DefenderSoftPremium.net
DefenderSoftPremium.net is a malicious website that advertises the rogueware called AntiSpyware Soft. DefenderSoftPremium.net also known as DefenderSoftPremium.com is encountered by users that have been infected with browser hijacking Trojans. Once a user lands on DefenderSoftPremium.net a fake warning about some unsafe Internet activity will be displayed. This warning will prompt the user to click on a certain link to purchase AntiSpyware Soft which will supposedly ensure that the user continues surfing the internet safely. Users should not trust DefenderSoftPremium.net or Antispyware Soft.
File System Details
DefenderSoftPremium.net may create the following file(s):
| # | File Name |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|
| 1. | %UserProfile%\Local Settings\Application Data\{random}tssd.exe |
Registry Details
DefenderSoftPremium.net may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:5555"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "{random}"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyEnable" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyOverride" = "
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = "no"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = ".exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "{random}"
