Home Malware Programs Rogue Anti-Spyware Programs Windows Activity Booster

Windows Activity Booster

Posted: December 9, 2013

Threat Metric

Threat Level: 10/10
Infected PCs: 12
First Seen: December 9, 2013
Last Seen: January 8, 2020
OS(es) Affected: Windows

Windows Activity Booster Screenshot 1Windows Activity Booster is a rogue anti-malware product of a family known for its predisposition towards blocking other applications (including essential security ones) and loading fraudulent pop-up warnings to bully its victims into buying its software registration keys. Although warning messages, scans and other Windows Activity Booster-delivered information may imply that your computer is suffering from a range of malfunctions that must be resolved, Windows Activity Booster only detects fake system problems and doesn't have any real anti-malware or system-cleaning features. As with all scamware, deleting Windows Activity Booster immediately and with a real anti-malware product is urgently advised by malware researchers for your computer's safety.

The Booster that Boosts Your PC in the Wrong Direction

A fraudulent security and system optimization product without any beneficial features, Windows Activity Booster always must be considered unsafe to your PC to the same degree as a Trojan, virus or other threat. Although Windows Activity Booster does 'boost' the ongoing activities of your computer, all of its functions are intended either to confuse you about your PC's state of security or disable security features. Major functions of Windows Activity Booster that malware researchers considered worthy of outlining include:

  • Redirecting your browser to fraudulent error pages – and, in the process, blocking various security-related sites.
  • Blocking other applications arbitrarily. Windows Activity Booster may force Svchost.exe (a basic Windows component) to launch instead of the intended software.
  • Loading fake error pop-ups with a range of semi-convincing formats and messages. Imitation firewall alerts and warnings about threat attacks both are common.

Together, Windows Activity Booster's features prevent you from using most obvious security solutions while also tempting you to spend money on its software, supposedly as a solution to the fake problems Windows Activity Booster 'detects.' Of course, malware experts stressed that there absolutely is no advantage to purchasing Windows Activity Booster, even to assist with its removal.

Preventing Windows Activity Booster from Meddling with Your PC Activities

While it may be very apparent that deleting Windows Activity Booster is the best thing for your computer, any method of removing Windows Activity Booster must be able to work around its software-blocking functions. However, such functions are particularly common with FakeVimes scamware and other rogue security programs that malware experts have examined in the past, and there are well-honed ways of dealing with them. As an initial volley, restarting your PC from an emergency boot CD, DVD or USB drive should disable most threats readily. From there, using legitimate anti-malware products to delete Windows Activity Booster from Safe Mode should provide an ample finisher for disinfecting your system.

Windows Activity Booster is a recent example of similar scamware products distributed throughout the world, with brand names changing regularly. Even when ignoring other major families like WinWebSec or FakeRean, close relatives of Windows Activity Booster that also should be treated as threats to your PC include Privacy Guard Pro, PrivacyGuard Pro 2.0, Extra Antivirus, Fast Antivirus 2009, Presto TuneUp, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, Live PC Care, PC Live Guard, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus and Smart Security. Whatever their names may be, malware analysts always encourage being cautious around 'security products' that appear to cause more problems than they solve.

Windows Activity Booster Screenshot 2Windows Activity Booster Screenshot 3Windows Activity Booster Screenshot 4Windows Activity Booster Screenshot 5Windows Activity Booster Screenshot 6Windows Activity Booster Screenshot 7Windows Activity Booster Screenshot 8

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



setup.exe File name: setup.exe
Size: 974.84 KB (974848 bytes)
MD5: 26609b30205bef5f297d0c53c45686c8
Detection count: 18
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: January 8, 2020
%AppData%\result1.db File name: %AppData%\result1.db
Mime Type: unknown/db
Group: Malware file
%AppData%\guard-[RANDOM CHARACTERS].exe File name: %AppData%\guard-[RANDOM CHARACTERS].exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "GuardSoftware" = "%AppData%\guard-[RANDOM CHARACTERS].exe"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes"=".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation"=1HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell"="C:\\Users\\User\\AppData\\Roaming\\guard-[RANDOM CHARACTERS].exe"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger"="svchost.exe"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe "Debugger"="svchost.exe"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "EnableLUA" = "0"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorUser" = "0"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorAdmin" = "0"HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings

Additional Information

The following messages's were detected:
# Message
1Error
Attempt to run a potentially dangerous script detected.
Full system scan is highly recommended.
2Error
System data security is at risk!
To prevent potential PC errors, run a full system scan.
3Firewall has blocked a program from accessing the Internet
c:\windows\system32\iexplore.exe
is suspected to have infected your PC.
This type of virus intercepts entered data and transmits them to a remote server.
4Warning! Identity theft attempt detected
Hidden connection IP: xx.xxx.xxx.xxx
Target: Microsoft Corporation keys
Your IP: 127.0.0.1

Loading...