Windows Pro Safety

Windows Pro Safety Image

Windows Pro Safety belongs to a category of malware programs known as rogue security applications. Rogue security programs like Windows Pro Safety pretend to be legitimate anti-malware programs but have no actual anti-malware capabilities. These kinds of fake security applications are used as part of a pervasive online scam that preys on inexperienced computer users. Basically, criminals make the victims believe that their computer system is severely infested with all kinds of malware. However, trying to use Windows Pro Safety to fix these simply results in a message claiming that the victim needs to 'upgrade' to an also useless 'full version' of Windows Pro Safety. This supposed upgrade is not cheap, usually close to one hundred dollars. ESG security analysts strongly advise against purchasing Windows Pro Safety. Instead, this fake security application should be dealt with using a reliable anti-spyware program.

Windows Pro Safety, Rootkits and the FakeVimes Family of Malware

Windows Pro Safety belongs to a particularly large group of fake security software known as the FakeVimes family of malware. Because these bogus security applications have been active since 2009, most legitimate anti-malware programs are well equipped to deal with them. However, malware in the FakeVimes family released in 2012 will often include an accompanying rootkit infection (often a version of the Sirefef rootkit) that makes them much more difficult to remove than previous versions of FakeVimes malware applications. Some examples of clones of Windows Pro Safety released in 2012 and before include Virus Melt, Presto TuneUp, Fast Antivirus 2009, Extra Antivirus, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, PC Live Guard, Live PC Care, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus, Smart Security, Windows Protection Suite, Windows Work Catalyst. The presence of the rootkit component makes these newer versions of FakeVimes clones much more difficult to remove than their predecessors and will often require the help of a specialized anti-rootkit tool or a strong anti-malware program with anti-rootkit technology.

How You Can Protect Your Computer System from the Windows Pro Safety Scam

The culprit behind most rogue security software infections is usually a Trojan. Trojans associated with Windows Pro Safety will often enter a computer system disguised as a fake video codec, a harmless email attachment, or as a result of an exploit on an attack website. The most common causes for Trojan infections associated with Windows Pro Safety are online advertisements claiming to scan your computer system for malware. They will always claim that your computer is infected and urge you to install Windows Pro Safety. Almost all of these kinds of malicious advertisements will also attempt to exploit known vulnerabilities in order to install Windows Pro Safety in the background while the fake scan is distracting the computer user.ScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshot

Windows Pro Safety Video

Tip: Turn your sound ON and watch the video in Full Screen mode.

File System Details

Windows Pro Safety may create the following file(s):
# File Name Detections
1. %AppData%\Protector-[RANDOM 4 CHARACTERS].exe
2. %AppData%\Protector-[RANDOM 3 CHARACTERS].exe
3. %AppData%\NPSWF32.dll
4. %CommonStartMenu%\Programs\Windows Pro Safety.lnk
5. %Desktop%\Windows Pro Safety.lnk
6. %AppData%\result.db

Registry Details

Windows Pro Safety may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorAdmin" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\belt.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alertsvc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sms.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorUser" = 0
HKEY_CURRENT_USER\Software\ASProtect
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "net" = "2012-5-20_4"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portmonitor.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsgk32.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "EnableLUA" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "rohjjdbsbt"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mrt.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnt.exe

Messages

The following messages associated with Windows Pro Safety were found:

Error
Attempt to modify Registry key entries detected.
Registry entry analysis recommended.
Warning
Firewall has blocked a program from accessing the Internet
C:\program files\internet explorer\iexplore.exe
is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server.
Warning
Firewall has blocked a program from accessing the Internet
C:program filesinternet exploreriexplore.exe
is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server.

Related Posts

Trending

Most Viewed

Loading...