SystemWarrior Description

 

 

[+] Click Image to Enlarge

 

 

CartCartCartCart

System Warrior is a fake security application. System Warrior comes from the group of attackers that created other rogue anti-spyware programs in the family of WiniGuard, System Cop and others.

System Warrior uses various methods to make unsuspecting computer users believe that they need to purchase the full System Warrior program to remove a threat. These threats are usually brought to a user’s attention through fake popup warning messages and bogus system scan results. System Warrior is not able to effectively detect or remove computer parasites.

Type: Rogue AntiSpyware Programs

Automatic Detection of SystemWarrior

SystemWarrior Technical Report

As new SystemWarrior details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following SystemWarrior files with its MD5s were created in the system:

SystemWarrior has typically the following processes in memory:

• SystemWarrior.exe

SystemWarrior created the following directories, files, paths:

• %ProgramFiles%\SystemWarrior Software\SystemWarrior

SystemWarrior creates the following registry entries:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “zsx1.tmp.exe”
• SystemWarrior
• HKEY_LOCAL_MACHINE\SOFTWARE\SystemWarrior
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “SystemWarrior”
• HKEY_CURRENT_USER\Software\SystemWarrior
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemWarrior

Important Article Disclaimer