Home Malware Programs Rogue Anti-Spyware Programs Windows Spyware Protection

Windows Spyware Protection

Posted: April 6, 2011

Windows Spyware Protection is a clone of other rogue anti-spyware and security programs. Windows Spyware Protection is a far cry from the helpful application Windows Spyware Protection portrays itself to be, and will create so many fake errors that your system may slow down or crash from it. Besides this most obvious attack, Windows Spyware Protection will also hijack your web browser and crash applications that could be used to delete Windows Spyware Protection and other malware threats. Avoid purchasing Windows Spyware Protection to make Windows Spyware Protection's attacks stop, since this will only put you at risk of fraud. Instead, delete Windows Spyware Protection by using tried and true anti-malware programs after preventing Windows Spyware Protection from launching.

Spying on Windows Spyware Protection's Attacks

Since Windows Spyware Protection runs with each Windows startup due to Registry abuses and will boldly present itself as a useful security product, you will not have any problems detecting Windows Spyware Protection's presence. Besides faking scans of your system with invariably inaccurate and unpleasant results, Windows Spyware Protection will also hit you messages like these, over and over again:

System Security Warning
Attempt to modify register key entries is detected. Register entries analysis is recommended.

Warning! Running trial version!
The security of your computer has been compromised!
Now running trial version of the software!
Click here to purchase the full version of the software and get full protection for your PC!

Warning! Database update failed!
Database update failed!
Outdated viruses databases are not effective and can't [sic] guarantee adequate protection and security for your PC!
Click here to get the full version of the product and update the database!

Warning!
Name: [application file name]
Name: [application file path]
Application that seems to be a key-logger is detected. System information security is at risk. It is recommended to enable the security mode and run total System scanning.

System component corrupted!
System reboot error has occurred due to lsass.exe system process failure.
This may be caused by severe malware infections.
Automatic restore of lsass.exe backup copy completed.

Not only are these errors inaccurate and able to lead you into performing actions that would harm the PC, they also can occur so rapidly and persistently that they cause an overall system slowdown. Other possible attacks include:

  • Disabled Volume Keys (a Microsoft-standard software registration method).
  • Disabled access to various applications, particularly anti-malware scanners and utilities like Task Manager.
  • Hijacked browser behavior, which can include strange errors that block websites, altered search engine results and changes to your homepage settings. If you're exposed to malicious sites through this behavior, other malware besides Windows Spyware Protection may be forced onto your computer via browser exploits.

How to Protect Your PC from Windows Spyware Protection

Windows Spyware Protection is a copy of known rogue security programs like Windows Problems Remover, Best Malware Protection, Windows Health Center and Windows Stability Center. Accordingly, you can protect yourself from all of these rogue security programs, including Windows Spyware Protection, by avoiding their most common infection method: the Fake Microsoft Security Essentials Alert Malware.

This Trojan will trick you into installing Windows Spyware Protection or another rogue security program by displaying a fake alert concerning a 'Win32/Trojan' or Trojan.Horse.Win32.PAV.64.a infection. If you keep your browser security settings strict and avoid downloading files from suspicious sources, your chances of contacting this Trojan will be minimal.

The other most common routes for infection by rogue security programs similar to Windows Spyware Protection include fake codec downloads, files from P2P websites, downloads from fake scanners that falsely detect infections on your PC and script exploits through malicious advertisements.

Any attempts to remove Windows Spyware Protection should also be all-encompassing enough to delete any Trojans or other infections, or you may be seeing Windows Spyware Protection again sooner than you'd like. Before deleting Windows Spyware Protection, make certain Windows Spyware Protection isn't running as a background process by switching to Safe Mode and inspecting all running memory processes in your Task Manager. This will guarantee that removing Windows Spyware Protection a single time will remove Windows Spyware Protection once and for all.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Spyware Protection.lnk
    2 %UserProfile%\Application Data\Windows Spyware Protection
    3 %UserProfile%\Application Data\Windows Spyware Protection\cookies.sqlite
    4 %UserProfile%\Application Data\Windows Spyware Protection\Instructions.ini
    5 %UserProfile%\Desktop\Windows Spyware Protection.lnk
    6 %UserProfile%\Start Menu\Programs\Windows Spyware Protection.lnk
    7 %UserProfile%\Start Menu\Windows Spyware Protection.lnk
    8 C:\Documents and Settings\All Users\Application Data\23077d\CB130_287.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun ""1" = "MSASCui.exe"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "0" = "msseces.exe"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "10" = "avgscanx.exe"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "5" = "avcenter.exe"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "11" = "avgcfgex.exe"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "12" = "avgemc.exe"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "13" = "avgchsvx.exe"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "14" = "avgcmgr.exe"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "15" = "avgwdsvc.exe"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "2" = "ekrn.exe"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "3" = "egui.exe"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "4" = "avgnt.exe"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "6" = "avscan.exe"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "7" = "avgfrw.exe"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "8" = "avgui.exe"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "9" = "avgtray.exe"HKCU\Software\Microsoft\Windows\CurrentVersion\Run "Windows Spyware Protection"

Related Posts

Loading...