Windows Activity Booster
Posted: December 9, 2013
Threat Metric
The following fields listed on the Threat Meter containing a specific value, are explained in detail below:
Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.
Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.
Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.
Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.
% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.
Threat Level: | 10/10 |
---|---|
Infected PCs: | 12 |
First Seen: | December 9, 2013 |
---|---|
Last Seen: | January 8, 2020 |
OS(es) Affected: | Windows |
Windows Activity Booster is a rogue anti-malware product of a family known for its predisposition towards blocking other applications (including essential security ones) and loading fraudulent pop-up warnings to bully its victims into buying its software registration keys. Although warning messages, scans and other Windows Activity Booster-delivered information may imply that your computer is suffering from a range of malfunctions that must be resolved, Windows Activity Booster only detects fake system problems and doesn't have any real anti-malware or system-cleaning features. As with all scamware, deleting Windows Activity Booster immediately and with a real anti-malware product is urgently advised by malware researchers for your computer's safety.
The Booster that Boosts Your PC in the Wrong Direction
A fraudulent security and system optimization product without any beneficial features, Windows Activity Booster always must be considered unsafe to your PC to the same degree as a Trojan, virus or other threat. Although Windows Activity Booster does 'boost' the ongoing activities of your computer, all of its functions are intended either to confuse you about your PC's state of security or disable security features. Major functions of Windows Activity Booster that malware researchers considered worthy of outlining include:
- Redirecting your browser to fraudulent error pages – and, in the process, blocking various security-related sites.
- Blocking other applications arbitrarily. Windows Activity Booster may force Svchost.exe (a basic Windows component) to launch instead of the intended software.
- Loading fake error pop-ups with a range of semi-convincing formats and messages. Imitation firewall alerts and warnings about threat attacks both are common.
Together, Windows Activity Booster's features prevent you from using most obvious security solutions while also tempting you to spend money on its software, supposedly as a solution to the fake problems Windows Activity Booster 'detects.' Of course, malware experts stressed that there absolutely is no advantage to purchasing Windows Activity Booster, even to assist with its removal.
Preventing Windows Activity Booster from Meddling with Your PC Activities
While it may be very apparent that deleting Windows Activity Booster is the best thing for your computer, any method of removing Windows Activity Booster must be able to work around its software-blocking functions. However, such functions are particularly common with FakeVimes scamware and other rogue security programs that malware experts have examined in the past, and there are well-honed ways of dealing with them. As an initial volley, restarting your PC from an emergency boot CD, DVD or USB drive should disable most threats readily. From there, using legitimate anti-malware products to delete Windows Activity Booster from Safe Mode should provide an ample finisher for disinfecting your system.
Windows Activity Booster is a recent example of similar scamware products distributed throughout the world, with brand names changing regularly. Even when ignoring other major families like WinWebSec or FakeRean, close relatives of Windows Activity Booster that also should be treated as threats to your PC include Privacy Guard Pro, PrivacyGuard Pro 2.0, Extra Antivirus, Fast Antivirus 2009, Presto TuneUp, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, Live PC Care, PC Live Guard, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus and Smart Security. Whatever their names may be, malware analysts always encourage being cautious around 'security products' that appear to cause more problems than they solve.
Technical Details
File System Modifications
Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.
The following files were created in the system:setup.exe
File name: setup.exeSize: 974.84 KB (974848 bytes)
MD5: 26609b30205bef5f297d0c53c45686c8
Detection count: 18
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: January 8, 2020
%AppData%\result1.db
File name: %AppData%\result1.dbMime Type: unknown/db
Group: Malware file
%AppData%\guard-[RANDOM CHARACTERS].exe
File name: %AppData%\guard-[RANDOM CHARACTERS].exeFile type: Executable File
Mime Type: unknown/exe
Group: Malware file
Registry Modifications
HKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "GuardSoftware" = "%AppData%\guard-[RANDOM CHARACTERS].exe"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes"=".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation"=1HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell"="C:\\Users\\User\\AppData\\Roaming\\guard-[RANDOM CHARACTERS].exe"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger"="svchost.exe"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe "Debugger"="svchost.exe"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "EnableLUA" = "0"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorUser" = "0"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorAdmin" = "0"HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings
Additional Information
# | Message |
---|---|
1 | Error Attempt to run a potentially dangerous script detected. Full system scan is highly recommended. |
2 | Error System data security is at risk! To prevent potential PC errors, run a full system scan. |
3 | Firewall has blocked a program from accessing the Internet c:\windows\system32\iexplore.exe is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server. |
4 | Warning! Identity theft attempt detected Hidden connection IP: xx.xxx.xxx.xxx Target: Microsoft Corporation keys Your IP: 127.0.0.1 |
Leave a Reply
Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter . If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.