Threat Database Rogue Anti-Spyware Program Windows Examination Utility

Windows Examination Utility

By SpideyMan in Rogue Anti-Spyware Program

Windows Examination Utility Image

Windows Examination Utility is a rogue anti-spyware program. Windows Examination Utility is designed to pester computer users with messages claiming that their machine is infected with viruses. The constant threats, pop-up windows, and messages are enough to make many inexperienced users enter their credit card information into the program to cure the imaginary infections. Giving Windows Examination Utility a credit card payment in exchange for a virus solution is completely useless and puts the credit card owner's identity at risk. If you have already entered your credit card information, you need to inform you credit card company immediately to dispute the charges. This kind of malicious program, also known as scareware, takes over the user's computer and then blackmail's the user into paying to regain control.

How Did Windows Examination Utility Get Into Your System?

Windows Examination Utility usually downloads and installs itself automatically through a Trojan. A Trojan is a kind of malicious computer program that takes advantage of weaknesses in your security, to deliver harmful software into your system. The most common way of getting infected with Windows Examination Utility's Trojan is by clicking on pop-up windows or fake downloads in high-risk websites. These Trojans may also be hidden as fake video codecs at adult video sites, or bundled with popular downloads in file-sharing networks.

So What Makes Windows Examination Utility a Fake Anti-Spyware Program?

There are several characteristics of Windows Examination Utility that make it easily identifiable as a rogue anti-spyware program:

– Windows Examination Utility is installed on your system without authorization.

– A quick search online shows that Windows Examination Utility is listed by most specialized websites as a harmful program. Windows Examination Utility has a bad reputation.

– The Windows Examination Utility official website and payment site are low in quality and look suspicious.

How to Get Rid of Windows Examination Utility

The best idea is to use a real anti-spyware utility to get rid of Windows Examination Utility. However, an advanced user can remove Windows Examination Utility manually. While the most common way of deleting files is using the "Add/Remove Programs" utility in the Control Panel, it is possible that this is not enough. Make sure that you know exactly what you are doing, if you are going to uninstall Windows Examination Utility manually. Apart from stopping the processes and the Windows Examination Utility files, there are some other things that it is important to remember:

– Block access to all websites associated with Windows Examination Utility.

– Delete DLL files and stop all Windows Examination Utility processes.

– Remove all registry keys associated with Windows Examination Utility.

Remember to back up your registry before editing it and deleting any registry keys. It is also important to use a legitimate anti-spyware utility in the future, especially if one routinely works with high-risk sites. Most important of all, you should use common sense when dealing with rogue anti-spyware programs. Be wary of all downloads and clicking on any links from a suspicious source. Don't fall into the trap this kind of software tries to set for you. If you are constantly getting pop-up messages and emergency system scans for a supposed infection, chances are that the supposed anti-spyware program installed is actually the thing infecting your computer.ScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshot

SpyHunter Detects & Remove Windows Examination Utility

File System Details

Windows Examination Utility may create the following file(s):
# File Name MD5 Detections
1. %AppData%\Microsoft\{RANDOM CHARACTERS}.exe
2. tldkjh.exe c7a7862bce4d5493b7fe55685498d1c6 0

Registry Details

Windows Examination Utility may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon | Shell = “%AppData%\Microsoft\{RANDOM CHARACTERS}.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe | Debugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe | Debugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe

Messages

The following messages associated with Windows Examination Utility were found:

Check your computer security
There are multiple security problems with your
computer.
Check this notification to fix these problems.
Warning
There`s a suspicious fsoftware running on your PC.
For more details, run a system file check.
Warning!
Location: …\mbam.exe
Viruses: Trojan.Win32.Qhost

Trending

Most Viewed

Loading...