Home Rogue Websites Scan4base.info

Scan4base.info

Posted: April 28, 2009

Scan4base.info is a fake online scanning page designed to mislead people into thinking their computers are infected. Scan4base.info promotes the Internet Antivirus Pro rogue anti-spyware program and acts by applying a series of browser redirections that are triggered by affiliated trojans. Due to the modification of browser settings due to these trojans, web-surfing activities are diverted to the Scan4base.info domain. Herein your computer will find itself being scanned by a fraudulent online scanner, which reports numerous infections that are also fake. This is all to ensure you purchase and install the fake spyware remover Internet Antivirus Pro out of fear.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %APPDATA%\Microsoft\Windows\winlogon.exe
    2 %LOCAL APPDATA%\Microsoft\Internet Explorer\iv.exe
    3 %LOCAL APPDATA%\Microsoft\Windows\services.exe
    4 %Program Files%\Internet Antivirus Pro\iapro.exe
    5 iainstall.exe
    6 iapro.exe
    7 install.exe
    8 InternetAntivirusPro.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Internet Antivirus ProHKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Policies\Explorer\run "iv":HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Run "Internet Antivirus Pro"HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Runonce "3p_udec_ia"
Loading...