Iron Protector
Iron Protector or IronProtector is a malicious software application created by cyber-criminals. Iron Protector is distributed by stealthy Trojans. Iron Protector is designed to display numerous security warnings and scan reports to convince a victim that his/her system is infested with malware. Then Iron Protector will direct a victim to a rogue website where he/she will be prompted to purchase the full version of Iron Protector to remove the detected malware. Iron Protector is another rogueware from the same family as IronDefender which should be removed immediately after detection.
File System Details
Iron Protector may create the following file(s):
| # | File Name |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|
| 1. | %Program Files%\RegistryClever Software\RegistryClever\RegistryClever.exe | |
| 2. | %WINDOWS%\.dll | |
| 3. | %Program Files%\FDFCA\Uninstall.exe | |
| 4. | %Program Files%\RegistryClever Software\RegistryClever\uninstall.exe | |
| 5. | %UserProfile%\Local Settings\Temp\.exe | |
| 6. | %Program Files%\FDFCA\F0E84.exe | |
| 7. | %Program Files%\RegistryClever Software\RegistryClever\RegistryCleverTray.exe | |
| 8. | %WINDOWS%\system32\.exe | |
| 9. | %Documents and Settings%\All Users\Application Data\RegistryClever\BackupedItems\items.xml | |
| 10. | %Documents and Settings%\All Users\Start Menu\Programs\RegistryClever\ | |
| 11. | %Documents and Settings%\All Users\Start Menu\Programs\RegistryClever\Uninstall.lnk | |
| 12. | %Program Files%\RegistryClever Software\RegistryClever\ | |
| 13. | %Program Files%\RegistryClever Software\RegistryClever\Styles\Vista.cjstyles | |
| 14. | %WINDOWS%\system32\.cpl | |
| 15. | %Documents and Settings%\All Users\Application Data\RegistryClever\BackupedItems\ | |
| 16. | %Documents and Settings%\All Users\Start Menu\Programs\IronProtector.lnk | |
| 17. | %Documents and Settings%\All Users\Start Menu\Programs\RegistryClever\RegistryClever.lnk | |
| 18. | %Program Files%\RegistryClever Software\ | |
| 19. | %Program Files%\RegistryClever Software\RegistryClever\Styles\ | |
| 20. | %WINDOWS%\.cpl | |
| 21. | %UserProfile%\Desktop\IronProtector.lnk | |
| 22. | %Documents and Settings%\All Users\Application Data\RegistryClever | |
| 23. | %Documents and Settings%\All Users\Desktop\RegistryClever.lnk | |
| 24. | %Documents and Settings%\All Users\Start Menu\Programs\RegistryClever\Homepage.lnk | |
| 25. | %Program Files%\FDFCA\ | |
| 26. | %Program Files%\RegistryClever Software\RegistryClever\license.txt | |
| 27. | %WINDOWS%\.bin | |
| 28. | %WINDOWS%\system32\.bin |
Registry Details
Iron Protector may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\IronProtector
HKEY_LOCAL_MACHINE\SOFTWARE\RegistryClever
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "F0E84.exe"
HKEY_CURRENT_USER\Software\RegistryClever
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RegistryClever
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "TrayScan"
HKEY_CURRENT_USER\Software\IronProtector
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IronProtector
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ".exe"
