Windows Easy Warden

Threat Scorecard

Ranking: 11,299
Threat Level: 100 % (High)
Infected Computers: 11,926
First Seen: July 12, 2011
Last Seen: July 25, 2023
OS(es) Affected: Windows

Windows Easy Warden Image

vWindows Easy Warden is a fake security program from a large family of rogue anti-spyware applications, the family. Windows Easy Warden mimics a legitimate security utility as part of a scam. The Windows Easy Warden scam consists in convincing the computer user that his/her computer is in danger. Then, Windows Easy Warden will aggressively push the computer user towards buying a "full version" of Windows Easy Warden. Since the real infection on the computer is Windows Easy Warden itself, paying for a "full version" is nothing more than a waste of money. Malware researchers recommend that you automatically remove Windows Easy Warden with a legitimate anti-malware tool.

There Are a Huge Amount of Windows Easy Warden Clones

Windows Easy Warden belongs to a large family of rogue security programs. PC security analysts have found that all of these clones share extremely similar interfaces and affect computer systems in the same way. The only thing that changes from clone to clone is the program's name, which is displayed on the upper left corner of the interface. Even then, most Windows Easy Warden clones are made up of three words, with the first being "Windows" and the other two being security-related words that can go from the utterly nonsensical (e.g. Windows Proofness Guarantor) to the somewhat plausible (e.g. Windows Cleaning Tool). Clones of Windows Easy Warden include

Windows Easy Warden is Delivered by a Trojan

Malware researchers have found that Windows Easy Warden is delivered by the Fake Microsoft Security Essentials Alert Trojan. This Trojan receives its name from the fact that it shows a fake alert from Microsoft Security Essentials. This alert will typically indicate that the Unknown Win32/Trojan is present on the affected computer. It will then prompt the computer user to remove this supposed Trojan infection with Windows Easy Warden. To avoid being infected with the Fake Microsoft Security Essentials Alert Trojan, malware researchers recommend that computer users take extra care while browsing. This includes avoiding high-risk websites, not clicking on unknown links and avoiding downloads from unknown or unreliable sources.

Remove Windows Easy Warden Immediately

PC security specialists have identified Windows Easy Warden as a dangerous rogue. This program can potentially take over an infected computer, rendering it useless for practical use. Malware researchers agree that manual removal is not recommended without advanced computer knowledge. The best way to remove Windows Easy Warden is to use a legitimate anti-malware tool after starting up Windows in Safe Mode.
ScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshot

SpyHunter Detects & Remove Windows Easy Warden

File System Details

Windows Easy Warden may create the following file(s):
# File Name MD5 Detections
1. dthrxuu.exe 498cc2698b39ddd0e232930ff1783465 1
2. %UserProfile%\Application Data\Microsoft\.exe

Registry Details

Windows Easy Warden may create the following registry entry or registry entries:
Regexp file mask
%AppData%\Microsoft\[RANDOM CHARACTERS].exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe "Debugger" = 'svchost.exe'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = '0'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fp-win.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavpers40eng.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcnasvc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore "DisableSR " = '1'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ave32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavlite40eng.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McSACore.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = '0'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\~1.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guarddog.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavpf.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcproxy.exe

Messages

The following messages associated with Windows Easy Warden were found:

Microsoft Security Essentials Alert
Potential Threat Details
Microsoft Security Essentials detected potential threats that might compromise your private or damage your computer. Your access to these items may be suspended until you take an action. Click 'show details' to learn more.
System Security Warning
Attempt to modify register key entries is detected. Register entries analysis is recommended.
Threat prevention solution found
Security system analysis has revealed critical file system vulnerability caused by severe malware attacks.
Risk of system files infection:
The detected vulnerability may result in unauthorized access to private information and hard drive data with a serious possibility of irreversible data loss and unstable PC performance. To remove the malware please run a full system scan. Press 'OK' to install the software necessary to initiate system files check. To complete the installation process please reboot your computer.
Warning!
Location: c:\windows\system32\taskmgr.exe
Viruses: Backdoor.Win32.Rbot

Trending

Most Viewed

Loading...