Windows Security Suite Description

 

 

[+] Click Image to Enlarge

 

 

CartCartCartCartCartCart

Windows Security Suite is a rogue anti-spyware application designed by the creators of Antivirus System Pro and Spyware Protect 2009. Due to affiliated trojans infiltrating the computer via security exploits and activating Windows Security Suite, a false system scan displays fictitious and sometimes grossly exaggerated infection results, along with numerous fake security alerts, all in an attempt to intimidate the user into thinking the system is threatened. User is then prompted to purchase and download the fake spyware remover Windows Security Suite in order to combat this threat.

Type: Rogue AntiSpyware Programs

How Can You Detect Windows Security Suite?

Windows Security Suite Technical Report

As new Windows Security Suite details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following Windows Security Suite files with its MD5s were created in the system:

Windows Security Suite has typically the following processes in memory:

• WI345d.exe
• energy.dll
• kernel32.dll
• SM.dll
• tempdoc.dll
• sqlite3.dll
• dudl.sys
• grid.sys
• runddl.dll
• std.exe
• mozcrt19.dll
• CLSV.exe
• grid.dll
• PE.dll
• snl2w.exe
• WS9e6d.exe

Windows Security Suite creates the following registry entries:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform “698909210803″
• HKEY_CLASSES_ROOT\WI345d.DocHostUIHandler
• WIdccb.DocHostUIHandler
• HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Windows Security Suite”

Important Article Disclaimer