Threat Database Rogue Anti-Spyware Program Windows Activity Inspector

Windows Activity Inspector

Windows Activity Inspector Image

Windows Activity Inspector is just one more addition to the already huge family of rogue anti-spyware programs delivered by the Fake Microsoft Security Essentials Alert Trojan. Programs like Windows Activity Inspector take over a computer system and cause numerous harmful changes to its operation. These programs do this to blackmail the computer user into buying a fake security solution (in this case Windows Activity Inspector) supposedly to get rid of the problem. Don't fall for the scam; Windows Activity Inspector is a malicious application that should be removed immediately.

Windows Activity Inspector and the Fake Microsoft Security Essentials Alert Family

Windows Activity Inspector belongs to the Fake Microsoft Security Essentials Alert family of rogue programs. This family of rogue anti-spyware applications gets its name because programs in it are typically delivered by the same Trojan. This Trojan causes the infected computer system to display a fake alert from Microsoft Security Essentials. This fake alert will usually say that a Trojan has been discovered on the computer system and that the computer user should download Windows Activity Inspector (or any other program in this group of rogue programs) to remove the Trojan. If the computer user mistakes this fake Microsoft Security Essentials alert for the real thing and downloads Windows Activity Inspector, this rogue security program will immediately proceed to take over the infected computer system.

How Windows Activity Inspector Disrupts Your Computer System’s Operation

Windows Activity Inspector makes several harmful changes to your computer. These are meant to cause panic and to make the removal of Windows Activity Inspector as difficult as possible. Some typical effects of Windows Activity Inspector include the following:

  • Constant pop-up notifications and fake security alerts.
  • System instability and decreased performance.
  • Files that are suddenly blocked or hidden.
  • Changes to Internet browser settings or blocked access to the Internet.

Removing Windows Activity Inspector

Windows Activity Inspector doesn't make it easy for computer users to remove Windows Activity Inspector. However, you can bypass most of Windows Activity Inspector's self-preservation measures by starting up Windows in Safe Mode. To start up in Safe Mode, all you need to do is press the F8 key when starting up. Then choose "Safe Mode" from the list of available options. Once you have gained access to your files, it is simply a matter of starting up your anti-malware utility to remove Windows Activity Inspector and Windows Activity Inspector's associated Trojans.

File System Details

Windows Activity Inspector may create the following file(s):
# File Name Detections
1. %UserProfile%\Application Data\Microsoft\.exe

Registry Details

Windows Activity Inspector may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe "Debugger" = 'svchost.exe'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon | Shell = "%AppData%\Microsoft\{RANDOM CHARACTERS}.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore "DisableSR " = '1'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = '0'

Trending

Most Viewed

Loading...