AV Defender

4 July 2010 Rogue 0 Comment

AV Defender is a security program that may cause system crashes and various errors on the computer it was installed. This is why AV Defender was categorized as rogue or potentially unwanted program. Not to mention that it was carried out and being spread via Trojan and scam web sites. Users must prevent this program from entering the computer by blocking sites that are promoting it. An updated anti-virus program is also useful to avoid attack by AV Defender virus. Once this fake program is installed on computer, annoyances will begin to experience including excessive pop-up alerts, stating that computer is infected with some form of malware and viruses. A frequent virus scanning is also presented to support its allegation regarding poor security status of the computer.

These scary tactics by AV Defender must be ignored totally. It was just trying to deceive computer users so that they will be force to obtain the licensed version of the program. AV Defender was installed on the system barely to perform fake scans and has no functionalities to remove virus and protect a computer from security threats. In fact, it does not even have an entry on the Add/Remove program of Windows. This was done purposely to prevent its removal from the system and enhance its presence by pulling down additional threats from its own server.

AV Defender Screen Shot:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Download V Defender Removal Tool:
For automatic removal of  AV Defender, download, install and update a copy of SuperAntiSpyware. If it was blocked, better download it from a clean computer before installing on the affected system.

Technical Details and Additional Information:

Various modifications will be done on the infected system to perform its task such as:
- Disable Antivirus and other security programs.
- Spread itself on the network.
- Install additional malware.
- Display fake warning and alert messages.
- Hijack homepage of Internet browser.

Malicious Files Added by AV Defender:
c:\Documents and Settings\All Users\Microsoft PData
c:\Documents and Settings\All Users\Microsoft PData\track.wid
%UserProfile%\Desktop\AV Defender.lnk
%UserProfile%\Start Menu\Programs\AV Defender
%UserProfile%\Start Menu\Programs\AV Defender\AV Defender.lnk
c:\Program Files\AV Defender
c:\Program Files\AV Defender\advanceddefender.exe
c:\Program Files\AV Defender\base.wdb
c:\Program Files\AV Defender\baseadd.wdb
c:\Program Files\AV Defender\conf.wcf
c:\Program Files\AV Defender\quarant.wdb
c:\Program Files\AV Defender\q
c:\WINDOWS\certofsystem.exe
c:\WINDOWS\explorers.exe
c:\WINDOWS\microsoftdefend.dll
c:\WINDOWS\regp.exe
c:\WINDOWS\secureit.com
c:\WINDOWS\spoos.exe
c:\WINDOWS\system32\winscent.exe

AV Defender Registry Entries:
HKEY_LOCAL_MACHINE\SOFTWARE\AV Defender
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AV Defender
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = “1″
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “avdefender”