TrustDoctor
TrustDoctor aka Trust Doctor is a fake anti-virus from the WiniSoft family of rogueware. The trial version of TrustDoctor may enter a system via fake codec downloads or drive-by downloads. Once TrustDoctor is inside a system it will create harmless files which will later be detected as malware when a fake system is conducted.
TrustDoctor will also display random security alerts and pop-up warning messages in order to scare a user into purchasing its "full" version as a remedy. Whatever you do, make sure you do not waste your money on this useless application; TrustDoctor is not to be trusted and should be removed upon detection.
File System Details
TrustDoctor may create the following file(s):
| # | File Name |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|
| 1. | %WINDOWS%\10566wormz5e.dll | |
| 2. | %Temp%\{random}.exe | |
| 3. | %Program Files%\TrustDoctor Software\TrustDoctor\uninstall.exe | |
| 4. | %WINDOWS%\system32\{random}.exe | |
| 5. | %Program Files%\TrustDoctor Software\TrustDoctor\TrustDoctor.exe | |
| 6. | %WINDOWS%\system32\2325viruz9.dll | |
| 7. | %Documents and Settings%\All Users\Start Menu\Programs\TrustDoctor\1 TrustDoctor.lnk | |
| 8. | %Program Files%\TrustDoctor Software | |
| 9. | %WINDOWS%\system32\15274hzcktool3d59.bin | |
| 10. | %Documents and Settings%\All Users\Start Menu\Programs\TrustDoctor | |
| 11. | %Documents and Settings%\All Users\Start Menu\Programs\TrustDoctor\3 Uninstall.lnk | |
| 12. | %WINDOWS%\101213zo9m49d5.cpl | |
| 13. | %Documents and Settings%\All Users\Desktop\TrustDoctor.lnk | |
| 14. | %Documents and Settings%\All Users\Start Menu\Programs\TrustDoctor\2 Homepage.lnk | |
| 15. | %Program Files%\TrustDoctor Software\TrustDoctor | |
| 16. | %WINDOWS%\system32\77481tzoj56fc.bin |
Registry Details
TrustDoctor may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\TrustDoctor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TrustDoctor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "TrustDoctor"
HKEY_CURRENT_USER\Software\TrustDoctor
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "{random}.exe"
