Safety Center Description

 

 

[+] Click Image to Enlarge

 

 

CartCartCartCartCartCartCartCart

Safety Center is a rogue anti-spyware application originating from the same family as Secret Service and Privacy Center. Safety Center must be installed manually, and once active, begins display fake infection results in order to trick the user into believing that the computer has been compromised. The user is then prompted to purchase the commercial version of Safety Center in order to combat these threats or fix the various problems.

Type: Rogue AntiSpyware Programs

How Can You Detect Safety Center?

Safety Center Technical Report

As new Safety Center details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following Safety Center files with its MD5s were created in the system:

Safety Center has typically the following processes in memory:

• cs_def.exe
• Adrevolver.txtAds360.com
• 102.exe
• install_tag002.exe
• start.exe
• protector.exe
• trojan.psw.stealth.a.exe
• tdfhex.dll

Safety Center created the following directories, files, paths:

• %ProgramFiles%\SafetyCenter

Safety Center creates the following registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EB09B56A-91AB-11DE-95FD-A39056D89593}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{BCA9B86C-91BC-11DE-B1CD-35C755D89593}
• HKEY_LOCAL_MACHINE\SOFTWARE\SafetyCenter
• SOFTWARE\SafetyCenter
• 0766AD3F-6636-454E-B95B-FDB1DD2CE4EB
• A73890FC-177F-4198-AE3D-C64F7D9E69D8
• HKEY_CLASSES_ROOT\CLSID\{EB09B56A-91AB-11DE-95FD-A39056D89593}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{BCA9B86C-91BC-11DE-B1CD-35C755D89593}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SafetyCenter
• EB09B56A-91AB-11DE-95FD-A39056D89593
• 88A5EFA0-AA5D-4684-9CC2-5EDEC8E84655
• DD1984BA-25E1-4F56-B124-A07ED6B2A87F
• HKEY_CLASSES_ROOT\CLSID\{BCA9B86C-91BC-11DE-B1CD-35C755D89593}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{BCA9B86C-91BC-11DE-B1CD-35C755D89593}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace\{BCA9B86C-91BC-11DE-B1CD-35C755D89593}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce “SafetyCenter”
• BCA9B86C-91BC-11DE-B1CD-35C755D89593
• 2414A739-9651-441B-BC10-D773267CC19D
• 95E14BC7-C5F1-4545-8064-E8DAA621580C

Important Article Disclaimer