Home Malware Programs Rogue Anti-Spyware Programs Windows Servant System

Windows Servant System

Posted: March 9, 2011

The rogue diagnostics application Windows Servant System is a copy of similar online frauds and hurts the proper functioning of your OS by creating alerts about false threats. Windows Servant System also initiates scans with completely disingenuous infection reports. Besides being a threat by itself, this PC threat is known to be dropped by Trojans, so any efforts at deleting Windows Servant System should also look for related Trojan infections.

Hitching a Ride on a Weary Trojan Horse

Windows Servant System is just one of many different computer threats that use the fake Microsoft Security Essentials Alert Malware to infect new machines. This Trojan sneaks onto your PC through malicious site code or by being misnamed as a beneficial file, and then alerts the user to a fake infection. Afterwards, the following message is provided to get the user to install the rogue security product themselves:

Threat prevention solution found
Security system analysis has revealed critical file system vulnerability caused by severe malware attacks.
Risk of system files infection:
The detected vulnerability may result in unauthorized access to private information and hard drive data with a serious possibility of irreversible data loss and unstable PC performance. To remove the malware please run a full system scan. Press ‘OK’ to install the software necessary to initiate system files check. To complete the installation process please reboot your computer.

Immediately rebooting into Safe Mode and taking appropriate actions to remove the Trojan can save you from a malware-plagued fate. Users who don't take these steps will find their computer attacked by Windows Servant System or another clone Trojan such as Windows Debug System, Windows Error Correction or Windows Optimization Center.

Windows Servant System's Infestation of Fake Errors

Blocked security programs, browser hijacks and altered system settings are all signs of probable rogue security program infection, but by far the most dominant symptom of Windows Servant System is simply the error messages. Windows Servant System may use these as a cover when crashing security applications, as in the below example:

Warning!
Name: [program executable]
Name: [program executable file path]
Application that seems to be a key-logger is detected. System information security is at risk. It is recommended to enable the security mode and run total System scanning.

Yet there is no keylogger, other than perhaps any spyware that might have been aided by Trojans related to the Windows Servant System infection. Some other false alerts include:

System Security Warning
Attempt to modify register key entries is detected. Register entries analysis is recommended.

System component corrupted!
System reboot error has occurred due to lsass.exe system process failure.
This may be caused by severe malware infections.
Automatic restore of lsass.exe backup copy completed.
The correct system performance can not be resumed without eliminating the cause of lsass.exe corruption.

In addition to interrupting your computer use with these worthless messages and using them to block applications, Windows Servant System will also run in startup due to Registry changes and abuse this position to flaunt bad scan results in your face. Scan results will always return excessively high infections even if Windows Servant System is the only infection on your machine!

This threat's agenda is to deceive you into paying money to make all these problems go away; deleting Windows Servant System is the only real way to make your computer safe again.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %AppData%\[RANDOM CHARACTERS].exe
    2 %UserProfile%\Application Data\[RANDOM CHARACTERS].exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell "%AppData%\[RANDOM CHARACTERS].exe"HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon | Shell = "%AppData%\{RANDOM CHARACTERS}.exe"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore "DisableSR " = '1'
Loading...