Windows Problems Stopper

Posted: March 18, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	2/10
Infected PCs:	40

First Seen:	March 18, 2012
OS(es) Affected:	Windows

Windows Problems Stopper is a fake anti-virus and general PC security product that displays fraudulent information instead of legitimate system analyses or threat alerts. Because Windows Problems Stopper is closely related to other rogue anti-virus applications with minimal differences between them (besides their brand name), Trojans that are capable of installing Windows Problems Stopper may also be able to install similar scamware from the same family. While Windows Problems Stopper may not have the ability to cause serious damage to your PC, a Windows Problems Stopper infection may prevent you from using your web browser properly or using real anti-malware programs, and SpywareRemove.com malware researchers recommend for you to disable Windows Problems Stopper and kick Windows Problems Stopper out of your PC without any delay.

Windows Problems Stopper – Unleashing a Torrent of Problems That It Has No Intention of Slowing Down

Windows Problems Stopper and similar PC threats from its family (identified by some PC security companies as FakeVimes) are often installed by fake online scanners, although they may also propagate via other methods, such as direct installation attacks through your web browser or as a payload for a Trojan. SpywareRemove.com malware research team also discovered that a combination of constantly-active anti-malware software and basic safety while web-browsing is an effective defense against Windows Problems Stopper attacks. The same also applies for clones of Windows Problems Stopper, such as Privacy Guard Pro, PrivacyGuard Pro 2.0, Extra Antivirus, Fast Antivirus 2009, Presto TuneUp, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, Live PC Care, PC Live Guard, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus and Smart Security.

Although its attempts to fake security features are Windows Problems Stopper's most obvious symptoms, SpywareRemove.com malware experts have shown more concern over Windows Problems Stopper's capability to cause security vulnerabilities. Until Windows Problems Stopper is shut down and removed from your PC, your computer may be vulnerable to such attacks as:

Browser hijacks that can censor websites or redirect you to harmful ones (such as Windows Problems Stopper's website).
Blocked programs, particularly with respect to security, diagnostic and anti-malware applications that could identify or remove Windows Problems Stopper from your computer.

Putting a Stopper on a Case Windows Problems Stopper Attacks

Once Windows Problems Stopper is installed, Windows Problems Stopper can be detected by its flood of fake alerts, simulated scans and other attempts to fool you into thinking that Windows Problems Stopper is a PC security product. Resolving these issues and deleting Windows Problems Stopper is likely to require stopping Windows Problems Stopper's startup routine, which SpywareRemove.com malware analysts recommend doing by way of Safe Mode or a removable drive-based boot.

After shutting Windows Problems Stopper down, you should scan your computer with appropriate security software to detect both Windows Problems Stopper and any related PC threats that may also be installed. Since Windows Problems Stopper places your computer in a state of lax security, SpywareRemove.com malware experts suggest that you should consider your PC vulnerable to attack until Windows Problems Stopper and its changes have been completely abolished.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%AppData%\result.db

File name: %AppData%\result.db
Mime Type: unknown/db
Group: Malware file

%AppData%\NPSWF32.dll

File name: %AppData%\NPSWF32.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file

%AppData%\Protector-[RANDOM 3 CHARACTERS].exe

File name: %AppData%\Protector-[RANDOM 3 CHARACTERS].exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

%CommonStartMenu%\Programs\Windows Problems Stopper.lnk

File name: %CommonStartMenu%\Programs\Windows Problems Stopper.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file

%Desktop%\Windows Problems Stopper.lnk

File name: %Desktop%\Windows Problems Stopper.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorAdmin" = 0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorUser" = 0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "EnableLUA" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "qfsbuqlsme"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "net" = "2012-3-18_2"HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sperm.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atcon.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsecomr.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonealarm.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bidef.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscache.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prmt.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsm32.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"