SafetyKeeper Description

 

 

[+] Click Image to Enlarge

 

 

CartCartCartCartCartCartCart

SafetyKeeper is a fake spyware remover originating from the same family as BlockDefense, SaveDefense and SaveKeeper. Due to affiliated trojans infiltrating the computer via security exploits, SafetyKeeper is installed onto the system and from there, begins launching various fake security alerts. Along with the fictitious and sometimes grossly exaggerated infection reports supplied by the counterfeit system scans, these tactics ensure the user is intimidated enough into purchasing the fake spyware remover SafetyKeeper in order to combat these non-existent threats.

Type: Rogue AntiSpyware Programs

How Can You Detect SafetyKeeper?

SafetyKeeper Technical Report

As new SafetyKeeper details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following SafetyKeeper files with its MD5s were created in the system:

SafetyKeeper has typically the following processes in memory:

• SafetyKeeper.exe
• c:\WINDOWS\1155backdoor929z.ocx
• c:\WINDOWS\system32\90a3t5ief225z.ocx

SafetyKeeper created the following directories, files, paths:

• %ProgramFiles%\SafetyKeeper Software\SafetyKeeper
• %AllUsersProfile%\Start Menu\Programs\SafetyKeeper

SafetyKeeper creates the following registry entries:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “SafetyKeeper”
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SAFETYKEEPERSVC
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “gbn976rl.exe”
• HKEY_LOCAL_MACHINE\SOFTWARE\SafetyKeeper
• HKEY_CURRENT_USER\Software\SafetyKeeper
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SafetyKeeper
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SafetyKeeperSvc

Important Article Disclaimer