Home Malware Programs Rogue Anti-Spyware Programs Windows Problems Stopper

Windows Problems Stopper

Posted: March 18, 2012

Threat Metric

Threat Level: 2/10
Infected PCs: 40
First Seen: March 18, 2012
OS(es) Affected: Windows

Windows Problems Stopper Screenshot 1Windows Problems Stopper is a fake anti-virus and general PC security product that displays fraudulent information instead of legitimate system analyses or threat alerts. Because Windows Problems Stopper is closely related to other rogue anti-virus applications with minimal differences between them (besides their brand name), Trojans that are capable of installing Windows Problems Stopper may also be able to install similar scamware from the same family. While Windows Problems Stopper may not have the ability to cause serious damage to your PC, a Windows Problems Stopper infection may prevent you from using your web browser properly or using real anti-malware programs, and SpywareRemove.com malware researchers recommend for you to disable Windows Problems Stopper and kick Windows Problems Stopper out of your PC without any delay.

Windows Problems Stopper – Unleashing a Torrent of Problems That It Has No Intention of Slowing Down

Windows Problems Stopper and similar PC threats from its family (identified by some PC security companies as FakeVimes) are often installed by fake online scanners, although they may also propagate via other methods, such as direct installation attacks through your web browser or as a payload for a Trojan. SpywareRemove.com malware research team also discovered that a combination of constantly-active anti-malware software and basic safety while web-browsing is an effective defense against Windows Problems Stopper attacks. The same also applies for clones of Windows Problems Stopper, such as Privacy Guard Pro, Extra Antivirus, Fast Antivirus 2009, Presto TuneUp, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, Live PC Care, PC Live Guard, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus, Smart Security and PrivacyGuard Pro 2.0.

Although its attempts to fake security features are Windows Problems Stopper's most obvious symptoms, SpywareRemove.com malware experts have shown more concern over Windows Problems Stopper's capability to cause security vulnerabilities. Until Windows Problems Stopper is shut down and removed from your PC, your computer may be vulnerable to such attacks as:

  • Browser hijacks that can censor websites or redirect you to harmful ones (such as Windows Problems Stopper's website).
  • Blocked programs, particularly with respect to security, diagnostic and anti-malware applications that could identify or remove Windows Problems Stopper from your computer.

Putting a Stopper on a Case Windows Problems Stopper Attacks

Once Windows Problems Stopper is installed, Windows Problems Stopper can be detected by its flood of fake alerts, simulated scans and other attempts to fool you into thinking that Windows Problems Stopper is a PC security product. Resolving these issues and deleting Windows Problems Stopper is likely to require stopping Windows Problems Stopper's startup routine, which SpywareRemove.com malware analysts recommend doing by way of Safe Mode or a removable drive-based boot.

After shutting Windows Problems Stopper down, you should scan your computer with appropriate security software to detect both Windows Problems Stopper and any related PC threats that may also be installed. Since Windows Problems Stopper places your computer in a state of lax security, SpywareRemove.com malware experts suggest that you should consider your PC vulnerable to attack until Windows Problems Stopper and its changes have been completely abolished.

Windows Problems Stopper Screenshot 2Windows Problems Stopper Screenshot 3Windows Problems Stopper Screenshot 4Windows Problems Stopper Screenshot 5Windows Problems Stopper Screenshot 6Windows Problems Stopper Screenshot 7Windows Problems Stopper Screenshot 8Windows Problems Stopper Screenshot 9Windows Problems Stopper Screenshot 10Windows Problems Stopper Screenshot 11Windows Problems Stopper Screenshot 12Windows Problems Stopper Screenshot 13

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to Windows Problems Stopper may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria .

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%AppData%\result.db File name: %AppData%\result.db
Mime Type: unknown/db
Group: Malware file
%AppData%\NPSWF32.dll File name: %AppData%\NPSWF32.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%AppData%\Protector-[RANDOM 3 CHARACTERS].exe File name: %AppData%\Protector-[RANDOM 3 CHARACTERS].exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%CommonStartMenu%\Programs\Windows Problems Stopper.lnk File name: %CommonStartMenu%\Programs\Windows Problems Stopper.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file
%Desktop%\Windows Problems Stopper.lnk File name: %Desktop%\Windows Problems Stopper.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorAdmin" = 0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorUser" = 0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "EnableLUA" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "qfsbuqlsme"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "net" = "2012-3-18_2"HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sperm.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atcon.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsecomr.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonealarm.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bidef.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscache.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prmt.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsm32.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"