Home Malware Programs Browser Hijackers Safetyonlinepage

Safetyonlinepage

Posted: December 13, 2007

Safetyonlinepage is a nasty browser hijacker that results from a Zlob Trojan infection. Once installed onto your computer, Zlob will bombard you with hundreds of popup Warning messages claiming that your computer is infected. Warning messages may look like the following: "Critical System Error", "Your computer is infected", "System Alert", "Trojan-Spy.win32@mx", "Internet connection speed decreased by 39%" and so on. This is the way how Safetyonlinepage attempts to trick you into buying a rogue anti-spyware application (such as AntiSpyGolden, AntiVirGear, VirusHeal, etc.).

File System Modifications

  • The following files were created in the system:
    # File Name
    1 fdpzgi.dll
    2 gtawclv.dll
    3 iesuninst.exe
    4 isamini.exe
    5 isamonitor.exe
    6 isfmdl.dll
    7 khtbpdl.dll
    8 Online Security Guide.url
    9 pmmon.exe
    10 pmsngr.exe
    11 Security Troubleshooting.url
    12 veptlh.dll
    13 vjxwnn.dll
    14 vmlwp.dll

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70d17a5f-ef27-4295-90f5-20ad6f24834f}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80ced3d6-ece9-48ba-8df8-2503d8d87c2b}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D61D7E1A-6613-49CA-B6F9-51DB248E209D}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{aa6d4f53-4c8d-4549-84d2-02d584acc4e9}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper objects\{D61D7E1A-6613-49CA-B6F9-51DB248E209D}HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}IExplorer Security Plug-inInternet Explorer Secure BarMessenger Service
Loading...