BlockProtector Description

 

 

[+] Click Image to Enlarge

 

 

CartCartCartCart

BlockProtector is a fake security application from the same family of rogueware as Block Scanner, Block Watcher and Block Keeper. BlockProtector is installed onto users’ computers with the help of sneaky Trojans that modify the settings to ensure that BlockProtector will automatically run when Windows is started up.

Once BlockProtector has accessed a system, it will conduct a fake scan that will report that the system is infected with multiple parasites. Targeted users will then be advised to purchase BlockProtector in order to remove all the detected parasites. All spyware alerts or notifications displayed by BlockProtector are false. It is best that you remove BlockProtector from your PC at your earliest convenience.

Type: Rogue AntiSpyware Programs

How Can You Detect BlockProtector?

BlockProtector Technical Report

As new BlockProtector details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following BlockProtector files with its MD5s were created in the system:

BlockProtector has typically the following processes in memory:

• c:\WINDOWS\1069szyware7695.exe
• %Temp%\rwb4.tmp.exe
• c:\Program Files\BlockProtector Software\BlockProtector\Uninstall.exe
• c:\WINDOWS\system32\335steal97z2.ocx
• c:\Program Files\BlockProtector Software\BlockProtector\BlockProtector.exe
• c:\WINDOWS\11763zpy1f95.exe
• BlockProtector.exe

BlockProtector created the following directories, files, paths:

• %ProgramFiles%\BlockProtector Software\BlockProtector

BlockProtector creates the following registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BlockProtector
• HKEY_LOCAL_MACHINE\SOFTWARE\BlockProtector
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “BlockProtector.exe”
• HKEY_CURRENT_USER\Software\BlockProtector
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “rwb4.tmp.exe”

Important Article Disclaimer