Software-Defender.net

Software-Defender.net Description

Software-Defender.net also known as Software-defender.com is a criminal website that promotes the rogueware called Antispyware Soft. Software-Defender.net may be placed into a user's Hosts file causing frequent redirections to the malicious website. Once a victim is on Software-Defender.net, a fake Internet Explorer warning page will be displayed stating that "visiting this website may harm your computer". The user will then be given the option to purchase Antispyware Soft in order to continue surfing the internet safely. This is all a scam. Users should not waste their money on Antispyware Soft and never trust anything on Software-Defender.net.

Technical Information

File System Details

Software-Defender.net creates the following file(s):
# File Name Detection Count
1 %UserProfile%\Local Settings\Application Data\{random}tssd.exe N/A

Registry Details

Software-Defender.net creates the following registry entry or registry entries:
Registry key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:5555"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "{random}"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyEnable" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyOverride" = "
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = "no"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = ".exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "{random}"