Windows Privacy Module

Threat Scorecard

Threat Level: 100 % (High)
Infected Computers: 5
First Seen: June 7, 2012
Last Seen: January 8, 2020
OS(es) Affected: Windows

Windows Privacy Module Image

Despite the fact that this application resembles a legitimate security program, Windows Privacy Module is one of the many bogus anti-virus applications belonging to the FakeVimes family of rogue security software. Programs like Windows Privacy Module are designed to prey on inexperienced computer users, making them believe that they need to purchase a useless, fake security application. If Windows Privacy Module is installed on your computer system, ESG malware analysts strongly recommend removing Windows Privacy Module from your computer with the help of a reliable anti-malware program.

The Many Clones of Windows Privacy Module

There are dozens of clones of Windows Privacy Module, all belonging to the FakeVimes family of malware. This malware family dates back to 2009 and has been continually updated since then. While Windows Privacy Module itself is not too different from versions of this fake security program dating back to 2010, Windows Privacy Module and other FakeVimes programs that have been released in 2012 will often be bundled with a version of the ZeroAccess rootkit. This makes FakeVimes programs considerably more difficult to remove than previous members of the FakeVimes family of malware. Examples of other FakeVimes malware programs that will often be associated with this rootkit component include Virus Melt, Presto TuneUp, Fast Antivirus 2009, Extra Antivirus, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, PC Live Guard, Live PC Care, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus, Smart Security, Windows Protection Suite, Windows Work Catalyst.

How Windows Privacy Module Tries to Steal Your Money

Fake security programs like Windows Privacy Module will try to persuade you that your machine is under attack. Using a fake scan and a large number of irritating error messages, Windows Privacy Module will claim that your computer is infested with numerous Trojans and viruses. This is meant to alarm you and to convince you to purchase a 'full version' of Windows Privacy Module. Whenever you try to use Windows Privacy Module to remove these supposed threats, you will be invited to enter a registration code in order to 'upgrade' Windows Privacy Module. However, Windows Privacy Module has no actual anti-virus components; Windows Privacy Module is merely designed to scare you making you be convinced that your PC is infected so you will hand over your money. ESG malware researchers have observed that the registration code 0W000-000B0-00T00-E0020 can help stop Windows Privacy Module's symptoms. Despite the fact that 'registering' Windows Privacy Module will not remove Windows Privacy Module from your computer, this can help you stop its annoying error messages and browser redirects. However, it will still be necessary to remove Windows Privacy Module with a dedicated anti-malware program containing anti-rootkit capabilities.

SpyHunter Detects & Remove Windows Privacy Module

Windows Privacy Module Video

Tip: Turn your sound ON and watch the video in Full Screen mode.

File System Details

Windows Privacy Module may create the following file(s):
# File Name MD5 Detections
1. Protector-pygh.exe 75f02b51c71cdff760722f207b41fe01 1
2. Protector-nbxm.exe a1dd16154109a07bcd6e780080f024df 1
3. Protector-sdfq.exe 34355a42cf71a37943f8bede767b322a 1
4. %CommonAppData%\58ef5\SP98c.exe
5. %AppData%\Windows Privacy Module\ScanDisk_.exe
6. %AppData%\Protector-[RANDOM CHARACTERS].exe
7. %Desktop%\Windows Privacy Module.lnk
8. %CommonAppData%\SPUPCZPDET\SPABOIJT.cfg
9. %AppData%\Microsoft\Internet Explorer\Quick Launch\Windows Privacy Module.lnk
10. %Programs%\Windows Privacy Module.lnk
11. %AppData%\Windows Privacy Module\Instructions.ini
12. %StartMenu%\Windows Privacy Module.lnk
13. %CommonAppData%\58ef5\SPT.ico

Registry Details

Windows Privacy Module may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\About.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agent.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alogserv.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aAvgApi.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\advxdwin.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alevir.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alertsvc.exe\"Debugger" = "svchost.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Inspector = %AppData%\Protector-[RANDOM CHARACTERS].exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentsvr.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV.exe\Debugger = svchost.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentw.exe\"Debugger" = "svchost.exe"

Trending

Most Viewed

Loading...