Windows Vista Security 2012

Posted: January 10, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	2/10
Infected PCs:	49

First Seen:	January 10, 2012
OS(es) Affected:	Windows

As a fake anti-malware scanner, Windows Vista Security 2012 can pretend to detect viruses, Trojans and other PC threats, but all alerts and warning messages by Windows Vista Security 2012 are fraudulent and don't reflect on the actual presence or lack of infections on your computer. Windows Vista Security 2012 and other variants of Rogue:Win32/FakeRean scamware are often installed by Zlob Trojans that pose in the form of fake codec updates for movie players. There's no security benefit to possessing Windows Vista Security 2012, and tolerating Windows Vista Security 2012's presence for longer than necessary to remove Windows Vista Security 2012 can also result in other attacks against your PC, including browser redirects, blocked security software and reduced security settings. Until you've deleted Windows Vista Security 2012 with an appropriate anti-malware product, SpywareRemove.com malware experts advise you to utterly-ignore all of Windows Vista Security 2012's simulated warning messages and other forms of bad analysis.

Windows Vista Security 2012 – Not as Vista-Specialized as It May Appear to Be

Even though Windows Vista Security 2012 presents itself from the top down as an anti-malware program that's designed to run optimally in Windows Vista, Windows Vista Security 2012 is, in fact, a copy of other FakeRean-derived scamware programs that share its looks, error messages and attack methodologies. These rogue anti-malware applications will configure their names to match the OS that they're attacking, and so you'll only see Windows Vista Security 2012 on a Vista PC, under ordinary circumstances. Some examples of the immense list of Windows Vista Security 2012's clones that SpywareRemove.com malware researchers have noted are Antivirus 2008 Pro, Antivirus XP 2008, Windows Antivirus 2008, Vista Antivirus 2008, PC Clean Pro, Antivirus Pro 2009, Rogue.Vista Antivirus 2008, AntiSpy Safeguard, ThinkPoint, Spyware Protection 2010, Internet Antivirus 2011, Palladium Pro, XP Anti-Virus 2011, CleanThis, XP Security 2012, XP Home Security 2012 and AntiVirus PRO 2015.

Windows Vista Security 2012 is primarily-noteworthy for its tendency to create alerts and system scanner results about infections that aren't on your PC – these warnings may even point to junk files that are created specifically to look like PC threats. Other issues that are often caused by Windows Vista Security 2012 and related PC threats (such as Zlob and Vundo Trojans) include:

Web browser redirects to Windows Vista Security 2012's website, which will attempt to bamboozle you into buying Windows Vista Security 2012. Malicious sites that promote scamware like Windows Vista Security 2012 may also attack your PC with drive-by-download exploits.
Blocked anti-malware programs that could remove Windows Vista Security 2012. Windows Vista Security 2012 may create error messages that indicate that these programs are damaged or infected, but like all of Windows Vista Security 2012's warnings, SpywareRemove.com malware analysts have found these errors to be wholly-deceitful.
Tampered security settings (particularly with respect to the Windows Firewall or your network ports) that make your PC more vulnerable to attacks from PC threats than it normally would be.

Tiptoeing Past Windows Vista Security 2012's Bad Security to Get to the Real Deal

A primary concern before deleting Windows Vista Security 2012 is simply avoiding being led into self-destructive actions by Windows Vista Security 2012's many alerts and warning pop-ups. Since Windows Vista Security 2012 will launch itself automatically (either by launching with Windows or launching whenever another executable is launched) and simulate system scans with inaccurate results, you should be prepared to disregard any scanner results that Windows Vista Security 2012 displays.

Removing Windows Vista Security 2012 should entail usage of trustworthy anti-malware products, particularly since Windows Vista Security 2012 may also be accompanied by Trojans or other PC threats. SpywareRemove.com malware researchers caution you specifically to avoid using Windows Vista Security 2012's included removal tool, since this tool will fail to remove all components of Windows Vista Security 2012 – and hidden components of Windows Vista Security 2012 can, naturally, be significant security hazards for your PC.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%AppData%\Microsoft\Windows\Templates\

File name: %AppData%\Microsoft\Windows\Templates\
Group: Malware file

%LocalAppData%\

File name: %LocalAppData%\
Group: Malware file

%LocalAppData%\.exe

File name: %LocalAppData%\.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

%AllUsersProfile%\

File name: %AllUsersProfile%\
Group: Malware file

%Temp%\

File name: %Temp%\
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_CLASSES_ROOT\ahHKEY_CURRENT_USER\Software\Classes\ah "(Default)" = 'Application'HKEY_CURRENT_USER\Software\Classes\.exe "(Default)" = 'ah'HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = "%LocalAppData%\.exe" -a "%1? %*HKEY_CURRENT_USER\Software\Classes\ah "Content Type" = 'application/x-msdownload'HKEY_CURRENT_USER\Software\Classes\ah\DefaultIcon "(Default)" = '%1'HKEY_CURRENT_USER\Software\Classes\ah\shell\open\command "(Default)" = "%LocalAppData%\.exe" -a "%1" %*HKEY_CLASSES_ROOT\ah\shell\open\command "IsolatedCommand"HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = "%LocalAppData%\.exe" -a "%1" %*HKEY_CLASSES_ROOT\ah\shell\open\command "(Default)" = "%LocalAppData%\.exe" -a "%1" %*

Vista Security 2012