When FraudTool.MS-Security.in is executed, it immediately disables all use of Portable Exectuable (PE) files. It prompts fake security alerts in order to scare the user into purchasing the trial version of the fake antivirus software application called Spyware Protection.
The rogueware will do the following:
It will drop the file:
%ALLUSERSPROFILE%\%appdata%\defender.exe
It does not reamin in memory and can be cleaned by killing the process in memory.
Below is a sample screenshot of the installed Spyware Protection:
Malware problems? We can help.
Evaluate Thirtyseven4 Antivirus Now
“Delight yourself in the Lord and he will give you the desires of your heart.” Psalm 37:4
