Windows Safeguard Upgrade

Posted: May 17, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	7

First Seen:	May 17, 2012
OS(es) Affected:	Windows

Rather than being an improvement to your computer's security, SpywareRemove.com malware experts consider Windows Safeguard Upgrade to be a hefty downgrade for the safety of any PC, due to its membership in the wide-ranging rogue AV software family of FakeVimes. Like the other fake anti-virus programs that Windows Safeguard Upgrade is inspired by, Windows Safeguard Upgrade is only capable of creating fake security information, such as pop-up alerts, scanner results and taskbar notifications that contain warnings about nonexistent attacks, security vulnerabilities or PC threats on your computer. This barrage of fraudulent security info is just Windows Safeguard Upgrade's trail of breadcrumbs on the way to defrauding you of your money, but purchasing Windows Safeguard Upgrade is never a good idea or even necessary to expedite Windows Safeguard Upgrade's removal. Due to accompanying security issues that Windows Safeguard Upgrade may also cause, deleting Windows Safeguard Upgrade with good anti-malware software is strongly recommended.

The Facts About Windows Safeguard Upgrade's Fraudulent Upgrade for Your PC's Security

For those who aren't familiar with scamware based on recent templates from Win32/FakeVimes, Windows Safeguard Upgrade may look like a convincing and surprisingly fully-featured anti-virus scanner with inclusions such as defenses against phishing attacks and a memory process utility. Sadly, Windows Safeguard Upgrade's real features belie its appearance, given that Windows Safeguard Upgrade, like all members of its family, is incapable of giving you any type of protection from PC threats or accurate identification of the same. SpywareRemove.com malware researchers have found that, after Windows Safeguard Upgrade uses typical Windows Registry exploits to launch itself automatically, Windows Safeguard Upgrade will display a range of different fake security alerts, including scanner results that always contain non-present types of malware. Some of the many clones of Windows Safeguard Upgrade are Privacy Guard Pro, PrivacyGuard Pro 2.0, Extra Antivirus, Fast Antivirus 2009, Presto TuneUp, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, Live PC Care, PC Live Guard, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus and Smart Security.

Windows Safeguard Upgrade would like you to believe that these alerts are genuine so that Windows Safeguard Upgrade can persuade you to spend money on its registration key, which SpywareRemove.com malware analysts discourage as unnecessary and potentially hazardous for your associated financial information. However, faking Windows Safeguard Upgrade's registration with the free key '0W000-000B0-00T00-E0020' is a viable option for lowering Windows Safeguard Upgrade's defenses, which may make it less tedious than usual to delete Windows Safeguard Upgrade with suitable security software.

Why Windows Safeguard Upgrade and Anything Like It is a Straight Security Downgrade

Windows Safeguard Upgrade may not be able to provide genuine security functions, but Windows Safeguard Upgrade can be a source of actual security risks, like all other FakeVimes-based rogue anti-virus scanners. SpywareRemove.com malware researchers particularly caution to be on guard against the attacks noted below until you've deleted Windows Safeguard Upgrade:

Windows settings that are changed for worsened security such as a disabled UAC and disabled checks against files with invalid signature identification.
Hosts file alterations that redirect your browsers to unusual sites (with an emphasis on fraudulent search engines).
Blocked security programs, including Task Manager, which Windows Safeguard Upgrade will replace with its own (worthless) memory-monitoring utility.

Windows Safeguard Upgrade, like related PC threats, is only designed to attack Windows computers and should be removed with anti-malware scans that can also reverse its destructive setting changes.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%APPDATA%\Protector-jxir.exe

File name: Protector-jxir.exe
Size: 2.03 MB (2039808 bytes)
MD5: 9f05820de768ce99a6ba71d0c567740e
Detection count: 79
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%
Group: Malware file
Last Updated: May 17, 2012

%APPDATA%\Protector-vdom.exe

File name: Protector-vdom.exe
Size: 2.04 MB (2043904 bytes)
MD5: f774fa4c8a47f377b724286900af5d2d
Detection count: 41
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%
Group: Malware file
Last Updated: May 17, 2012

%APPDATA%\Protector-leer.exe

File name: Protector-leer.exe
Size: 2.08 MB (2085376 bytes)
MD5: 20fe0825152fdc6a8c16825bcc233bd1
Detection count: 14
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%
Group: Malware file
Last Updated: May 17, 2012

%AppData%\NPSWF32.dll

File name: %AppData%\NPSWF32.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file

%AppData%\Protector-{RANDOM 3 CHARACTERS}.exe

File name: %AppData%\Protector-{RANDOM 3 CHARACTERS}.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

%AppData%\Protector-{RANDOM 4 CHARACTERS}.exe

File name: %AppData%\Protector-{RANDOM 4 CHARACTERS}.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

%StartMenu%\ Windows Safeguard Upgrade .lnk

File name: %StartMenu%\ Windows Safeguard Upgrade .lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "ID" = 4HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "net" = 2012-2-20_1HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{RANDOM CHARACTERS}.exeHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"