Home Malware Programs Spyware RankScan4.info

RankScan4.info

Posted: May 15, 2009

RankScan4.info is a rogue website sponsoring the fake spyware remover called Internet Antivirus Pro. It achieves this goal by infiltrating your system with affiliated trojans that alter your browser settings, causing your web-surfing activities to be diverted to the RankScan4.info webpage. Here your PC is subject to a fake online scan that displays bogus infection reports, all in order to scare you into purchasing the Internet Antivirus Pro software.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 c:\program files\Internet Antivirus\
    2 IAPro.exe
    3 ska.dll
    4 ska.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKCU\..\Policies\Explorer\Run: [iv] "%UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer\iv.exe"HKCU\..\Run: [Internet Antivirus] "c:\program files\Internet Antivirus\IAvir.exe" /sHKCU\..\RunOnce: [3P_UDEC_IA] "%UserProfile%\Desktop\IAInstall.exe" 0;C;user_id=165639&uid=0
Loading...