Windows Antivirus Helper

Posted: February 28, 2014

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	19

First Seen:	February 28, 2014
Last Seen:	January 25, 2023
OS(es) Affected:	Windows

Windows Antivirus Helper is a fake anti-malware program cloned from previous, identical versions of scamware, such as Windows Antivirus Tool. Because Windows Antivirus Helper is fraudulent security software unable to provide any of the anti-virus features Windows Antivirus Helper boasts having, there's no cause for purchasing Windows Antivirus Helper, regardless of how urgently Windows Antivirus Helper may request your money. Besides the usual pop-up nags and other symptoms of questionable free software, Windows Antivirus Helper is also associated with the potential for attacks against other programs, and malware researchers are comfortable in declaring Windows Antivirus Helper a threat that should be exterminated without so much as a pause.

A Helper Whose Help is Toxic to Your PC's Safety

Families of fake anti-malware programs tend to re-create their members with new names fairly regularly, with Windows Antivirus Helper serving as an example of their names often take forms that imply the exact opposite of the program's functions. Although Windows Antivirus Helper doesn't possess any security-benefiting functions for your computer, Windows Antivirus Helper does include some real functions that either confuse its victims into a loss of money or barricade the infected PC by denying it any access to real security products. Some of the issues malware researchers most often see with Windows Antivirus Helper and its family members include:

Windows Antivirus Helper may create pop-up warnings that imitate the security functions of real PC security suites. Windows Antivirus Helper's pop-ups, unlike real security features, exist to provide fake information about a threat that's not on your computer, even when they identify specific programs and threats.
In some cases, Windows Antivirus Helper's pop-ups may be accompanied by Windows Antivirus Helper actively blocking any software that Windows Antivirus Helper claims is compromised by threats. The programs that Windows Antivirus Helper blocks are determined by its personal blacklist, and don't correspond to any actual problems with these products.
Of course, no security scanner would be complete without the ability to scan your computer, although Windows Antivirus Helper's results are predetermined for inaccuracy. As with its pop-ups, malware experts found that Windows Antivirus Helper generates lists of 'infected programs' that actually are clean, and always will identify the presence of various, high-level PC threats, even on systems whose only infection is Windows Antivirus Helper.

Helping Yourself out of a Helping of Scamware Trouble

Windows Antivirus Helper is no more a help to your PC's security than any other member of its family, the FakeVimes family, even though its every feature is designated to give the impression that Windows Antivirus Helper is protecting you – or encouraging you to buy additional protection. As illicit and threatening software, Windows Antivirus Helper's purchase always is against your best interests, and malware researchers warn that you should treat any information transferred in such a process as being under the wrong hands' control. As usual, removing Windows Antivirus Helper from your computer is most safely done with explicit anti-malware products, although some basic security steps may be needed to allow these programs to ignore Windows Antivirus Helper's software-blocking attacks.

Windows Antivirus Helper and similar PC threats most often enjoy distribution through corrupted
website-embedded JavaScript and related exploits, although other infection vectors also are more than possible. Windows Antivirus Helper's numerous clones include Privacy Guard Pro, PrivacyGuard Pro 2.0, Extra Antivirus, Fast Antivirus 2009, Presto TuneUp, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, Live PC Care, PC Live Guard, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus and Smart Security.. A little concern about which sites you visit and which places you trust to download security software from can help protect your PC from more than a few future problems from Windows Antivirus Helper and other fraudulent products.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

svc-yiec.exe

File name: svc-yiec.exe
Size: 1.07 MB (1073152 bytes)
MD5: e522866b2e72a9a23a2c0060f7c6f4f5
Detection count: 6
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: February 28, 2014

%AppData%\data.sec

File name: %AppData%\data.sec
Mime Type: unknown/sec
Group: Malware file

%AppData%\svc-[RANDOM CHARACTERS].exe

File name: %AppData%\svc-[RANDOM CHARACTERS].exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

%AllUsersProfile%\Start Menu\Programs\Windows Antivirus Helper.lnk

File name: %AllUsersProfile%\Start Menu\Programs\Windows Antivirus Helper.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file

%UserProfile%\Desktop\Windows Antivirus Helper.lnk

File name: %UserProfile%\Desktop\Windows Antivirus Helper.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

File name without pathWindows AntiVirus Helper.lnkHKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "S_SC" = %AppData%\svc-[RANDOM CHARACTERS].exeHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "ZSFT" = %AppData%\svc-[RANDOM CHARACTERS].exeHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "MS-SEC" = %AppData%\svc-[RANDOM CHARACTERS].exeHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = 1HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" = "%AppData%\svc-[RANDOM CHARACTERS].exe"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorAdmin" = 0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorUser" = 0HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\bckd "ImagePath" = 22.sys HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "EnableLUA" = 0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "EnableVirtualization" = 0HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exeHKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exeHKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exeHKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exeHKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exeHKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exeHKEY_LOCAL_MACHINE\Software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\k9filter.exe

Additional Information

The following messages's were detected:

#	Message
1	Error System data security is at risk! To prevent potential PC errors, run a full system scan.
2	Error Trojan activity detected. System integrity at risk. Full system scan is highly recommended.
3	Firewall has blocked a program from accessing the Internet Internet Explorer C:\Windows\system32\iexplore.exe is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server.ran