BlockProtector, BlockWatcher, BlockScanner and BlockKeeper

5 November 2009 Rogue 0 Comment

BlockProtector, BlockWatcher, BlockScanner and BlockKeeper are breeds of fake antivirus program and are members of the circle where QuickHealCleaner and TrustWarrior also belong. These type of programs where conceived as a moneymaker for its  developer. BlockProtector will use the Internet to spread itself. Sometimes with the help of a Trojan that can bypass antivirus program, installing this unwanted application on computers is unknown to user.

When inside the system, BlockProtector virus will configure to run itself during Windows start-up. It will demonstrate its own virus scanning process and will detect dozens of virus found on your system. These infections are non-existent and are displayed to draw user’s interest into purchasing the license version of BlockProtector. Instead of obtaining it, we are suggesting you to download a legitimate anti-malware program that can be used as BlockProtector removal tool. It is free, effective and most of all, it is one legal program that effectively demonstrates its power to combat computer virus.

Screen Shot Images:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Characteristics (Analysis)
BlockProtector, BlockWatcher, BlockScanner and BlockKeeper are rogue security software. Unlike Trojans and viruses, rogues do not reproduce once it enters the system. They usually propagate by means of another Trojan infection, fake security web sites, bogus software updates and cracked programs. Infection of rogue programs leads to modification of system registry that allows the software to run during Windows start-up.

Malware Behavior
When this rogue is installed on the computer, it continuously pop-up an alert messages stating several threats are detected. The alert reads similar to this:

Spyware Alert!
Your computer is infected with spyware. It could damage your critical files or expose your private data on the Internet. Click here to register your copy of BlockProtector and remove spyware threats from your PC.

Added Registry Entries:

HKCU\Software\BlockProtector
HKLM\SOFTWARE\BlockProtector
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BlockProtector
HKCU\Software\Microsoft\Windows\CurrentVersion\Run "rwb4.tmp.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "BlockProtector.exe" 

Associated Files and Folders:

C:\Documents and Settings\User\Desktop\BlockProtector.lnk
C:\Documents and Settings\User\Start Menu\Programs\BlockProtector.lnk
C:\Program Files\BlockProtector Software
C:\Program Files\BlockProtector Software\BlockProtector
C:\Program Files\BlockProtector Software\BlockProtector\BlockProtector.exe
C:\Program Files\BlockProtector Software\BlockProtector\Uninstall.exe
C:\WINDOWS\2314szyware4512.exe
C:\WINDOWS\23145th5zf32664.cpl
C:\WINDOWS\22145zpy1f51.exe
C:\WINDOWS\system32\112steal45z0.ocx
C:\WINDOWS\system32\125eb9ckdoor1z421.cpl
C:\WINDOWS\system32\35z0sp9rse541.bin
%Temp%\rwb4.tmp.exe 

1. Kill any running process that belongs to BlockProtector, BlockWatcher, BlockScanner and BlockKeeper.
- Press Ctrl+Alt+Del on your keyboard.
- When Windows Task Manager appears, look for the following files and click End Task.
Protector.exe, rwb4.tmp.exe or (random).exe

2. Delete all registry entries that belong to this malware.
- Press [Windows Key]+R on your keyboard.
- In the 'Open' dialog box, type regedit. This will open registry editor.
- Find and delete the following:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "BlockProtector.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "rwb4.tmp.exe"
- Close registry editor. Changes made will be save automatically.

3. Scan the computer with antivirus program.
- Connect to Internet and open your antivirus software. Please Update to obtain the latest database and necessary files.
- Restart the computer in Safe Mode.
- Just before Windows logo begins to load press F8 on your keyboard.
- On Windows Advanced Boot Options, select Safe Mode and press Enter.

4. Delete all files dropped by BlockProtector, BlockWatcher, BlockScanner and BlockKeeper.
- While still in Safe Mode, search and delete malicious files. Please refer to 'Associated Files and Folders.'

Automatic Removal of BlockProtector, BlockWatcher, BlockScanner and BlockKeeper

In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.