Home Rogue Websites Vm-onlinescan.net

Vm-onlinescan.net

Posted: April 15, 2009

Another in the long line of browser hijacker websites, Vm-onlinescan.net promotes the rogue anti-spyware program called Virus Sweeper. By way of a Trojan virus infiltrating your PC via security exploits, browser settings become altered in order to interrupt your web-surfing activities and redirect you to the Vm-onlinescan.net web page.

With the fraudulent online scan Vm-onlinescan.net provides, you are sure to find your computer riddled with infections, none of which actually exist. This serves to persuade you into purchasing the fake spyware remover Virus Sweeper, which will do nothing for your system other than slow down your computer’s performance and degrade internet connection speed.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %\Documents and Settings%\All Users\Application Data\7c69f0c
    2 %\Documents and Settings%\All Users\Application Data\7c69f0c\LoopSystem
    3 %\Documents and Settings%\All Users\Application Data\7c69f0c\LoopSystem\vd952342.bd
    4 %\Documents and Settings%\All Users\Application Data\7c69f0c\VSweep.exe
    5 %\Documents and Settings%\All Users\Application Data\LoopSystem
    6 %\Documents and Settings%\All Users\Application Data\LoopSystem\swcfg.ini
    7 %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Virus Sweeper.lnk
    8 %UserProfile%\Application Data\Virus Sweeper
    9 %UserProfile%\Application Data\Virus Sweeper\Instructions.ini
    10 %UserProfile%\Desktop\Virus Sweeper.lnk
    11 %UserProfile%\Recent\ANTIGEN.drv
    12 %UserProfile%\Recent\cb.dll
    13 %UserProfile%\Recent\CLSV.dll
    14 %UserProfile%\Recent\energy.exe
    15 %UserProfile%\Recent\exec.dll
    16 %UserProfile%\Recent\fix.sys
    17 %UserProfile%\Recent\PE.exe
    18 %UserProfile%\Recent\PE.sys
    19 %UserProfile%\Recent\ppal.tmp
    20 %UserProfile%\Recent\snl2w.drv
    21 %UserProfile%\Recent\tjd.exe
    22 %UserProfile%\Recent\tjd.tmp
    23 %UserProfile%\Start Menu\Programs\Virus Sweeper.lnk
    24 %UserProfile%\Start Menu\Virus Sweeper.lnk

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "97680312703"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Virus Sweeper"HKEY..\..\..\..{RegistryKeys}HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}HKEY_CLASSES_ROOT\VSweep.DocHostUIHandler
Loading...