Iron Protector

7 October 2010 Rogue 0 Comment

Iron Protector, also known as IronProtector virus is a clone of Iron Defender. These two shares the same graphical user interface that will provide a fake virus scan to misinform victims on the real security status of the computer. When Iron Protector is loaded on to the computer, it will produce dozens of annoyances and redundant warning messages. This technique is its effort to encourage target to purchase the registered version of Iron Protector. As expected, even with the licensed version, computer will remain to experience troubles particularly when executing installed applications. The fake program will disallow running of certain software especially those that were found to be security related.

Disregard rogue programs and all of its prompts and links. Most of all, never purchase them and use your credit card on their payment processing web sites. It may record your banking details and will be used for other fraudulent online transactions. Remove Iron Protector automatically with the recommended anti-malware on this page.

Iron Protector Screen Shot:

This is how the Iron Protector virus scanner looks like

Critical Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Iron Protector Removal Procedures

Manual Removal:
1. Stop Iron Protector process by pressing Ctrl+Alt+Del. Windows Task Manager will open. Look for the following process:
(random characters).exe

2. Update your installed anti-virus program.
3. Run a full system scan and clean/delete all detected infected file(s). A manual removal of virus-related files should also be performed.
4. Edit Windows registry and delete Iron Protector entries. [how to edit registry]
5. Exit registry editor.
6. Remove Iron Protector start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. System Configuration Utility will open. Go to Startup tab and uncheck the following Startup item(s):
(random characters).exe

7. Click Apply and restart Windows.

Iron Protector Removal Tool:
In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.

Online Virus Scanner:
Another way to remove a virus without the need to install additional anti-virus application is to perform a thorough scan with free Online Virus Scanner that can be found here or on websites of legitimate anti-virus and security provider.

Technical Details and Additional Information:

Malicious Files Added by Iron Protector:
%Program Files%\FDFCA\F0E84.exe
%Program Files%\FDFCA\Uninstall.exe
%Documents and Settings%\All Users\Start Menu\Programs\IronProtector.lnk
%WINDOWS%\.dll
%WINDOWS%\.bin
%WINDOWS%\.cpl
%WINDOWS%\system32\.cpl
%WINDOWS%\system32\.exe
%WINDOWS%\system32\.bin
%UserProfile%\Desktop\IronProtector.lnk
%UserProfile%\Local Settings\Temp\.exe

Iron Protector Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “.exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “TrayScan”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “F0E84.exe”
HKEY_CURRENT_USER\Software\IronProtector
HKEY_LOCAL_MACHINE\SOFTWARE\IronProtector
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IronProtector