Home Rogue Websites Virusalarm-Scanvirus.net

Virusalarm-Scanvirus.net

Posted: April 15, 2009

Virusalarm-scanvirus.net (also known as Virusalarm-scanvirus.com) is a browser hijacker that promotes the rogue anti-spyware application, Virus Sweeper. By way of intricate pranks pulled by the Trojans infiltrating your system via security exploits, your browser settings become undoubtedly modified in order to interrupt web surfing activities and redirect you to the Virusalarm-scanvirus.net domain.

Once you arrive at this web page, a fake online scanner checks your system and, surprise surprise, dozens of irritating pop-up ads and security alert messages begin bombarding your screen, notifying you of the various viruses infecting your PC. Of course, these parasites are all nonexistent, and are nothing more than a tactic used to scare you into purchasing Virus Sweeper in order to combat this attack. It is important to note, however, that Virus Sweeper does nothing and is a complete waste of money.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %\Documents and Settings%\All Users\Application Data\7c69f0c
    2 %\Documents and Settings%\All Users\Application Data\7c69f0c\LoopSystem
    3 %\Documents and Settings%\All Users\Application Data\7c69f0c\LoopSystem\vd952342.bd
    4 %\Documents and Settings%\All Users\Application Data\7c69f0c\VSweep.exe
    5 %\Documents and Settings%\All Users\Application Data\LoopSystem
    6 %\Documents and Settings%\All Users\Application Data\LoopSystem\swcfg.ini
    7 %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Virus Sweeper.lnk
    8 %UserProfile%\Application Data\Virus Sweeper
    9 %UserProfile%\Application Data\Virus Sweeper\Instructions.ini
    10 %UserProfile%\Desktop\Virus Sweeper.lnk
    11 %UserProfile%\Recent\ANTIGEN.drv
    12 %UserProfile%\Recent\cb.dll
    13 %UserProfile%\Recent\CLSV.dll
    14 %UserProfile%\Recent\energy.exe
    15 %UserProfile%\Recent\exec.dll
    16 %UserProfile%\Recent\fix.sys
    17 %UserProfile%\Recent\PE.exe
    18 %UserProfile%\Recent\PE.sys
    19 %UserProfile%\Recent\ppal.tmp
    20 %UserProfile%\Recent\snl2w.drv
    21 %UserProfile%\Recent\tjd.exe
    22 %UserProfile%\Recent\tjd.tmp
    23 %UserProfile%\Start Menu\Programs\Virus Sweeper.lnk
    24 %UserProfile%\Start Menu\Virus Sweeper.lnk

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF} HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "97680312703"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Virus Sweeper"HKEY..\..\..\..{RegistryKeys}HKEY_CLASSES_ROOT\VSweep.DocHostUIHandler
Loading...