Custom Search

Search more than 150 trusted Websites for related information.

WinDefender 2009 Analysis and Removal

WinDefender 2009 is one of the recent rogue security software. A variant of the rogue IE Defender and Total Secure it deceptively looks similar to Windows Defender, a legitimate Microsoft anti-malware program.

A rogue security software belongs to a family of software products that call themselves as antivirus, antispyware or registry cleaners and often use deceptive or high pressure sales tactics and deliberate false positives to convince users into buying a license/subscription. They are often repackaged and renamed. They do not actually remove malware instead many of them add more malware of their own.

Note: Visiting any of the malware hosting domains mentioned below may be injurious to the health of your computer system.

• WinDefender 2009 Domain Information and Installation
• WinDefender 2009 -- Associated Files and Folders
• WinDefender 2009 -- Associated Registry keys and values
• WinDefender 2009 -- Associated Domains
• WinDefender 2009 -- Removal (How to remove WinDefender 2009)
• WinDefender 2009 -- Rogue Gallery
• WinDefender 2009 -- Video

WinDefender 2009 Screenshot

This rogueware is currently installed through windefender-2009.com registered to domainsreg.cn by the ICANN accredited registrar BIZCN.COM, INC. It appears to be hosted at the IP 208.85.181.45 located in Delaware -- Wilmington -- Network Engineering Technologies Research Center Llc.

The rogue installer is named WinDefender2009.exe and is about 1.71 MB in size. This file must be manually executed for the installation of the rogue anti-spyware. At this point only 25% of the antivirus engines at VirusTotal was able to identify this file as an undesirable file.

WinDefender-2009 VirusTotal Screenshot

This installer file is downloaded from the IP 78.157.141.6 in Latvia. This IP is also home to the nameservers of other malware domains: gettotalsec2008.com, totalsecuredownload.com and videofreeforonline.com.

After the rogueware is sucessfully installed it contacts mothership at megauplinkbindinstaller.com, specifically with a page curiously named infected.php through the process windef.exe

Once the user is tricked into installing this scareware, the popup window like the one captured below appear periodically. When the user clicks the "OK" button, he is taken to their own 256 bit secure SSL payment page certified by Equifax Secure Inc.

WinDefender 2009 Scare Popup

WinDefender 2009 -- Associated Files and Folders

Note: File names may be randomly generated.

WinDefender 2009 -- Associated Registry keys and values

WinDefender 2009 -- Associated Domains

WinDefender 2009 -- Removal (How to remove WinDefender 2009)

The free versions of MalwareBytes’s Anti-Malware and SuperAntiSpyware appear to remove this rogue security software quite comfortably.

I would also recommend turning off and on the System Restore to clear any infected restore points and using CCleaner to clear the temp folders and files to avoid recurrence.

If you still see symptoms associated with this rogue anti-spyware, please post your problem at one of the Recommended Online Forums for Malware Help.

WinDefender 2009 -- Rogue Gallery

 

WinDefender 2009 -- Video

Note: The above installation was tested on a fully patched Windows XP SP3 running updated versions of Internet Explorer 7 and Firefox 3. The content provided in this article is not warranted or guaranteed by Malware Help. Org. The content provided is intended for entertainment and/or educational purposes. I am not liable for any negative consequences that may result from implementing any information covered in this article. The above information is correct at the time of my testing, it might change with time and or under different testing conditions.