IronDefender
IronDefender is a fake security application that spreads with the help of sneaky Trojans. IronDefender will display fake scanners, security alerts and pop-up warnings in an attempt to convince a user that his/her machine is infested with malware. Then IronDefender will coerce the user into paying for its "full version" in order to remove the purportedly detected malware. IronDefender is unable to detect or remove computer malware therefore users should never waste their money on this rogueware.
Table of Contents
File System Details
IronDefender may create the following file(s):
| # | File Name |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|
| 1. | c:\WINDOWS\[random characters].exe | |
| 2. | c:\WINDOWS\system32\[random characters].dll | |
| 3. | c:\Program Files\FDFCA\Uninstall.exe | |
| 4. | c:\WINDOWS\system32\[random characters].exe | |
| 5. | c:\Program Files\FDFCA\F0E84.exe | |
| 6. | c:\WINDOWS\[random characters].dll | |
| 7. | %UserProfile%\Local Settings\Temp\[random characters].exe | |
| 8. | c:\WINDOWS\[random characters].bin | |
| 9. | c:\WINDOWS\system32\[random characters].cpl | |
| 10. | c:\Program Files\FDFCA\ | |
| 11. | c:\WINDOWS\system32\[random characters].bin | |
| 12. | %UserProfile%\Desktop\IronDefender.lnk | |
| 13. |
C:\Documents and Settings\ |
|
| 14. | c:\WINDOWS\[random characters].cpl | |
| 15. | %UserProfile%\Desktop\hash |
Registry Details
IronDefender may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IronDefender
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "F0E84.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\IronDefender
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "vur4.exe"
HKEY_CURRENT_USER\Software\IronDefender
HKEY_CURRENT_USER\Software "Install_Dir" = "C:\Program Files\FDFCA"
Messages
The following messages associated with IronDefender were found:
|
Spyware Alert!
Your computer is infected with spyware. It could damage your critical files or expose your private data on the Internet. Click here to register your copy of IronDefender and remove spyware threats from your PC. Warning Your computer is under a great risk! Malware applications are still running. This will lead to the loss of personal date and system damage. Do you want to remove the malware and protect your system? Security Center Alert! Infiltration Alert! Your computer is being at |
