Home Malware Programs Browser Hijackers Browsersafeon.com

Browsersafeon.com

Posted: October 21, 2009

Browsersafeon.com is a venomous Trojan that assists in the distribution of the rogue security application Alpha Antivirus. Browsersafeon.com spreads with the help of Trojans that specialize in the surreptitious infiltration of computer systems. Once inside the system, the Trojan will adjust the browser settings causing search results to be redirected to Browsersafeon[dot]com/block.php URL and will display a warning page that reads "Warning! Visiting this site may harm your computer!".

Along with the security warning comes the option to "Continue Unprotected" or "Get security software". Should you decide to get the security software, you will be directed to a page that advises you to purchase the rogueware Alpha Antivirus. Browsersafeon.com is a deceptive webpage that promotes dangerous programs.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Program Files%\AlphaAV
    2 %Program Files%\AlphaAV\AlphaAV.exe
    3 %UserProfile%\Desktop\Alpha Antivirus.lnk
    4 %WINDOWS%\system32\drivers\NDISRD.sys
    5 %WINDOWS%\system32\msnaoladdon.dll
    6 %WINDOWS%\system32\ndisapi.dll
    7 %WINDOWS%\system32\NetFilter.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Alpha AntivirusHKEY_LOCAL_MACHINE\Software\Alpha AntivirusHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "Alpha Antivirus"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "AlphaAV"HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}Alpha Antivirus
Loading...