Alphaantivir.microsoft.com
Alphaantivir.microsoft.com (or Alphaantivir.com) is a deceitful domain that promotes the rogueware called AntiSpyware Soft. Alphaantivir.microsoft.com can be placed into a computer's Host file by Trojans, causing the machine browser to be frequently redirected to the criminal website. Alphaantivir.microsoft.com may display fake security alerts and warning messages to persuade users that their machines are infected and they need to purchase AntiSpyware Soft in order to remove all the "detected" threats. Users should ignore all security notifications displayed on Alphaantivir.microsoft.com and use a reliable security tool to remove all malware associated with the website.
File System Details
Alphaantivir.microsoft.com may create the following file(s):
| # | File Name |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|
| 1. | %UserProfile%\Local Settings\Application Data\{random}tssd.exe |
Registry Details
Alphaantivir.microsoft.com may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:5555"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "{random}"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyEnable" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyOverride" = "
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = "no"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = ".exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "{random}"
