Threat Database Rogue Anti-Spyware Program Windows Advanced Security Center

Windows Advanced Security Center

Despite its name, Windows Advanced Security Center is not associated with Microsoft Security Center nor does Windows Advanced Security Center provide legitimate security for your PC. Rather, Windows Advanced Security Center is a kind of malware infection known as a rogue security program. These kinds of malware infections will try to convince inexperienced computer users that they need to purchase a 'full version' of Windows Advanced Security Center in order to fix nonexistent problems on their computer system. This scam is among the most common types of malware scams.

There are countless different versions of the Windows Advanced Security Center scam. While some are simple fake security programs that limit themselves to pretending to be real anti-virus programs and displaying some fake error messages, some pose a severe danger to a computer system due to their intrusive practices. Unfortunately, Windows Advanced Security Center is part of this second category of malware infection. Windows Advanced Security Center will rarely attack alone and will often be associated with various Trojan and rootkit components that can wreak havoc on a computer. Because of this, apart from fake error messages a Windows Advanced Security Center infection will also be accompanied with browser redirects, system crashes, decreases system performance and the presence of other malware on the infected computer system.

Windows Advanced Security Center’s Many Clones

Windows Advanced Security Center is part of a large family of malware known as Rogue:FakeVimes. Fake security programs in the FakeVimes family have been around since 2009. There are dozens of clones of Windows Advanced Security Center, for example programs like Virus Melt, Presto TuneUp, Fast Antivirus 2009, Extra Antivirus, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, PC Live Guard, Live PC Care, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus, Smart Security, Windows Protection Suite, Windows Work Catalyst.

The FakeVimes family of malware is a well-known threat that can be removed with most security programs. However, malware in this family released after January of 2012 (including Windows Advanced Security Center) has been associated with a rootkit component that is significantly more difficult to remove than other kinds of malware. Often, removing this rootkit component requires a specialized anti-rootkit application.

The code 0W000-000B0-00T00-E0020 has proven useful in 'registering' malware in the FakeVimes family. While this will not remove Windows Advanced Security Center, it will stop many of its irritating error messages and facilitate removing this malware infection with a reliable anti-malware program. ESG security researchers strongly advise against purchasing Windows Advanced Security Center's fake "full version'; this will do nothing to remove Windows Advanced Security Center and will place your credit card information in the hands of unscrupulous criminals.

File System Details

Windows Advanced Security Center may create the following file(s):
# File Name Detections
1. %AppData%\Protector-{RANDOM 4 CHARACTERS}.exe
2. %AppData%\Protector-{RANDOM 3 CHARACTERS}.exe
3. %AppData%\NPSWF32.dll
4. %StartMenu%\Windows Advanced Security Center.lnk

Registry Details

Windows Advanced Security Center may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "net" = 2012-2-20_1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "ID" = 4
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{RANDOM CHARACTERS}.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0

Trending

Most Viewed

Loading...