Threat Database Rogue Anti-Spyware Program Windows Secure Web Patch

Windows Secure Web Patch

Threat Scorecard

Threat Level: 100 % (High)
Infected Computers: 15
First Seen: June 15, 2012
Last Seen: January 8, 2020
OS(es) Affected: Windows

Windows Secure Web Patch Image

ESG security analysts recommend avoiding the installation of download of Windows Secure Web Patch. This is not a real patch for your operating system. Rather, Windows Secure Web Patch is part of a large family of fake security software that is commonly known as the FakeVimes family of malware. Since 2009, these fake security programs have infected computer systems all around the world. The main purpose of Windows Secure Web Patch and other malware in the FakeVimes family is to carry out a common online scam that seeks to steal inexperienced computer users' money. Because of this, you should protect your computer system with a reliable anti-malware solution and never download Windows updates except directly from Microsoft or Windows Update.

An Overview of Windows Secure Web Patch and Its Many Clones

The FakeVimes family of malware is quite large, including dozens of fake security programs with names such as Virus Melt, Presto TuneUp, Fast Antivirus 2009, Extra Antivirus, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, PC Live Guard, Live PC Care, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus, Smart Security, Windows Protection Suite, Windows Work Catalyst. Most security programs have no problems removing the FakeVimes-related malware itself. The problem is that Windows Secure Web Patch and other rogue anti-virus programs in the FakeVimes family released in 2012 will often be bundled with a dangerous rootkit infection from the ZeroAccess (also known as Sirefef) family of rootkits. This rootkit component provides Windows Secure Web Patch with support and has the ability to disable legitimate security programs or hide the presence of malware on the victim's computer system. ESG security analysts recommend using a strong anti-rootkit utility to help with the removal of a Windows Secure Web Patch infection.

How Windows Secure Web Patch Tries to Steal Your Money

Windows Secure Web Patch and other rogue security programs carry out variations on a common scam. Basically, Windows Secure Web Patch will try to make you believe that your computer system has become infected with viruses, Trojans and other kinds of malware. To do this, Windows Secure Web Patch has the ability to display numerous fake error messages and pop-up notifications from the Task Bar, some appearing to come from Windows itself! Windows Secure Web Patch will also run a fake scan of the victim's computer system and cause other miscellaneous problems, such as browser redirects and causing the infected computer to run slowly and become unstable. If you try to use Windows Secure Web Patch to fix these supposed problems, Windows Secure Web Patch will display error messages and try to convince you to purchase an expensive upgrade for this fake security program. Of course, since Windows Secure Web Patch is actually a malware infection itself, ESG security analysts strongly advise against paying for this fake security tool.

SpyHunter Detects & Remove Windows Secure Web Patch

Windows Secure Web Patch Video

Tip: Turn your sound ON and watch the video in Full Screen mode.

File System Details

Windows Secure Web Patch may create the following file(s):
# File Name MD5 Detections
1. Protector-tkbu.exe 9be34127493f172fe42959ee6520ad6d 1
2. %AppData%\Protector-[RANDOM CHARACTERS].exe

Registry Details

Windows Secure Web Patch may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "rudbxijemb"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashDisp.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpcc.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mostat.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "net" = "2012-2-17_2"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapsetup3001.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ERROR_PAGE_BYPASS_ZONE_CHECK_FOR_HTTPS_KB954312
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "ID" = 0
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\divx.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tapinstall.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\platin.exe

Trending

Most Viewed

Loading...