Pcsecurity-2009.com
Pcsecurity-2009.com is a browser hijacker promoting the rogue anti-spyware application known as PC Security 2009. Due to affiliated trojans infiltrating the computer via security exploits and modifying the browser settings, web-surfing activities are redirected to the Pcsecurity-2009.com domain. Once here, the computer is subject to a fake online scan that displays fictitious and sometimes grossly exaggerated infection results, all in order to intimidate the user into purchasing the fake spyware remover PC Security 2009.
File System Details
Pcsecurity-2009.com may create the following file(s):
| # | File Name |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|
| 1. | %Program Files%\PC_Security2009\PC_Security2009.exe | |
| 2. | %Program Files%\PC_Security2009\Microsoft.VC80.CRT\msvcm80.dll | |
| 3. | %WINDOWS%\bezyneluri.dll | |
| 4. | %Documents and Settings%\All Users\Documents\emytijy.bat | |
| 5. | %Program Files%\PC_Security2009\htmlayout.dll | |
| 6. | %Program Files%\PC_Security2009\Uninstall.exe | |
| 7. | %Program Files%\PC_Security2009\Microsoft.VC80.CRT\msvcr80.dll | |
| 8. | %Documents and Settings%\All Users\Application Data\juvugyx.sys | |
| 9. | %UserProfile%\Cookies\qyciq.exe | |
| 10. | %Program Files%\PC_Security2009\AVEngn.dll | |
| 11. | %Program Files%\PC_Security2009\pthreadVC2.dll | |
| 12. | %Program Files%\PC_Security2009\Microsoft.VC80.CRT\msvcp80.dll | |
| 13. | %Documents and Settings%\All Users\Application Data\imevata.exe | |
| 14. | %Documents and Settings%\All Users\Documents\uzasezo.bat | |
| 15. | %Program Files%\Common Files\wepyta._sy | |
| 16. | %Program Files%\PC_Security2009\data | |
| 17. | %Program Files%\PC_Security2009\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest | |
| 18. | %WINDOWS%\uwojevuk.reg | |
| 19. | %WINDOWS%\system32\exeneqaze.vbs | |
| 20. | %WINDOWS\system32\xyluny.dat | |
| 21. | %UserProfile%\Application Data\ciwizatyvo.vbs | |
| 22. | %UserProfile%\Application Data\netekoh.pif | |
| 23. | %UserProfile%\Desktop\PC_Security2009.lnk | |
| 24. | %UserProfile%\Local Settings\Temporary Internet Files\teqiqu.dl | |
| 25. | %UserProfile%\Start Menu\Programs\PC_Security2009\PC_Security2009.lnk | |
| 26. | %Program Files%\Common Files\sisejemaqy.pif | |
| 27. | %Program Files%\PC_Security2009\wscui.cpl | |
| 28. | %Program Files%\PC_Security2009\Microsoft.VC80.CRT | |
| 29. | %WINDOWS%\jagavodo._dl | |
| 30. | %WINDOWS%\system32\_scui.cpl | |
| 31. | %WINDOWS%\system32\loturyk.db | |
| 32. | %Documents and Settings%\All Users\Application Data\tihavodyru.dl | |
| 33. | %UserProfile%\Application Data\huwo.lib | |
| 34. | %UserProfile%\Cookies\tufubyvyv.inf | |
| 35. | %UserProfile%\Local Settings\Temporary Internet Files\ehyzubi.ban | |
| 36. | %UserProfile%\Start Menu\Programs\PC_Security2009 | |
| 37. | %Program Files%\Common Files\edydule.db | |
| 38. | %Program Files%\PC_Security2009 | |
| 39. | %Program Files%\PC_Security2009\data\daily.cvd | |
| 40. | %WINDOWS%\hitamoja.db | |
| 41. | %WINDOWS%\xyqimomyte.inf | |
| 42. | %WINDOWS%\system32\ezecep.scr | |
| 43. | %Documents and Settings%\All Users\Application Data\hipeh.vbs | |
| 44. | %Documents and Settings%\All Users\Documents\etycipifez._sy | |
| 45. | %UserProfile%\Application Data\equcetovyf.scr | |
| 46. | %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\PC_Security2009.lnk | |
| 47. | %UserProfile%\Local Settings\Application Data\dofevura.ban | |
| 48. | %UserProfile%\Local Settings\Temporary Internet Files\xujite.vbs | |
| 49. | %UserProfile%\Start Menu\Programs\PC_Security2009\Uninstall.lnk |
Registry Details
Pcsecurity-2009.com may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Control Panel\don't load "scui.cpl"
HKEY_LOCAL_MACHINE\SOFTWARE\PC_Security2009
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "PC Security 2009"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC_Security2009
HKEY_CURRENT_USER\Control Panel\don't load "wscui.cpl"
