SaveArmor Description

 

 

[+] Click Image to Enlarge

 

 

CartCartCartCartCartCartCartCartCart

SaveArmor is a fake security program related to the group of rogue anti-spyware programs called SaveKeeper, SoftSafeness and SafetyKeeper. All of these applications use similar methods to get computer users to purchase a full version of the rogue. SaveArmor will use misleading system warnings and falsified system scans to scare a user into purchasing SaveArmor. Usually these threats come in the form of a message that alerts the user of parasites found on the system but in reality they are all fabricated. SaveArmor is not a trusted application for removal and detection of spyware, Trojans or any other type of computer parasite.

Type: Rogue AntiSpyware Programs

How Can You Detect SaveArmor?

SaveArmor Technical Report

As new SaveArmor details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following SaveArmor files with its MD5s were created in the system:

SaveArmor has typically the following processes in memory:

• %WINDOWS%\1044zhackt9ol5b2.dll
• %Program Files%\SaveArmor Software\SaveArmor\uninstall.exe
• %Program Files%\SaveArmor Software\SaveArmor\savearmor.exe
• SaveArmor.exe

SaveArmor created the following directories, files, paths:

• %ProgramFiles%\SaveArmor Software\SaveArmor
• %AllUsersProfile%\Start Menu\Programs\SaveArmor

SaveArmor creates the following registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\SaveArmor
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “SaveArmor”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SaveArmor
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SaveArmorSvc
• HKEY_CURRENT_USER\Software\SaveArmor
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SAVEARMORSVC
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “x0lc3bqd.exe”

Important Article Disclaimer