PerfectDefender2009

Behavior
The program can be manually installed or may be installed through Trojan.Zlob.

The program reports false or exaggerated system security threats on the computer.





The user is then prompted to pay for a full license of the application in order to remove the threats.






Installation
When the program is executed, it creates the following files:

• %UserProfile%\Start Menu\Programs\Perfect Defender 2009\Perfect Defender 2009.lnk
• %UserProfile%\Start Menu\Programs\Perfect Defender 2009\Uninstall Perfect Defender 2009.lnk
• %ProgramFiles%\Perfect Defender 2009\dbbase.div
• %ProgramFiles%\Perfect Defender 2009\pd.dll
• %ProgramFiles%\Perfect Defender 2009\pdfndr.exe
• %ProgramFiles%\Perfect Defender 2009\UnInstall.exe

It then creates the following folders:

• %UserProfile%\Start Menu\Programs\Perfect Defender 2009
• %ProgramFiles%\Perfect Defender 2009

Next, the program creates the following registry entry so that it executes whenever Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Perfet Defender 2009" = "%ProgramFiles%\Perfect Defender 2009\pdfndr.exe"


It also creates the following registry subkeys:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PDefender
• HKEY_LOCAL_MACHINE\SOFTWARE\Malware Defender 2009

SIMILAR SECURITY RISKS

The following misleading application is similar to PerfectDefender 2009:

Registry Defender Platinum

Summary