Home Malware Programs Rogue Anti-Spyware Programs AVDefender 2011

AVDefender 2011

Posted: August 26, 2010

AVDefender 2011 (or AV Defender 2011) is a rogue malware remover which uses the Windows platform to do its devious dirty work. AV Defender 2011 pretends to be a Windows product and uses fake warning messages to scare users into purchasing its rogue software. AVDefender 2011 convinces unwary computer users that the PC is infected with malware before advertising itself as a solution to remove the so-called threats. Do not trust AV Defender 2011 and have it removed immediately using a reliable anti-spyware software.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %UserProfile%\Local Settings\Application Data\[random]\
    2 %UserProfile%\Local Settings\Application Data\[random]\avdefender 2011.exe
    3 %UserProfile%\Local Settings\Application Data\[random]\sysguard.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = "1"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyOverride" = ""HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:5555"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = ".exe"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = "1"HKEY_CURRENT_USER\Software\avdefender 2011KEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[random]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[random]"
Loading...