Internet Protector

Threat Scorecard

Ranking: 16,376
Threat Level: 20 % (Normal)
Infected Computers: 134
First Seen: February 29, 2012
Last Seen: August 15, 2023
OS(es) Affected: Windows

Internet Protector is a fake security application that belongs to the large family of rogue anti-malware applications associated with the Win32/FakeRean Trojan. It is well known that malware in the FakeRean family has the capacity of changing its name according to the victim's operating system. Because of this, it is likely to find versions of Internet Protector named Vista Internet Protector, Win 7 Internet Protector or XP Internet Protector. ESG security analysts have discovered that Internet Protector has absolutely no way of detecting or removing malware; instead, this program is designed to take over the victim's computer and carry out a well-known online scam. Internet Protector and its clones have been known to disable legitimate security programs, Windows components that are useful for malware removal and recovery and to take over the infected computer's web browser. Because of this, the Internet Protector scam is not limited to trying to convince computer users that they should buy this useless security tool, but also has implications in how your computer system works. ESG malware analysts recommend removing Internet Protector with a reliable anti-malware program after starting up Windows from an external drive or in Safe Mode.

How Internet Protector Attempts to Scam Its Victims

Superficially, Internet Protector looks legitimate. It even includes an uninstaller utility that is completely useless and seemingly uses a proper installation procedure. However, Internet Protector is designed to display constant alarming messages claiming that your computer is infected with dangerous Trojans and viruses. It also tends to launch highly-visible fake scans and refuses to allow the victim to remove or turn off Internet Protector. The alerts used by Internet Protector are authentic-looking fakes that mimic real Windows error messages. However, these alerts tend to be greatly exaggerated and are merely trying to make the computer user panic so that they can be convinced to purchase Internet Protector.

There are many clones of Internet Protector, which include fake security applications like Antivirus 2008, Windows Antivirus 2008, Vista Antivirus 2008, Antivirus Pro 2009, AntiSpy Safeguard, ThinkPoint, Spyware Protection 2010, Internet Antivirus 2011, Palladium Pro, XP Anti-Virus 2011, CleanThis, PC Clean Pro, XP Home Security 2012, Windows Clear Problems, XP Security 2012, Antivirus PRO 2015.

All of these fake security programs tend to include a year in the title (2010, 2011 or 2012) as well as using the victim's operating system as the prefix (XP, Vista or Win 7). For example, Home Security can appear as >XP Home Security 2011 or Vista Home Security 2012. Do not fall for this scam, instead of purchasing Internet Protector use a legitimate anti-malware tool to remove Internet Protector from your computer system.

File System Details

Internet Protector may create the following file(s):
# File Name Detections
1. %AppData%\Internet Protector\securitymanager.exe
2. %AppData%\Internet Protector\securityhelper.exe
3. %AppData%\Internet Protector\internet protector.exe
4. %AppData%\Internet Protector\icouninstall.ico
5. %Programs%\Internet Protector\Internet Protector.lnk
6. %AppData%\Internet Protector\icoactivate.ico
7. %Programs%\Internet Protector.lnk
8. %Programs%\Internet Protector\how to activate Internet Protector.lnk
9. %AppData%\Internet Protector\icohelp.ico
10. %AppData%\Microsoft\Internet Explorer\Quick Launch\Internet Protector.lnk
11. %Programs%\Internet Protector\help Antivirus Protection.lnk

Registry Details

Internet Protector may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce "[RANDOM DIGITS]".exe

URLs

Internet Protector may call the following URLs:

mylocaldates1.com

Trending

Most Viewed

Loading...