Home Malware Programs Viruses Bitdefender.exe

Bitdefender.exe

Posted: April 26, 2011

Bitdefender.exe is the main executable file and process of fake anti-spyware application BitDefender 2011. Bitdefender.exe can create start-up registry entry to run automatically everytime when the computer system boots up. The main aim of Bitdefender.exe is to confuse the infected users and hope they would purchase rogue security program BitDefender 2011. Bitdefender.exe process can create, delete or make changes to files on the disk. Bitdefender.exe shows fabricated pop-up alerts to report you that your PC system is corrupted with malware. Remove Bitdefender.exe as quickly as possible from your machine before it harms your computer.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %AllUsersProfile%\Start Menu\BitDefender 2011\Uninstall.lnk
    2 %Temp%\srvED4.ini
    3 %Temp%\srvED4.tmp
    4 %UserProfile%\Desktop\BitDefender 2011.lnk
    5 c:\Documents and Settings\All Users\Start Menu\BitDefender 2011\
    6 c:\Documents and Settings\All Users\Start Menu\BitDefender 2011\BitDefender 2011.lnk
    7 c:\Program Files\BitDefender 2011\
    8 c:\Program Files\BitDefender 2011\bitdefender.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\EVAEC2HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "BitDefender 2011" = 'C:\Program Files\BitDefender 2011\bitdefender.exe'HKEY_CURRENT_USER\Software\MonEC2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe "Debugger" = 'msiexecs.exe -sb'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe "Debugger" = 'msiexecs.exe -sb'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe "Debugger" = 'msiexecs.exe -sb'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe "Debugger" = 'msiexecs.exe -sb'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safari.exe "Debugger" = 'msiexecs.exe -sb'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "WinNT-EVI 21.04.2011"HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyEnable" = '0'
Loading...