Home Malware Programs Browser Hijackers Spywarewebsiteblock.com

Spywarewebsiteblock.com

Posted: October 2, 2009

Spywarewebsiteblock.com is a web browser hijacker that is able to redirect computer users to a website that promotes the Alpha Antivirus rogue anti-spyware program. Spywarewebsiteblock.com is known to change settings within a web browser application without permission from the computer user. When visited, Spywarewebsiteblock.com will display fabricated warning messages and that can lead to a landing page that sells the Alpha Antivirus application.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Program Files%\AlphaAV
    2 %Program Files%\AlphaAV\AlphaAV.exe
    3 %UserProfile%\Desktop\Alpha Antivirus.lnk
    4 %WINDOWS%\system32\drivers\NDISRD.sys
    5 %WINDOWS%\system32\msnaoladdon.dll
    6 %WINDOWS%\system32\ndisapi.dll
    7 %WINDOWS%\system32\NetFilter.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Alpha AntivirusHKEY_LOCAL_MACHINE\Software\Alpha AntivirusHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "Alpha Antivirus"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "AlphaAV"HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}Alpha Antivirus
Loading...