Home Rogue Websites Mostpopularscan.com

Mostpopularscan.com

Posted: March 18, 2009

Mostpopularscan.com is another browser hijacker and rogue website promoting a fake anti-spyware program. The fake anti-spyware program being peddled this time is System Security. Mostpopularscan.com will redirect your browser page to its own website. Once you're on its website your PC will become infected with a Trojan which will then produce a free online scanner that will report numerous infections on your PC. This scanner can not be trusted as its results are all fabricated in order to trick you into buying the counterfeit System Security application. Your PC screen may also display phony pop up ads and warning alerts that have the same intention of tricking you into buying a worthless program. Don't be conned by these underhanded methods. Instead remove the infection immediately.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %\Documents and Settings%\All Users\Application Data\538654387
    2 %\Documents and Settings%\All Users\Application Data\538654387\1632575944.exe
    3 %\Documents and Settings%\All Users\Application Data\538654387\config.udb
    4 %\Documents and Settings%\All Users\Application Data\538654387\init.udb
    5 %\Documents and Settings%\All Users\Application Data\538654387\Languages
    6 %\Documents and Settings%\All Users\Application Data\538654387\Languages\English.lng
    7 %\Documents and Settings%\All Users\Application Data\538654387\Languages\German.lng
    8 %\Documents and Settings%\All Users\Application Data\538654387\Languages\Spanish.lng
    9 %UserProfile%\Desktop\System Security.lnk
    10 %UserProfile%\Start Menu\Programs\System Security
    11 %UserProfile%\Start Menu\Programs\System Security\System Security.lnk

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "1632575944"
Loading...