Home Rogue Websites Protection-estore.com

Protection-estore.com

Posted: December 4, 2009

Protection-estore.com is the official rogue website page related to the malicious anti-spyware program known as Personal Security. PC users get redirected to Protection-estore.com via malicious trojans which invade the system and download the Protection-estore.com hijacker. Protection-estore.com uses misleading descriptions which claim Personal Security is the "Best Spyware Protection" software. Personal Security is a scam and Protection-estore.com is not a website to be trusted so do not click anything on it. If you're getting diverted to Protection-estore.com, you need to get rid of the trojans associated with this annoying hijacker and remove Protection-estore.com immediately.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Documents and Settings%\All Users\Start Menu\PSecurity
    2 %Documents and Settings%\All Users\Start Menu\PSecurity\Computer Scan.lnk
    3 %Documents and Settings%\All Users\Start Menu\PSecurity\Help.lnk
    4 %Documents and Settings%\All Users\Start Menu\PSecurity\Personal Security.lnk
    5 %Documents and Settings%\All Users\Start Menu\PSecurity\Registration.lnk
    6 %Documents and Settings%\All Users\Start Menu\PSecurity\Security Center.lnk
    7 %Documents and Settings%\All Users\Start Menu\PSecurity\Settings.lnk
    8 %Documents and Settings%\All Users\Start Menu\PSecurity\Update.lnk
    9 %Program Files%\Common Files\PSecurityUninstall
    10 %Program Files%\Common Files\PSecurityUninstall\Uninstall.lnk
    11 %Program Files%\PSecurity
    12 %Program Files%\PSecurity\psecurity.exe
    13 %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\PSecurity.lnk
    14 %UserProfile%\Desktop\Personal Security.lnk
    15 %WINDOWS%\system32\win32extension.dll

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "PSecurity"HKEY_LOCAL_MACHINE\SOFTWARE\5FFB10D58FFCF482208906E6A889FD56HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\post platform "WinTSI 01.12.2009"HKEY..\..\..\..{RegistryKeys}HKEY_CLASSES_ROOT\CLSID\{35A5B43B-CB8A-49CA-A9F4-D3B308D2E3CC}
Loading...