Windows Expert Console

Threat Scorecard

Threat Level: 100 % (High)
Infected Computers: 1
First Seen: November 25, 2013
OS(es) Affected: Windows

Windows Expert Console Image

Windows Expert Console is a rogue security application. Windows Expert Console belongs to an enormous family or rogue security programs, the FakeVimes family. Threats in Windows Expert Console's family use very similar naming patterns that seem to be generated automatically using a thesaurus, often to the point of not making sense. Regardless of the name of the particular variant of Windows Expert Console infecting a computer, all of these fake security applications carry out the same basic scam. Because of this, Windows Expert Console or its variants should be removed at once from an infected computer.

Windows Expert Console Scam’s Expertise is to Steal Money from Credible PC Users

Rogue security applications like Windows Expert Console have been active for at least nearly a decade, in one way or another. Although their tactics for evading detection and removal have become increasingly advanced, the same basic strategy behind infections like Windows Expert Console remains the same. Typically, programs like Windows Expert Console enter a computer often using typical threat delivery methods such as attack websites and social engineering tactics or through the use of secondary Trojan or rootkit infections designed to download and install threats on the victim's computer. Once Windows Expert Console has been installed, Windows Expert Console effectively takes over the affected computer. Windows Expert Console pretends to be a real security application, claiming that the victim's computer is infected with various Trojans, viruses or worms. When the computer user tries to use Windows Expert Console to remove these bogus threats, Windows Expert Console displays a message claiming that it is necessary to pay for an expensive, fake 'full version' of Windows Expert Console.

Deleting Windows Expert Console for Good

Malware researchers strongly advise computer users to avoid paying for this fake upgrade. Instead, Windows Expert Console should be removed with the help of an actual security program. Starting up the affected computer in Safe Mode can prevent Windows Expert Console from defending itself by interfering with your anti-virus software. Windows Expert Console's clones use names such as Virus Melt, Presto TuneUp, Fast Antivirus 2009, Extra Antivirus, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, PC Live Guard, Live PC Care, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus, Smart Security, Windows Protection Suite, Windows Work Catalyst.Screenshot

SpyHunter Detects & Remove Windows Expert Console

File System Details

Windows Expert Console may create the following file(s):
# File Name MD5 Detections
1. svc-ryrt.exe 0e8e56ab76b42e2527caa10cba692d55 1
2. %AppData%\guard-fvtb.exe
3. %AppData%\results1.db

Registry Details

Windows Expert Console may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe "Debugger"="svchost.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger"="svchost.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "GuardSoftware" = "%AppData%\guard-toiy.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation"=1
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell"="C:\\Users\\User\\AppData\\Roaming\\guard-fvtb.exe""LowRiskFileTypes"=".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations

Messages

The following messages associated with Windows Expert Console were found:

Error
Attempt to run a potentially dangerous script detected.
Full system scan is highly recommended.
Error
System data security is at risk!
To prevent potential PC errors, run a full system scan.
Error
Trojan activity detected. System data security is at risk.
It is recommended to activate protection and run a full system scan.
Firewall has blocked a program from accessing the Internet
c:program filesinternet exploreriexplore.exe
is suspected to have infected your PC.
This type of virus intercepts entered data and transmits them
to a remote server.
Torrent Alert
Recommended: Please use secure encrypted protocol for torrent links.
Torrent link detected!
Receiving this notification means that you have violated:
- the copyright laws. Using Torrent for downloading movies and licensed software shall be prosecuted and you may be sued for cybercrime and break of law under the SOPA legislation.
Warning! Identity theft attempt detected
Hidden connection IP: xx.xxx.xxx.xxx
Target: Microsoft Corporation keys
Your IP: 127.0.0.1

Trending

Most Viewed

Loading...