Windows Virus Hunter

Threat Scorecard

Threat Level: 100 % (High)
Infected Computers: 4
First Seen: July 4, 2012
Last Seen: January 8, 2020
OS(es) Affected: Windows

Windows Virus Hunter Image

The image the name Windows Virus Hunter evokes is of a strong, reliable anti-spyware program. Unfortunately, ESG malware researchers have observed that Windows Virus Hunter is a kind of malware infection itself. Windows Virus Hunter belongs to a big family of malware named FakeVimes> which has been active since July of 2009. These fake security program infections had been in decline all through 2011. However, Windows Virus Hunter and its many clones have enjoyed a boost due to a move on the part of their creators. It seems that the criminals behind the FakeVimes family of malware commenced binding these fake security applications with the ZeroAccess rootkit, making them considerably more difficult than normal to remove or detect. Because of this, ESG security researchers strongly advise utilizing an up-to-date anti-malware application capable of removing rootkits in order to deal with Windows Virus Hunter or any of its clones and variants.

Windows Virus Hunter is One of the Many Faces of the FakeVimes Family of Malware

There are dozens of variants and clones of Windows Virus Hunter in the FakeVimes family of malware. In fact, since early 2012, new versions of this fake security program have been released nearly daily. Some examples of clones of Windows Virus Hunter which also include this dangerous rootkit component include fake anti-virus programs such as Virus Melt, Presto TuneUp, Fast Antivirus 2009, Extra Antivirus, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, PC Live Guard, Live PC Care, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus, Smart Security, Windows Protection Suite, Windows Work Catalyst.

All of these fake security applications will carry out the same basic scam; they will use a series of alarming error messages and annoying pop-up windows to convince their victims that they must register for an expensive 'full version' of Windows Virus Hunter. Since Windows Virus Hunter is a malware infection itself, ESG malware researchers strongly advise against purchasing Windows Virus Hunter or installing Windows Virus Hunter on your computer system. ESG malware researchers strongly advise disregarding all warnings and messages originating from Windows Virus Hunter, since they are all part of this fake security program's scam. You can 'register' Windows Virus Hunter with the code 0W000-000B0-00T00-E0020. Registering Windows Virus Hunter will not remove this fake security program from your machine. However, it will stop many of its irritating error messages and other symptoms, such as browser redirects. This can be used to aid the complete removal of Windows Virus Hunter with a reliable anti-malware program.

SpyHunter Detects & Remove Windows Virus Hunter

Windows Virus Hunter Video

Tip: Turn your sound ON and watch the video in Full Screen mode.

File System Details

Windows Virus Hunter may create the following file(s):
# File Name MD5 Detections
1. Protector-rmgh.exe f07d2f5146f1f2eed87620e7f0d37d55 1
2. %CommonAppData%\58ef5\SP98c.exe
3. %AppData%\Windows Virus Hunter\ScanDisk_.exe
4. %Desktop%\Windows Virus Hunter.lnk
5. %CommonAppData%\SPUPCZPDET\SPABOIJT.cfg
6. %AppData%\Microsoft\Internet Explorer\Quick Launch\Windows Virus Hunter.lnk
7. %StartMenu%\Windows Virus Hunter.lnk
8. %AppData%\Windows Virus Hunter\Instructions.ini
9. %Programs%\Windows Virus Hunter.lnk
10. %CommonAppData%\58ef5\SPT.ico

Registry Details

Windows Virus Hunter may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Windows Virus Hunter\DisplayIcon = [UNKNOWN DIRECTORY]\[UNKNOWN FILE NAME].exe,0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Windows Virus Hunter\UninstallString = "[UNKNOWN DIRECTORY]\[UNKNOWN FILE NAME].exe" /del
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\[UNKNOWN FILE NAME].DocHostUIHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Dumped_.DocHostUIHandler\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Dumped_.DocHostUIHandler\Implements DocHostUIHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\MaxFileSize 1048576
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWEBGRD.EXE\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\About.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\About.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AluSchedulerSvc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe\"Debugger" = "svchost.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Windows Virus Hunter
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Windows Virus Hunter\DisplayName = Windows Malware Firewall
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Windows Virus Hunter\Publisher UIS Inc.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\Implements DocHostUIHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Dumped_.DocHostUIHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\EnableConsoleTracing 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\FileTracingMask -65536
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWEBGRD.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Windows Virus Hunter "%CommonAppData%\58ef5\SP98c.exe" /s /d
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Windows Virus Hunter\DisplayVersion = 1.1.0.1010
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Windows Virus Hunter\InstallLocation = [UNKNOWN DIRECTORY]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\[UNKNOWN DIRECTORY]\[UNKNOWN FILE NAME].exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Dumped_.DocHostUIHandler\Clsid\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\EnableFileTracing 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\ConsoleTracingMask -65536
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\FileDirectory %windir%\tracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AluSchedulerSvc.exe\"Debugger" = "svchost.exe"

Related Posts

Trending

Most Viewed

Loading...