Home Malware Programs Browser Hijackers Mjadmen.com

Mjadmen.com

Posted: April 2, 2010

Mjadmen.com is a deceiving domain that uses malware advertising scams to get computer users to download and purchase the rogue anti-spyware program Virus Protector. Mjadmen.com may appear to be a security scanner that initiates a system scan only to return bogus results. Mjadmen.com is also known to popup up deceptive messages and notifications attempting to warn users of infections found on their system. Mjadmen.com can hijack a user's web browser leading them to an unwanted web site.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Documents and Settings%\[UserName]\Application Data\[random].dll
    2 %Documents and Settings%\[UserName]\Application Data\[random].exe
    3 %Documents and Settings%\[UserName]\Local Settings\Temp\[random].dll
    4 %Documents and Settings%\[UserName]\Local Settings\Temp\[random].exe
    5 %Program Files%\Internet Explorer\[random].dll
    6 %Program Files%\Internet Explorer\[random].exe
    7 %WINDOWS%\[random].dll
    8 %WINDOWS%\[random].exe
    9 %WINDOWS%\system32\[random].dll
    10 %WINDOWS%\system32\[random].exe
    11 %WINDOWS%\system32\drivers\[random].dll
    12 %WINDOWS%\system32\drivers\[random].exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Virus Protector"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows "AppInit_DLLs" = "[random].dll"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows "LoadAppInit_DLLs" = "1"
Loading...