Threat Database Rogue Anti-Spyware Program Windows Proprietary Advisor

Windows Proprietary Advisor

Windows Proprietary Advisor Image

Since early 2012, ESG security analysts have observed a resurgence in malware infections related to the FakeVimes family of malware. This is probably due to the fact that criminals have started to bundle malware in the FakeVimes family with dangerous rootkits in the Sirefef family. Working together, these fake security programs are considerably more difficult to remove than rogue security programs belonging to previous versions of the FakeVimes family of malware. Windows Proprietary Advisor is one of the many bogus security tools released in 2012. Like its predecessors, Windows Proprietary Advisor will try to trick its victims that their machine is severely infected with malware in order to fool them into purchasing fake security applications.

The FakeVimes family of malware has been around since July of 2009 (at the very least), so there are dozens – if not hundreds – of clones of Windows Proprietary Advisor. They all tend to follow similar naming conventions and have evolved little since the first manifestation of this family of malware. However, the criminals behind the FakeVimes family of malware have evolved the social engineering tactics used to deliver these fake security programs, as well as bundling other malicious applications along with the rogue security program infection. This means that, over the years, FakeVimes-related infections have become increasingly more difficult to remove. Today, removing Windows Proprietary Advisor or any of its clones will usually require the use of a specialized anti-rootkit application in order to remove its associated rootkit component. Examples of clones of Windows Proprietary Advisor also released in 2012 include Virus Melt, Presto TuneUp, Fast Antivirus 2009, Extra Antivirus, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, PC Live Guard, Live PC Care, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus, Smart Security, Windows Protection Suite, Windows Work Catalyst.

Dealing with a Windows Proprietary Advisor Infection

Windows Proprietary Advisor will try to convince you that you need to 'upgrade' to a supposed full version by purchasing a registration code. While entering this registration code will stop Windows Proprietary Advisor from causing many annoying symptoms on your computer system, the infection will remain on your computer system, potentially endangering your data. You can 'register' Windows Proprietary Advisor with the code 0W000-000B0-00T00-E0020. However, you should remove Windows Proprietary Advisor entirely with the help of reliable anti-spyware software to ensure that your machine is safe. To prevent future Windows Proprietary Advisor infections, ESG security analysts recommend using a strong anti-malware scanner and being careful when browsing the Internet.ScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshot

Windows Proprietary Advisor Video

Tip: Turn your sound ON and watch the video in Full Screen mode.

File System Details

Windows Proprietary Advisor may create the following file(s):
# File Name Detections
1. %CommonAppData%\58ef5\SP98c.exe
2. %AppData%\Windows Proprietary Advisor\ScanDisk_.exe
3. %Desktop%\Windows Proprietary Advisor.lnk
4. %CommonAppData%\SPUPCZPDET\SPABOIJT.cfg
5. %AppData%\Microsoft\Internet Explorer\Quick Launch\Windows Proprietary Advisor.lnk
6. %StartMenu%\Windows Proprietary Advisor.lnk
7. %AppData%\Windows Proprietary Advisor\Instructions.ini
8. %Programs%\Windows Proprietary Advisor.lnk
9. %CommonAppData%\58ef5\SPT.ico

Registry Details

Windows Proprietary Advisor may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AluSchedulerSvc.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWEBGRD.EXE\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AluSchedulerSvc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\About.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWEBGRD.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\About.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV\"Debugger" = "svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe

Messages

The following messages associated with Windows Proprietary Advisor were found:

Error
Attempt to modify registry key entries detected. Registry entry analysis is recommended.
Error
Keylogger activity detected. System information security is at risk.
It is recommended to activate protection and run a full system scan.
Warning
Firewall has blocked a program from accessing the Internet
C:program filesinternet exploreriexplore.exe
is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server.

Trending

Most Viewed

Loading...