Home Rogue Websites OnlineProtect-ExtraAntivir.com

OnlineProtect-ExtraAntivir.com

Posted: April 15, 2009

Onlineprotect-extraantivir.com is a browser hijacker promoting the rogue anti-spyware application called Extra Antivir. By way of a Trojan that infiltrates your system and modifies your browser settings, you will find your web-surfing activities becoming interrupted and you will be diverted to the Onlineprotect-extraantivir.com domain.

Once here, you will be subject to a bogus online scan that will inform you of the many and varied parasites infecting your system, none of which actually exist. This is an effort to intimidate you into purchasing the Extra Antivir rogue anti-spyware program. Do not fall for it. Instead, remove Onlineprotect-extraantivir.com immediately upon detection.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %UserProfile%\Application
    2 %UserProfile%\Application Data\Extra Antivir
    3 %UserProfile%\Application Data\Extra Antivir\Extra Antivir.ini
    4 Data\install_511_MHwzNnwxMDAwMDAwMDAwfHx8fHx8fHw_\base.dat
    5 Data\install_511_MHwzNnwxMDAwMDAwMDAwfHx8fHx8fHw_\base2.dat
    6 Data\install_511_MHwzNnwxMDAwMDAwMDAwfHx8fHx8fHw_\Desc.dat
    7 Data\install_511_MHwzNnwxMDAwMDAwMDAwfHx8fHx8fHw_\spline.dat

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Extra Antivir
Loading...