Home Malware Programs Browser Hijackers Buy-security-essentials.com

Buy-security-essentials.com

Posted: February 16, 2010

Buy-security-essentials.com is a malicious browser hijacker which makes surfing the net a complete nightmare. Buy-security-essentials.com is designed to promote the rogue anti-spyware product known as Security Essentials 2010. Once your system is infected with Security Essentials 2010 malware, which usually comes in form of a Trojan, you will continuously be redirected to the Buy-security-essentials.com website. The Buy-security-essentials.com webpage resembles a computer security scan and produces bogus results claiming the PC is infected with all sorts of malware. You will soon be bombarded by numerous warnings urging you to purchase Security Essentials 2010, which will apparently rid your PC of all known threats. This is a blatant scam, so do not become another victim of cyber crime and have Security Essentials 2010 and Buy-security-essentials.com removed from your computer with effective anti-spyware software.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Documents and Settings%\[UserName]\Application Data\[randomnumbers].exe
    2 %Documents and Settings%\[UserName]\Desktop\Security essentials 2010.lnk
    3 %Documents and Settings%\[UserName]\Start Menu\Security essentials 2010.lnk
    4 %Program Files%\Securityessentials2010\
    5 %Program Files%\Securityessentials2010\SE2010.exe
    6 %System%\smss32.exe
    7 %System%\winlogon32.exe
    8 %Temp%\[randomnumbers].dll
    9 %Temp%\[randomnumbers].exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilterHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\DomainsHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktopHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\SystemHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilterHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\DomainsHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktopHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
Loading...