RegistryDefender Will Defend Absolutely Nothing
Title: RegistryDefender
Also Known as: Registry Defender
Severity scale:
Most computer user that have RegistryDefender on their computers put the program on there in the first place. Whether they installed it as part of a bundle and did not pay attention while they were clicking continue or they installed it straight from the website thinking it was something that would protect their computers. However someone gets RegistryDefender on their computer, removal is recommended.
RegistryDefender file contents:
c:\Program Files\Angle Interactive
c:\Program Files\Angle Interactive\RD Platinum v5.0
c:\ProgramData\RD Platinum v5.0\backup
%UserProfile%\Start Menu\Programs\Registry Defender
Running Processes:
RDPlatinumv5.exe Uninstall.exe Updater.exe
Registry values:
HKEY_CURRENT_USER\Software\VB and VBA Program Settings\RD Platinum v5.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B26CAA68-6EBF-4A30-A0F0-0A0BFE3DA5DD}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\RegistryDefenderPlatinum
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\RegistryDefenderPlatinum displayicon
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\RegistryDefenderPlatinum displayname
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\RegistryDefenderPlatinum shortcutpath
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\RegistryDefenderPlatinum uninstallstring
Registered DLLs:
Associated Files:
Customer Support.url INSTALL.LOG install.sss RDPlatinumv5.exe RDPlatinumv5.exe.manifest Uninstall.exe Updater.exe User Guide.url repair-bar scan-bar-100 scan-bar-pulse c:\\ProgramData report.csv Registry-Defender v5.lnk Customer Support.lnk RD Platinum v5.lnk User Guide.lnk
Recommended Action: Immediate removal if the user know that they are also infected with a trojan.
What makes RegistryDefender dangerous is not so much that it lacks simple algorithms that actually do anything; it is the fact that there are now reports that other scammers are using it to con people out of money. Technically one could say that the original designers that created RegistryDefender were out to scam people, but there is a fine line there. As far as the reports that RegistryDefender is now being associated with trojans is a sign that this program will become highly dangerous in the near future.
