Antimalware Defender Description

Antimalware Defender is a rogue security tool extending from the same family as Virus Doctor. Antimalware Defender is typically distributed by sneaky Trojans but it can also be dropped by other malicious software. On execution, Antimalware Defender displays a bogus pop-up window that appears to be a Critical Windows update. The update reads as follows:

“Antimalware security update for Windows XP (KB961118)
Size: 433KB
This critical update will install System Security Update 2010.01.023 (Antimalware Defender Upgrade; KB648759)”

Antimalware Defender has a similar GUI to the legitimate Windows Defender application, but they are not related to each other at all. Antimalware Defender will also conduct a fake system scan that will report several infections, scaring the victim into purchasing the “full version” of Antimalware Defender. Antimalware Defender will also launch annoying pop-ups and security alerts to further incite the victim. Users should not even consider purchasing Antimalware Defender as it cannot detect or remove any type of computer malware.

Type: Rogue AntiSpyware Programs

How Can You Detect Antimalware Defender?

Antimalware Defender has typically the following processes in memory:

• c:\Program Files\Antimalware Defender\Antimalware Defender.dll

Antimalware Defender creates the following registry entries:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “ca84c702-c758-4421-974e-b02662e76d7c_6″
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ca84c702-c758-4421-974e-b02662e76d7c}
• HKEY_CLASSES_ROOT\CLSID\{ca84c702-c758-4421-974e-b02662e76d7c}

Important Article Disclaimer