System-check.de

By Domesticus in Rogue Websites

System-check.de Image

System-check.de is the German web interface for the fake defragmenter program System Check. Basically, a computer system infected with one of the German clones of System Check, a common fake defragmenter application, will have its web browser redirect the victim to System-check.de repeatedly. At System-check.de, the victim is prompted to pay for a useless 'full version' of System Check. Any contact with System-check.de means that your computer system has become infected with the System Check rogue defragmenter.

To stop any redirects to System-check.de, ESG security analysts indicate that System Check should be removed completely from the infected computer system. Since System Check has no reliable way of removing it through legitimate means (its uninstaller is fake and crashes your computer system and removing System Check via the Control Panel is useless; System Check will simply reinstall itself the next time Windows reboots – as soon as the uninstall is finished). ESG security analysts recommend the aid of a dedicated anti-malware program to destroy System Check and other malware associated with this fake security program. Doing this should stop your web browser from visiting System-check.de repeatedly. If the redirects continue, you may need to use an anti-rootkit tool, update your security software and ensure that your security program is strong enough to remove System-check.de-related malware from your computer system.

Do Not Fall for the System-check.de Scam!

System-check.de will attempt to convince German speakers that they need to purchase System Check. It provides a credit card entry form where computer users are prompted to enter their information, just as if they were purchasing any other legitimate product over the Internet. However, knowing that the criminals behind System-check.de are also responsible for various malware-related activities, it is obviously not the best option to let them have your credit card information.

If you have already made the mistake of entering your credit card and personal information into the System-check.de interface, ESG security analysts strongly urge you to ensure that your bank accounts and online accounts have not become compromised and to safeguard them before they do. Then, make sure to contact your credit card company. Since System-check.de is part of a well-known online scam, it may be possible to have your credit card company waiving the charges, since they are part of a criminal's attempt to commit fraud or steal your identity.

File System Details

System-check.de may create the following file(s):
# File Name Detections
1. %LocalAppData%.exe
2. %Temp%smtmp1
3. %Temp%smtmp4
4. %StartMenu%ProgramsSystem CheckUninstall System Check.lnk
5. %Temp%smtmp3
6. %StartMenu%ProgramsSystem CheckSystem Check.lnk
7. %Temp%smtmp2
8. %UserProfile%DesktopSystem Check.lnk

Registry Details

System-check.de may create the following registry entry or registry entries:
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedMRU "MRUList"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoDesktop" = '1'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "DisableTaskMgr" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "ShowSuperHidden" = '0'
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun ".exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ""
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "Hidden" = '0'
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations "LowRiskFileTypes" =
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop "NoChangingWallPaper" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'

Trending

Most Viewed

Loading...