Windows Defragger

By ESGI Advisor in Rogue Anti-Spyware Program

Despite its generic, bland name, Windows Defragger is not actually a Windows defragmenter. Although some legitimate defragmentation utilities may be referred to conversationally as "Windows Defragger," if you have a program calling itself Windows Defragger trying to scare you senseless, it is malware.

What Does Windows Defragger Really is, and How it Infects a Computer?

Windows Defragger is the latest name, or the latest minor variation on, a fake defragmenter that has been infecting PCs for at least a few months. Windows Defragger is closely related to Windows Diagnostic, System Diagnostic, WinScan and Windows Tool. Windows Defragger looks the same, causes the same symptoms, and uses exactly the same wording in its bogus warning messages and scans. Windows Defragger has a relatively good-looking interface for a fake security program, with some Windows styling, icons, and fonts; but that doesn't make Windows Defragger real.

Windows Defragger uses a Trojan in order to find ways onto victim computers. The Trojan that supports Windows Defragger will usually be hidden in a program update downloaded from a third-party site, or bundled with freeware or a pirated file. Once the Trojan has secretly downloaded to your computer, it takes care of setting up Windows Defragger and making sure that Windows Defragger runs whenever Windows starts.

Windows Defragger’s Signs of Infection

When Windows Defragger is active on your computer, Windows Defragger will work to convince you that your hard drive or other system components are in dangerously bad shape and that your best hope of avoiding disaster is to purchase a licensed version of Windows Defragger. Every time Windows starts, Windows Defragger will run, and Windows Defragger will show its phony scanner interface, where Windows Defragger will show a little animation and tell you that Windows Defragger has found some very serious problems with your hard drive. Then, Windows Defragger will tell you that the only way to fix these "errors" that Windows Defragger has found is to purchase a license for the Windows Defragger Advanced Module.

While you try to use your computer, after you make it past the Windows Defragger interface, Windows Defragger will continue to interfere with your ability to use your PC. Windows Defragger will constantly show error messages and warnings that say "Critical error!" followed by some scary-sounding thing about how your hard disk can't be found, or isn't responding, or has damaged sectors. Sometimes you'll even get warnings that say that the internal temperature of some of your system components is dangerously high. These warnings will also remind you to pay for Windows Defragger in order to resolve these supposed hard drive issues. Of course, if you do decide to pay for Windows Defragger, Windows Defragger will not gain any functionality. Windows Defragger is entirely fake, and no matter what you do, Windows Defragger will not be able to detect actual problems or repair anything.

In case the ordinary scare tactics aren't enough, Windows Defragger will make it appear as if the things Windows Defragger claims to find wrong with your computer are real. Windows Defragger will prevent other programs from opening and will claim that the reason for this is that there was some kind of hard disk error while trying to access the program. Occasionally, Windows Defragger will tell you that Windows Defragger needs to run a scan in Safe Mode, and Windows Defragger will open up a fake Windows Safe Mode and pretend to scan and then defragment your hard drive. Windows Defragger can even make it appear as if some folders are empty, or cause some folders to display the contents of others, so that you'll believe that there is some issue with accessing the hard drive. Windows Defragger very commonly does this with the system files, but if you come across this symptom, there is no need to panic; the files and sub-folders are only hidden, not deleted.

Windows Defragger is part of a Russian scam, and no good can come of paying money for this malware. Avoid Windows Defragger by using proper, legitimate security software; and if you do wind up with this rogue defragmentation utility on your computer, don't give the crooks the money they demand.

File System Details

Windows Defragger may create the following file(s):
# File Name Detections
1. %AllUsersProfile%\Application Data\[RANDOM CHARACTERS].exe
2. %AllUsersProfile%\Application Data\[RANDOM CHARACTERS].dll
3. %AllUsersProfile%\Application Data\[RANDOM CHARACTERS]
4. %AllUsersProfile%\Application Data\~[RANDOM CHARACTERS]

Registry Details

Windows Defragger may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnonBadCertRecving" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS].exe"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = '{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS]"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Use FormSuggest" = 'yes'

Related Posts

Trending

Most Viewed

Loading...