Unlimited Defender

23 July 2011 Rogue 0 Comment

Unlimited Defender is a bogus security program that can steal money from a victim that falls into its trap. Unlimited Defender is a virus that will try to pretend as legal anti-virus software in order to convince user in acquiring the licensed version. Typically, this unwanted program can be obtained by visiting web sites that are contracted with Trojan Downloader. Those who got infected with it may unknowingly download and install a copy of Unlimited Defender. When inside the PC, this software will arrange the registry to give itself a start-up functions. It may disable any security-related program by ending running processes. Additionally, Unlimited Defender will block execution of installed programs and announce that it is infected with virus. As expected, a prompt to pay for the licensed version will pop-up and promote that full version of Unlimited Defender can clean the compromised computer.

Rogue application such as this must be eliminated instantly. There should be no room for Unlimited Defender to reside on one’s system to perform malicious actions. Getting infected with this bogus AV product can be prevented if only a full version of anti-malware program is protecting the computer. Just in case this unwanted product have invaded the system, a free version of anti-malware program is enough to remove it. Though, having the registered version of legitimate program with real-time scan is highly recommended to guard the PC against Unlimited Defender virus.

Screen Shot Image:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Unlimited Defender Removal Procedures

Unlimited Defender Removal Tool:
In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected computer.
Manual Removal:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “Unlimited Defender”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
(random characters).exe

2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the system and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to Unlimited Defender Virus.
4. Registry entries created by Unlimited Defender must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of Unlimited Defender start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
(random characters).exe

7. Click Apply and restart the computer.

Additional Useful Tools

Using Portable SuperAntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be get rid as well. Click here to download and run SAS Portable Scanner.

Technical Details and Additional Information:

Malicious Files Added by Unlimited Defender
%Documents and Settings%\[UserName]\Local Settings\Application Data\[random].exe
%Documents and Settings%\[UserName]\Local Settings\Temp\[random] %Documents and Settings%\[UserName]\Templates\[random]

Unlimited Defender Registry Entries:
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation “TLDUpdates” = “1″
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command “(Default)” = ‘”%Documents and Settings%\[UserName]\Local Settings\Application Data\[random].exe” -a “%1? %*’
HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command “(Default)” = ‘”%Documents and Settings%\[UserName]\Local Settings\Application Data\[random].exe” -a “%1? %*’
HKEY_CLASSES_ROOT\.exe\shell\open\command “(Default)” = ‘”%Documents and Settings%\[UserName]\Local Settings\Application