DataDoctor 2010 Description

 

 

[+] Click Image to Enlarge

 

 

CartCartCart

DataDoctor 2010 (or Data Doctor 2010) is a fake anti-spyware application that uses scare tactics to coerce users into purchasing it. DataDoctor 2010 can be obtained via drive-by downloads or contaminated websites. On entering a computer system, DataDoctor 2010 will run in the background and create a start-up registry entry. DataDoctor 2010 utilizes fake system scan results, pop-up windows and security warning messages to convince a victim that his/her system is infected with several dangerous computer parasites. A victim will then be advised to purchase the “licensed version” of DataDoctor 2010 in order to exterminate the purportedly detected parasites. All the parasites detected by DataDoctor 2010 are fictitious and DataDoctor 2010 is unable to perform any security software functions.

Type: Rogue AntiSpyware Programs

How Can You Detect DataDoctor 2010?

DataDoctor 2010 Technical Report

As new DataDoctor 2010 details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following DataDoctor 2010 files with its MD5s were created in the system:

DataDoctor 2010 has typically the following processes in memory:

• %ProgramFiles%\DataDoctor 2010\modules\module.filefix.dll
• %ProgramFiles%\DataDoctor 2010\modules\module.regclean.dll
• %ProgramFiles%\DataDoctor 2010\unins000.exe
• %ProgramFiles%\DataDoctor 2010\fs.exe
• %ProgramFiles%\DataDoctor 2010\modules\module.privacy.dll
• %ProgramFiles%\DataDoctor 2010\modules\module.startup.dll
• %ProgramFiles%\DataDoctor 2010\ddreg.dll
• %ProgramFiles%\DataDoctor 2010\modules\module.inetopt.dll
• %ProgramFiles%\DataDoctor 2010\modules\module.shredder.dll
• %System%\msvcp71.dll

DataDoctor 2010 created the following directories, files, paths:

• %ProgramFiles%\DataDoctor 2010
• %AllUsersProfile%\Start Menu\Programs\DataDoctor

DataDoctor 2010 creates the following registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Uninstall\{C6869864-8987-4067-9666-BEA678E823F3}_is1

Important Article Disclaimer