English 
Secret Service Secret Service
By
ZulaZuza in Rogue Anti-Spyware Program |
74 views
(No Ratings Yet)
Loading ...
Secret Service Description
Secret Service is a rogue anti-spyware application emanating from the same developers of another rogue spyware remover called Crusader Antivirus. Secret Service is typically promoted through browser hijacking techniques or through affiliated trojans infiltrating the system via security exploits, all without informed consent from the user. Once active, Secret Service displays fictitious and often grossly exaggerated infection results, along with pop-up advertisements prompting the user to purchase and download the fake spyware remover Secret Service in order to combat these imaginary threats.
Type: Rogue AntiSpyware Programs
Automatic Detection of Secret Service
Secret Service Technical Report
As new Secret Service details are reported by our customers and findings from our Threat Research Center, we will update this section.
The following Secret Service files with its MD5s were created in the system:
| File Name | File Size | MD5 |
|---|
| ~1.exe | 1064960 | 5e8cb92e57ca480c144e8c03c53f4c81 |
| protector.exe | 1064960 | 5e8cb92e57ca480c144e8c03c53f4c81 |
| setup[1].exe | 1064960 | 5e8cb92e57ca480c144e8c03c53f4c81 |
| setup[1].exe | 200704 | da10daa9a0b75be25553206a849bec11 |
| ~3.dll | 221184 | 8a78faa4955f16e537324576b9152e8d |
| ~130F.dll | 219648 | 4bb3a643113188af2d853cbec7f7d734 |
| ~C2F0.dll | 219136 | 1459abb0f782909d417f3aabcd5e9d7c |
Secret Service created the following directories, files, paths:
- %ProgramFiles%\SecretService
Secret Service creates the following registry entries:
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run “Secret Service”
- 5199201E-60B4-11DE-85CF-260556D89593
- Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\5199201E-60B4-11DE-85CF-260556D89593
- 93E601D3-978D-4D52-AC7F-D541E5F7CA51
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Secret Service
- SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SecretService
- Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\5199201E-60B4-11DE-85CF-260556D89593
- Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace\5199201E-60B4-11DE-85CF-260556D89593
- HKEY_LOCAL_MACHINE\Software\Secret Service
- 25469879-7856-4D09-83C1-456546545454
- Microsoft\Internet Explorer\Extensions\5199201E-60B4-11DE-85CF-260556D89593
- Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\5199201E-60B4-11DE-85CF-260556D89593
- B8C60D42-9881-11DE-B7C5-CD5255D89593
Important Article Disclaimer
