Www1.useclean-atyour-sys.in
Www1.useclean-atyour-sys.in is a misleading website that is involved in the malvertising of Security Antivirus. Only victims that have previously been infected with Trojans related to www1.useclean-atyour-sys.in will encounter the malicious domain. Once a victim has visited www1.useclean-atyour-sys.in a fake online system scan will be run and the victim will be informed that his/her system is severely infected with harmful computer parasites. Bogus security alerts and pop-ups will also be launched to further scare the victim into purchasing the rogue Security Antivirus. Do not trust anything from www1.useclean-atyour-sys.in or Security Antivirus they are malicious programs that should be removed upon detection.
File System Details
Www1.useclean-atyour-sys.in may create the following file(s):
| # | File Name |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|
| 1. | SA345d.exe | |
| 2. | %Documents and Settings%\All Users\Application Data\345d567\SA345d.exe | |
| 3. | %Documents and Settings%\[UserName]\Recent\cid.dll | |
| 4. | %Documents and Settings%\[UserName]\Recent\ddv.sys | |
| 5. | %Documents and Settings%\[UserName]\Recent\runddlkey.dll | |
| 6. | PE.exe | |
| 7. | %Documents and Settings%\All Users\Application Data\345d567\mozcrt19.dll | |
| 8. | %Documents and Settings%\[UserName]\Recent\ANTIGEN.exe | |
| 9. | %Documents and Settings%\[UserName]\Recent\ddv.dll | |
| 10. | %Documents and Settings%\[UserName]\Recent\PE.sys | |
| 11. | %Documents and Settings%\[UserName]\Recent\tjd.sys | |
| 12. | ANTIGEN.exe | |
| 13. | Std.exe | |
| 14. | %Documents and Settings%\All Users\Application Data\345d567\sqlite3.dll | |
| 15. | %Documents and Settings%\[UserName]\Recent\DBOLE.sys | |
| 16. | %Documents and Settings%\[UserName]\Recent\PE.exe | |
| 17. | %Documents and Settings%\[UserName]\Recent\std.exe | |
| 18. | %Documents and Settings%\All Users\Application Data\345d567\SAV.ico | |
| 19. | %Documents and Settings%\All Users\Application Data\345d567\BackUp\Adobe Reader Synchronizer.lnk | |
| 20. | %Documents and Settings%\All Users\Application Data\345d567\SAVSys\vd952342.bd | |
| 21. | %Documents and Settings%\[UserName]\Application Data\Microsoft\Internet Explorer\Quick Launch\Security Antivirus.lnk | |
| 22. | %Documents and Settings%\[UserName]\Recent\ANTIGEN.drv | |
| 23. | %Documents and Settings%\[UserName]\Recent\FS.drv | |
| 24. | %Documents and Settings%\[UserName]\Recent\PE.tmp | |
| 25. | %Documents and Settings%\[UserName]\Start Menu\Programs\Security Antivirus.lnk | |
| 26. | %Documents and Settings%\All Users\Application Data\345d567\72.mof | |
| 27. | %Documents and Settings%\All Users\Application Data\345d567\BackUp\Adobe Reader Speed Launch.lnk | |
| 28. | %Documents and Settings%\All Users\Application Data\345d567\SAVSys | |
| 29. | %Documents and Settings%\[UserName]\Application Data\Security Antivirus | |
| 30. | %Documents and Settings%\[UserName]\Desktop\Security Antivirus.lnk | |
| 31. | %Documents and Settings%\[UserName]\Recent\energy.tmp | |
| 32. | %Documents and Settings%\[UserName]\Recent\PE.drv | |
| 33. | %Documents and Settings%\[UserName]\Start Menu\Security Antivirus.lnk | |
| 34. | %Documents and Settings%\All Users\Application Data\345d567 | |
| 35. | %Documents and Settings%\All Users\Application Data\345d567\BackUp | |
| 36. | %Documents and Settings%\All Users\Application Data\345d567\Quarantine Items | |
| 37. | %Documents and Settings%\All Users\Application Data\SADFIOPODIV\SAAKDUPV.cfg | |
| 38. | %Documents and Settings%\[UserName]\Application Data\Security Antivirus\cookies.sqlite | |
| 39. | %Documents and Settings%\[UserName]\Recent\CLSV.drv | |
| 40. | %Documents and Settings%\[UserName]\Recent\gid.drv | |
| 41. | %Documents and Settings%\[UserName]\Recent\tjd.drv | |
| 42. | %Program Files%\Mozilla Firefox\searchplugins\search.xml |
Registry Details
Www1.useclean-atyour-sys.in may create the following registry entry or registry entries:
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala.com/?&uid=195&q={searchTerms}"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = "1"
HKEY_CLASSES_ROOT\SA345d.DocHostUIHandlr
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer "PRS" ="http://127.0.0.1:27777/?inj=%ORIGINAL%"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Security Antivirus"
HKEY_CURRENT_USER\Software\3
HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala.com/?&uid=195&q={searchTerms}"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "App/7.00195"
