Windows Examination Utility

Windows Examination Utility is a rogue security program that pretends to analyze and score your PC security settings. These scores are preset to be negative, and in combination with fake pop-up alerts and Windows Examination Utility-instigated program crashes, they place your PC in a deceitful scenario that makes the computer look as though it's heavily infected. Avoid falling for Windows Examination Utility's end game plan of making you purchase a registration or activation key, and instead, delete Windows Examination Utility by using the same real anti-malware software that you would use on any standard Trojan or virus.

A Careful Inspection of the Opening Windows Examination Utility Uses to Get on Your PC

Windows Examination Utility reuses the same graphical shell that you can see on other recent rogue security programs like Windows Anticrashes Utility, Windows Averting System, Windows Accidents Prevention, Windows Necessary Firewall and Windows Troubles Solver. All of Windows Examination Utility's advertising markets Windows Examination Utility as a stand-alone security program, but in reality, Windows Examination Utility copies all of Windows Examination Utility's major functions from older rogue security applications.

Like many other rogue security programs in Windows Examination Utility's subgroup, Windows Examination Utility relies on false marketing on malicious websites, as well as Trojan-based infiltration to infect your PC. The most well-known Trojan that can infect your computer with Windows Examination Utility is the Fake Microsoft Security Essentials Alert.

A Fake Microsoft Security Essentials Alert will infect your PC without your permission, usually by exploiting browser security limitations. After doing this, the Fake Microsoft Security Essentials Alert installs Windows Examination Utility, while using pop-ups similar to the ones below:

Microsoft Security Essentials Alert
Potential Threat Details
Microsoft Security Essentials detected potential threats that might compromise your private or damage your computer. Your access to these items may be suspended until you take an action. Click 'show details' to learn more.

Threat prevention solution found
Security system analysis has revealed critical file system vulnerability caused by severe malware attacks.
Risk of system files infection:
The detected vulnerability may result in unauthorized access to private information and hard drive data with a seriuos [sic] possibility of irreversible data loss and unstable PC performance. To remove the malware please run a full system scan. Press 'OK' to install the software necessary to initiate system files check. To complete the installation process please reboot your computer.

Windows Examination Utility will be installed even if you try to avoid doing what these fake Security Essentials windows say, after which your PC will reboot so that Windows Examination Utility can run automatically.

A List of the Windows Examination Utility's Misdirection and Ambush Tactics

In addition to the fake scores and system scans that are included in Windows Examination Utility's recycled interface, Windows Examination Utility will also use a wide range of other attacks to make you think that your PC is infected from many different angles. Windows Examination Utility has no detection or threat removal functions, however, so you should avoid ever purchasing Windows Examination Utility or related software.

• Windows Examination Utility will create indiscriminately erroneous pop-ups that tell you that serious threats are occurring on your PC, even though other anti-malware programs can't detect these problems. Some of these pop-up errors may also encourage you to download other malicious software or redirect you to Windows Examination Utility's website.

  System Security Warning
  Attempt to modify register key entries is detected. Register entries analysis is recommended.

  Warning! Database update failed!
  Database update failed!
  Outdated viruses databases are not effective and can't [sic] guarantee adequate protection and security for your PC!
  Click here to get the full version of the product and update the database!

  System component corrupted!
  System reboot error has occurred due to lsass.exe system process failure.
  This may be caused by severe malware infections.
  Automatic restore of lsass.exe backup copy completed.
  The correct system performance can not be resumed without eliminating the cause of lsass.exe corruption.

  Warning! Running trial version!
  The security of your computer has been compromised!
  Now running trial version of the software!
  Click here to purchase the full version of the software and get full protection for your PC!

• Windows Examination Utility can also go the extra mile with these false positives and create errors regarding specific programs. While doing this, Windows Examination Utility is likely to cause these programs to crash or otherwise malfunction, preventing you from using real security software while absolving itself of blame.

  Warning!
  Location: [application file path]
  Viruses: Backdoor.Win32.Rbot

  Warning!
  Name: [application file name]
  Name: [application file path]
  Application that seems to be a key-logger is detected. System information security is at risk. It is recommended to enable the security mode and run total System scanning.

• Browser hijacks are a third symptom of being infected with Windows Examination Utility. These attacks can yank you away from safe websites by using fake error pages, redirect you to hostile websites, create pop-ups and change your homepage.

Although Windows Examination Utility doesn't do any serious damage to the programs Windows Examination Utility attacks, Windows Examination Utility does abuse various settings, especially within the Windows Registry, to accomplish Windows Examination Utility's ends. Because of these Registry changes, removing Windows Examination Utility manually can result in many programs continuing to work improperly.

However, using a real anti-virus program to search your machine remove Windows Examination Utility will also attend to all malicious Registry changes if you're using high-quality software. Run your scan in Safe Mode to reduce the possibility of Windows Examination Utility or other attackers hampering it.

File System Modifications

• The following files were created in the system:
  

  #	File Name
  1	%AppData%\Microsoft\{RANDOM CHARACTERS}.exe

Registry Modifications

• The following newly produced Registry Values are:
  HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon | Shell = “%AppData%\Microsoft\{RANDOM CHARACTERS}.exe”HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe | DebuggerHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe | DebuggerHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe

Additional Information on Windows Examination Utility

• The following messages's were detected:
  

  #	Message
  1	Warning There`s a suspicious fsoftware running on your PC. For more details, run a system file check.
  2	Check your computer security There are multiple security problems with your computer. Check this notification to fix these problems.
  3	Warning! Location: …\mbam.exe Viruses: Trojan.Win32.Qhost