Hoax.HTML.OdKlas.a

Technical Details
Payload
Removal instructions

Technical Details

This hoax program imitates an anonymizer service allowing the user to get access to blocked "Odnoklassniki.ru" site. It is an HTML document. It is 3367 bytes in size.

Payload

When the user opens the fraudulent resource in the browser, this HTML document opens in a frame on the main page. The domain names of such fraudulent resources nearly match the "Odnoklassniki.ru" site or have very similar names, for example:

www.odn***sswiki.ru

Once the page is opened, the user is asked to use the anonymizer service to get access to the "Odnoklassniki.ru" site.

The user is then asked to send 2 SMS messages to one of the premium rate numbers:

3***47
1***61
1***71 

with the text

5***45

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Delete the original program file (its location will depend on how the program originally penetrated the infected computer).
2. Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?).
3. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

MD5: c96512e452355737c47a9bedbe0aef68
SHA1: 065df2ba8443f562b49a3a0a9899a03e990ca677