Windows Advanced Security Center Description

Despite its name, Windows Advanced Security Center is not associated with Microsoft Security Center nor does Windows Advanced Security Center provide legitimate security for your PC. Rather, Windows Advanced Security Center is a kind of malware infection known as a rogue security program. These kinds of malware infections will try to convince inexperienced computer users that they need to purchase a ‘full version’ of Windows Advanced Security Center in order to fix nonexistent problems on their computer system. This scam is among the most common types of malware scams.

There are countless different versions of the Windows Advanced Security Center scam. While some are simple fake security programs that limit themselves to pretending to be real anti-virus programs and displaying some fake error messages, some pose a severe danger to a computer system due to their intrusive practices. Unfortunately, Windows Advanced Security Center is part of this second category of malware infection. Windows Advanced Security Center will rarely attack alone and will often be associated with various Trojan and rootkit components that can wreak havoc on a computer. Because of this, apart from fake error messages a Windows Advanced Security Center infection will also be accompanied with browser redirects, system crashes, decreases system performance and the presence of other malware on the infected computer system.

Windows Advanced Security Center’s Many Clones

Windows Advanced Security Center is part of a large family of malware known as Rogue:FakeVimes. Fake security programs in the FakeVimes family have been around since 2009. There are dozens of clones of Windows Advanced Security Center, for example programs like Windows Pro Web Helper, Windows Internet Booster and Windows Daily Advisor. The FakeVimes family of malware is a well-known threat that can be removed with most security programs. However, malware in this family released after January of 2012 (including Windows Advanced Security Center) has been associated with a rootkit component that is significantly more difficult to remove than other kinds of malware. Often, removing this rootkit component requires a specialized anti-rootkit application.

The code 0W000-000B0-00T00-E0020 has proven useful in ‘registering’ malware in the FakeVimes family. While this will not remove Windows Advanced Security Center, it will stop many of its irritating error messages and facilitate removing this malware infection with a reliable anti-malware program. ESG security researchers strongly advise against purchasing Windows Advanced Security Center’s fake “full version’; this will do nothing to remove Windows Advanced Security Center and will place your credit card information in the hands of unscrupulous criminals.

Type: Rogue AntiSpyware Programs

How Can You Detect Windows Advanced Security Center?

Windows Advanced Security Center Removal Details

Windows Advanced Security Center has typically the following processes in memory:

• %AppData%\Protector-{RANDOM 4 CHARACTERS}.exe
• %AppData%\Protector-{RANDOM 3 CHARACTERS}.exe
• %AppData%\NPSWF32.dll

Windows Advanced Security Center creates the following files in the system:

• %StartMenu%\Windows Advanced Security Center.lnk

Windows Advanced Security Center creates the following registry entries:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “net” = 2012-2-20_1
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “ID” = 4
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegistryTools” = 0
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{RANDOM CHARACTERS}.exe
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegedit” = 0
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0

Important Article Disclaimer