SaveDefender Description

 

 

[+] Click Image to Enlarge

 

 

CartCartCartCartCartCartCart

SaveDefender is a rogue anti-spyware program that is directly related to the fake security applications SoftSafeness and SafetyKeeper. SaveDefender, once active after installation, is able to scan a users system to trick them into purchasing a full version of SaveDefender. The use of falsified popup alerts and system scan results are many of the deceiving actions that SaveDefender takes to persuade computer users into purchasing a full version of SaveDefender. SaveDefender is completely unable to detect and rid a computer of parasites including Trojans, viruses, malware and spyware.

Type: Rogue AntiSpyware Programs

How Can You Detect SaveDefender?

SaveDefender Technical Report

As new SaveDefender details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following SaveDefender files with its MD5s were created in the system:

SaveDefender has typically the following processes in memory:

• ri2aqoym.exe
• 10203hack9z5l284.ocx
• 14397szambot506.exe
• 13598viruz5b9.ocx
• SaveDefender.exe
• 101919py365z.ocx

SaveDefender created the following directories, files, paths:

• %ProgramFiles%\SaveDefender Software\SaveDefender
• %AllUsersProfile%\Start Menu\Programs\SaveDefender

SaveDefender creates the following registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\SaveDefender
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SaveDefenderSvc
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SaveDefender
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SAVEDEFENDERSVC
• HKEY_CURRENT_USER\Software\SaveDefender
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “SaveDefender”
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “ri2aqoym.exe”

Important Article Disclaimer