Home Rogue Websites TheOnlineSecurity.com

TheOnlineSecurity.com

Posted: April 24, 2009

Theonlinescanner.com is a browser hijacker and a fake online scanner promoting the rogue anti-spyware application called System Security 2009. Using nasty trojan viruses to infect computers and then modify browser settings, this ensures that all your web-surfing activities are eventually redirected to the Theonlinesecurity.com domain. Here your PC is subject to the fake online scanner mentioned earlier, which reports back a variety of infections, all of which are fake, of course. This is designed to scare you into purchasing the System Security 2009 fake spyware remover advertised, which does absolutely nothing to protect your system from parasites.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %\Documents and Settings%\All Users\Application Data\00308937\00308937.exe
    2 %\Documents and Settings%\All Users\Application Data\00308937\config.udb
    3 %\Documents and Settings%\All Users\Application Data\00308937\pc00308937ins
    4 %UserProfile%\Desktop\System Security 2009.lnk
    5 %UserProfile%\Start Menu\Programs\System Security\System Security 2009 Support.lnk
    6 %UserProfile%\Start Menu\Programs\System Security\System Security 2009.lnk

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\Software\00308937HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "00308937"HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}SystemSecurity2009
Loading...