Home Rogue Websites Scanplus4.info

Scanplus4.info

Posted: April 13, 2009

Scanplus4.info is deemed as a malicious hijacker website. Scanplus4.info could promote various rogue anti-spyware applications such as Internet Antivirus Pro as well as infect your system with other unknown parasites. Scanplus4.info may display an under construction message. Scanplus4.info could also hijack your web browser changing settings such as your home page URL. It is highly advisable that you never visit Scanplus4.info for any reason.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %APPDATA%\Microsoft\Windows\winlogon.exe
    2 %LOCAL APPDATA%\Microsoft\Internet Explorer\iv.exe
    3 %LOCAL APPDATA%\Microsoft\Windows\services.exe
    4 %Program Files%\Internet Antivirus Pro\iapro.exe
    5 iainstall.exe
    6 iapro.exe
    7 install.exe
    8 InternetAntivirusPro.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Internet Antivirus ProHKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Policies\Explorer\run "iv":HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Run "Internet Antivirus Pro"HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Runonce "3p_udec_ia"
Loading...