Home Malware Programs Browser Hijackers Eprotectionline.com

Eprotectionline.com

Posted: August 7, 2007

Eprotectionline.com is another computer hijacker, which is installed through Trojan exploits and once executed it modifies Internet Explorer default home page and redirects the user to "http://eprotectionline.com". It attempts to threaten and get the user into purchasing the rogue anti-spyware program that is usually bundled with a Trojan. Usually Warning messages such as "Virus Alert", "Your Computer is Infected", "Security Alert" Trojan-Spy.win32@mx or "Spyware.Cyberlog-X infections" are displayed. Eprotectionline.com may pose a security risk to your computer and it should not be trusted as a safe website. It is recommended that you remove Eprotectionline.com Trojan immediately as to prevent additional harm to your computer and your privacy.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 Eprotectionline.com
    2 oksrqqu.dll
    3 pmmon .exe
    4 pmsngr.exe
    5 Video Access ActiveX Object

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_USERS\S-1-5-21-1614895754-1801674531-682003330-1005\Software\Internet SecurityHKEY..\..\..\..{RegistryKeys}HKEY_CLASSES_ROOT\CLSID\{84938242-5C5B-4A55-B6B9-A1507543B418}HKEY_CLASSES_ROOT\CLSID\{84938242-5C5B-4A55-B6B9-A1507543B418}\Implemented Categories\{00021493-0000-0000-C000-000000000046}HKEY_CLASSES_ROOT\CLSID\{84938242-5C5B-4A55-B6B9-A1507543B418}\Implemented CategoriesHKEY_CLASSES_ROOT\CLSID\{C1DF2728-8510-0773-96D8-5D0C1F27821B}HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}Internet Security
Loading...