SpywareProtection

SpywareProtection

Found: 
2011-01-24
Description: 

Win32.FraudTool.SpywareProtection is a rogue anti-spyware application. It may give exaggerated threat reports on the compromised computer then ask the user to purchase a registered version to remove those reported threats.

 

Credit: Tachikoma

Known system changes: 

Files

%AppData%\defender.exe

Folders


RegistryEntries

Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Value: Spyware Protection
Data: C:\Documents and Settings\VPCTest\Application Data\defender.exe