Register your computer’s security software

2 December 2009 Hijacker 1 Comment

“Register your computer’s security software” is a browser hijacker that will pretend as an Internet browser’s error page in order to divert user’s attention into downloading a rogue program called Personal Security. If this error persists on computer, it signifies that existing Trojan has made adjustments on system settings and Internet browser’s configuration to receive fake error page for every Internet access request.

If user clicks on “Register your computer’s security software”, the page will display a payment-processing web site that handles transaction for the acquisition of Personal Security licensed version.  The site will asks for user’s personal information and credit card details that will be charge accordingly based on chosen package.

We must insist that trial or paid version of rogue programs makes no difference particularly if computer’s protection is at risk. Rogue programs are made not to protect but rather generate profits for attackers behind it. “Register your computer’s security software” is just a part of this whole money-making scheme that targets naïve computer users.

Screen Shot Image:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Characteristics (Analysis)
On the first wave of the attack, Trojan will slips into target system through certain web browser’s exploit and security vulnerabilities. This entry may conceal the Trojan and evade antivirus detection. While inside the system, it primary objective is to promote the rogue application in a range of methods. It generates fake pop-up alerts and fabricated scan results to mislead victims. The same Trojan also modifies Internet browser’s settings that made “Register your computer’s security software” fake error page to appear each time user attempts to access the Internet. Fake page may contain this message:

This website has been reported as unsafe
We strongly recommend to discontinue the use of this website.
Register your computer’s security software
This website has been reported to Microsoft for containing threats that might steal personal or financial information from your computer.

1. Temporarily Disable System Restore (Windows Me/XP). [how to]
2. Open your antivirus application and update the virus definition file. This method ensures that your antivirus program can detect even newer variants of "Register your computer's security software"

3. Start Windows in Safe Mode with Networking.
- From a power-off state, turn on the computer and press F8 on your keyboard repeatedly.
- Your computer will display Windows Advanced Boot Options menu. Please select Safe Mode with Networking.
- The system will now boot Windows and loads only necessary drivers and files.

4. Open your antivirus program and run a full system scan. After the scan, delete all infected items. If unable, better place them in quarantine. Once the scan is complete, please proceed with the next step.

Online Virus Scanner:

Another way to remove "Register your computer's security software" without the need to install additional antivirus application is to perform a thorough scan with free online virus scanner that can be found here or on websites of legitimate anti-virus and security provider.

5. Go to Online Virus Scanner list and run a virus scan. This may require plug-ins, add-on or Activex object, please install if you want to proceed with scan.
6. After completing the necessary download, your system is now ready for online virus scanning.
7. Select an option in which you can thoroughly scan the computer to make sure that it will find and delete entirely all infections not detected on previous scan.
8. Remove or delete all detected items.
9. When scanning is finished you may now restart the computer in normal mode.

Automatic Removal of "Register your computer's security software"

In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.