Home Rogue Websites Online-Antivirus.net

Online-Antivirus.net

Posted: March 2, 2009

Online-Antivirus.net is a browser hijacker and rogue website that promotes and sells the bogus program AntiMalware 2009. Online-Antivirus.net may change your homepage to www.Online-Antivirus.net and displays numerous irritating pop-ups and fake notifications to trick you into purchasing AntiMalware 2009.

To restore the original default homepage, open IE > go to Tools > Internet Options > Type the URL address of your desired website > Click "Use Current" > click "OK". But restoring your hompepage manually does not necessarily mean that you've gotten rid of the infection that brought on the homepage hijacker. Online-Antivirus.net may be a sign that you've been infected with spyware or a trojan.

If, when Internet Explorer starts, you see any pop up windows telling you about a rogue anti-spyware program and how to remove spyware, then you're probably infected with a trojan and you will continue to be hijacked by Online-Antivirus.net. Sometimes the hijackers prevent you from changing the homepage, or may allow you to temporarily change the homepage only to have Online-Antivirus.net reappear later.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %common_desktopdirectory%\AntiMalware Pro.lnk
    2 %common_programs%\AntiMalware Pro.lnk
    3 %common_programs%\AntiMalware Pro\AntiMalware Pro.lnk
    4 %common_programs%\AntiMalware Pro\how to register AntiMalware Pro.lnk
    5 %common_programs%\AntiMalware Pro\license agreement.lnk
    6 %common_programs%\AntiMalware Pro\register AntiMalware Pro.lnk
    7 %common_programs%\AntiMalware Pro\uninstall.lnk
    8 %profile%\application data\microsoft\internet explorer\quick launch\AntiMalware Pro.lnk
    9 %program_files%\thcansj0e57c\database.dat
    10 %program_files%\thcansj0e57c\forceuninstall.exe
    11 %program_files%\thcansj0e57c\license.txt
    12 %program_files%\thcansj0e57c\mfc71.dll
    13 %program_files%\thcansj0e57c\mfc71enu.dll
    14 %program_files%\thcansj0e57c\msvcp71.dll
    15 %program_files%\thcansj0e57c\msvcr71.dll
    16 %program_files%\thcansj0e57c\thcansj0e57c.exe
    17 %program_files%\thcansj0e57c\thcansj0e57c.exe.local
    18 %program_files%\thcansj0e57c\uninstall.exe
    19 AntiMalware2009.exe
    20 AntiMalware2009Installer.exe
    21 antimalwareproinstaller.exe
    22 pphc3nsj0e57c.exe
    23 xpprotectorinstaller.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\AntiMalware ProHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "antimalware2009.exe"
Loading...