Threat Database Rogue Anti-Spyware Program Windows Be-on-Guard Edition

Windows Be-on-Guard Edition

Threat Scorecard

Threat Level: 10 % (Normal)
Infected Computers: 1
First Seen: May 12, 2012
Last Seen: January 13, 2023
OS(es) Affected: Windows

Windows Be-on-Guard Edition Image

Despite its name, Windows Be-on-Guard Edition is not associated with Microsoft and is also not an actual security program. Windows Be-on-Guard Edition belongs to a large family of fake security programs known as Rogue:FakeVimes. Malware programs in the FakeVimes family have infected computers since 2009, carrying out a common online scam that consists in trying to persuade PC users that they must purchase useless fake security programs. While most reliable anti-malware programs can remove Windows Be-on-Guard Edition and other threats in the FakeVimes family without too many problems, bogus security software in this family that have been released in 2012 will often include a rootkit component that is difficult to remove. This rootkit component also makes Windows Be-on-Guard Edition more difficult to remove than normal.

There are dozens of clones of Windows Be-on-Guard Edition that have been released in 2012, including such fake security programs as Virus Melt, Presto TuneUp, Fast Antivirus 2009, Extra Antivirus, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, PC Live Guard, Live PC Care, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus, Smart Security, Windows Protection Suite, Windows Work Catalyst.

How Criminals Try to Steal Your Money Using Windows Be-on-Guard Edition

Criminals use fake security programs like Windows Be-on-Guard Edition in order to try to gain access to your credit card information by convincing you to purchase a useless fake security program. To do this, Windows Be-on-Guard Edition is designed to make you believe that your computer system is the victim of a severe malware attack – other than at the hands of Windows Be-on-Guard Edition and its associated malware, of course. Windows Be-on-Guard Edition displays a fake system scan claiming to have found a large number of virus and Trojan infections. It will also display a constant stream of alarming error messages, some of which appear to come from Windows itself. In addition to these tactics, Windows Be-on-Guard Edition can also cause browser redirects, block access to the victim's files, and negatively affect the infected computer system's performance.

Dealing with a Windows Be-on-Guard Edition Infection

ESG malware analysts strongly recommend that you avoid paying for Windows Be-on-Guard Edition. The proper course of action is to erase Windows Be-on-Guard Edition with a reliable anti-malware application. Because Windows Be-on-Guard Edition is often associated with a rootkit infection, a specialized anti-rootkit tool may be necessary to deal with this threat. You can make Windows Be-on-Guard Edition stop displaying most of its error messages with the registration code 0W000-000B0-00T00-E0020. However, this code will only stop some of Windows Be-on-Guard Edition's symptoms; this fake security program will remain on the infected computer system until Windows Be-on-Guard Edition is removed with a reliable anti-malware program.ScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshot

Windows Be-on-Guard Edition Video

Tip: Turn your sound ON and watch the video in Full Screen mode.

File System Details

Windows Be-on-Guard Edition may create the following file(s):
# File Name Detections
1. %AppData%\Protector-[RANDOM 4 CHARACTERS].exe
2. %AppData%\Protector-[RANDOM 3 CHARACTERS].exe
3. %AppData%\NPSWF32.dll
4. %CommonStartMenu%\Programs\Windows Be-on-Guard Edition.lnk
5. %Desktop%\Windows Be-on-Guard Edition.lnk
6. %AppData%\result.db

Registry Details

Windows Be-on-Guard Edition may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorUser" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "net" = "2012-5-12_7"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\emsw.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\patch.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscache.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorAdmin" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"
HKEY_CURRENT_USER\Software\ASProtect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bisp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak5.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "EnableLUA" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "ypjcmvvgbv"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\init.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rwg.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AluSchedulerSvc.exe

URLs

Windows Be-on-Guard Edition may call the following URLs:

supersearchconverters.com

Messages

The following messages associated with Windows Be-on-Guard Edition were found:

Error
Attempt to modify Registry key entries detected.
Registry entry analysis recommended.
Error
Trojan activity detected. System data security is at risk. It is recommended to activate protection and run a full system scan.
Warning
Firewall has blocked a program from accessing the Internet
C:\program files\internet explorer\iexplore.exe
is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server.
Warning
Firewall has blocked a program from accessing the Internet
C:program filesinternet exploreriexplore.exe
is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server.

Trending

Most Viewed

Loading...