Rogue software details: ArmorDefender

ArmorDefender is a rogue security application. In order to remove it, find out what files and registry entries to look for below.

Known system changes:

Files
c:\Desktop\ArmorDefender.lnk
c:\StartMenu\Programs\ArmorDefender.lnk
c:\ProgramFiles\ArmorDefender Software\
ArmorDefender\ArmorDefender.exe

Folders
c:\ProgramFiles\ArmorDefender Software

Registry entries
Key: HKEY_CURRENT_USER\Software\ArmorDefender
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall\ArmorDefender
Key: HKEY_LOCAL_MACHINE\SOFTWARE\ArmorDefender
Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run
Value: ykd2.tmp.exe
Data: C:\WINDOWS\system32\ykd2.tmp.exe
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run
Value: ArmorDefender
Data: “C:\Program Files\ArmorDefender Software\
ArmorDefender\ArmorDefender.exe” -min

Source: Lavasoft Malware Lab’s Rogue Gallery.