Unavsoft.com

By JubileeX in Browser Hijackers

Unavsoft.com is a malicious website that you should avoid if you can. Obviously, you can't avoid visiting Unavsoft.com if your browser is taking you there on its own; in that case, do not believe anything you see on Unavsoft.com, and do not purchase the fake anti-virus software promoted on the site.

How the Unavsoft.com’s Hijacker Works?

As is the case with many malicious websites, Unavsoft.com has a browser hijacker that supports Unavsoft.com. This hijacker is also referred to as Unavsoft.com. The hijacker Unavsoft.com installs itself on your computer via a Trojan, which may be hidden in a file that you download or may download itself when you click on a malicious link. The Trojan sets up the hijacker, and after that, every time you try to go online, you either wind up at Unavsoft.com, or you get a "page blocked" window that says that your browser has prevented the website you were trying to view from opening. This window is fake, and it is part of the hijacker Unavsoft.com infection. How can you tell? If you click on the "more information" link at the bottom of the window, you are taken to Unavsoft.com.

Occasionally, there are reports of pop-up security alerts or advertisements generated by hijackers like Unavsoft.com. If you are frequently seeing unwanted pop-ups, and your browser is redirecting you to Unavsoft.com, please disregard anything that the pop-ups may tell you.

Unavsoft.com Misleading Website

The website Unavsoft.com promotes a rogue anti-virus application called Antivirus Monitor. The site contains only the bare minimum in content and appearance required to fool people into thinking that Antivirus Monitor is real software. Unavsoft.com has fake customer testimonials, a completely useless customer support email form, and a handful of very basic definitions of computer security terms that are repeated in several places on the site in order to take up space. The real reason for the existence of Unavsoft.com is its payment page, which is the endpoint of the Antivirus Monitor scam. You can pay for a "license" for Antivirus Monitor on Unavsoft.com, but if you do that, you will not actually receive anything for your money. Antivirus Monitor is malware, plain and simple, and if you give your credit card number to the crooks behind the scam, you put your finances at serious risk.

Unavsoft.com is not a unique website. In fact, Unavsoft.com is identical to several other malicious sites that promote Antivirus Monitor, including antivired.com, softbard.com, softbard.net, antiviran.com, and softwaream.com. Each of these sites claims to be the one and only site for the "company" selling Antivirus Monitor, and that in itself should raise suspicion. Also, if you look at the information for the domain of Unavsoft.com – the website registration and address – you find that there are several layers of false information hiding the true origins of Unavsoft.com. On the surface, it seems to be the case that Unavsoft.com is registered to someone in Missouri, but that information is stolen and fake. The truth comes out when you look at the IP address for Unavsoft.com.

Unavsoft.com currently is located at IP address 91.217.162.49, which traces back to Ukraine. It's also the same IP address as the previously mentioned, known malicious site antiviran.com! Based on its IP address, Unavsoft.com is reportedly hosted by a Ukraine-based hosting company, Tirexhost – but even that is misleading. Unavsoft.com may technically be based in Ukraine, but Tirexhost is run out of St. Petersburg, Russia, and Unavsoft.com is notorious for hosting malicious websites. In fact, there is not a single website hosted by Tirexhost that isn't malicious. This is where Unavsoft.com actually originates, with a hosting service located in one country and run from another, hosting hundreds of different malicious websites. Clearly, Unavsoft.com is not trustworthy in any way.

File System Details

Unavsoft.com may create the following file(s):
# File Name Detections
1. %Temp%\{RANDOM CHARACTERS}\{RANDOM CHARACTERS}.exe
2. %Temp%\{RANDOM CHARACTERS}

Registry Details

Unavsoft.com may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = 'http=127.0.0.1:18810'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyEnable" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter "Enabled" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyOverride" = "
HKEY_CURRENT_USER\Software\{RANDOM CHARACTERS}

Trending

Most Viewed

Loading...