Windows Troubles Killer

Windows Troubles Killer is a relative of threats like Windows Salvage System and Windows Custom Settings, with an identical interface and functions. Windows Troubles Killer may pretend to be a security program, but as a threat, Windows Troubles Killer can only create infection warnings about infections that aren't on your computer. Windows Troubles Killer and similar threats are also known to hijack web browsers, and prevent you from using a number of unrelated applications. Because of these security-violating attacks, Windows Troubles Killer should be deleted hastily with the assistance of any available anti-malware application.

Windows Troubles Killer: the PC-Killer to Watch Out For

Windows Troubles Killer is often installed as a payload by Trojans, particularly the Fake Microsoft Security Essentials Alert. Fake Microsoft Security Essentials Alert Trojans are known for creating fake pop-up errors that resemble a Microsoft Essentials Alert, before they install Windows Troubles Killer or a similar rogue security program.

The following is one possible Fake Microsoft Security Essentials Alert error that you might see:

Threat prevention solution found
Security system analysis has revealed critical file system vulnerability caused by severe malware attacks.
Risk of system files infection:
The detected vulnerability may result in unauthorized access to private information and hard drive data with a seriuos [sic] possibility of irreversible data loss and unstable PC performance. To remove the malware please run a full system scan. Press 'OK' to install the software necessary to initiate system files check. To complete the installation process please reboot your computer.

Errors like these try to fool you into believing that Windows Troubles Killer is a real security program, but Windows Troubles Killer's only reason for existence is to steal your credit card information. Towards this end, Windows Troubles Killer will create Windows Troubles Killer's own fake errors that advertise Windows Troubles Killer's nonexistent threat-detection functionality:

System Security Warning
Attempt to modify register key entries is detected. Register entries analysis is recommended.

Warning!
Location: [application file path]
Viruses: Backdoor.Win32.Rbot

Warning!
Name: [application file name]
Name: [application file path]
Application that seems to be a key-logger is detected. System information security is at risk. It is recommended to enable the security mode and run total System scanning.

Warning! Database update failed!
Database update failed!
Outdated viruses databases are not effective and can't [sic] guarantee adequate protection and security for your PC!
Click here to get the full version of the product and update the database!

System component corrupted!
System reboot error has occurred due to lsass.exe system process failure.
This may be caused by severe malware infections.
Automatic restore of lsass.exe backup copy completed.
The correct system performance can not be resumed without eliminating the cause of lsass.exe corruption.

Windows Troubles Killer also uses an interface that pretends to give your PC poor grades on different aspects of security, and may fake system scans. Like the errors that can only detect infections that aren't really there, these Windows Troubles Killer features are fake, and should be ignored.

Your Windows Troubles Killer Problems May Start with Fake Errors – But Don't End with Them

You may also find that other programs perform poorly while Windows Troubles Killer is on your computer. The two most common Windows Troubles Killer-related program attacks are browser hijacks and restricted program usage.

• Windows Troubles Killer will blacklist different programs to stop you from using security and diagnostic tools like anti-virus scanners and the Registry Editor. Many of Windows Troubles Killer's fake errors, as seen earlier, are designed to make it look like these normal programs have become infected.
• Windows Troubles Killer and similar rogue security programs are also responsible for frequent browser hijacks that control which websites your web browser visits. Hijacks can directly redirect you to or from a website without your consent. Windows Troubles Killer hijacks may also be implemented subtlety by using altered search engine results, extra links or fake 'unsafe website' errors to lure you to a harmful website.

File System Modifications

• The following files were created in the system:
  

  #	File Name
  1	%UserProfile%\Application Data\Microsoft\.exe

Registry Modifications

• The following newly produced Registry Values are:
  HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = '0'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore "DisableSR " = '1'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = '0'