Threat Database Rogue Anti-Spyware Program Windows Stability Maximizer

Windows Stability Maximizer

Threat Scorecard

Ranking: 6,112
Threat Level: 20 % (Normal)
Infected Computers: 2,050
First Seen: April 9, 2012
Last Seen: August 31, 2023
OS(es) Affected: Windows

Windows Stability Maximizer Image

It is easy to be fooled by Windows Stability Maximizer's interface and appearance. Criminals have designed Windows Stability Maximizer to mimic the Microsoft Security Center, a legitimate anti-malware tool. However, once you take a look under the hood it is obvious that Windows Stability Maximizer has no actual anti-malware capabilities. In fact, ESG malware analysts warn that Windows Stability Maximizer is designed to do nothing more than display numerous misleading security alerts, provide an interface that is nice to look at but ultimately useless and attempt to direct its victims to its website so that they will hand over their money. Windows Stability Maximizer's claims that Windows Stability Maximizer will protect you from malware are laughable considering that Windows Stability Maximizer is a malware infection itself.

According to ESG malware researchers, Windows Stability Maximizer is part of a very large family of rogue security software known as the FakeVimes family. This family of fake security programs has been around since 2009. Windows Stability Maximizer has many clones, and among the most recent of these are included fake security programs with names like Virus Melt, Presto TuneUp, Fast Antivirus 2009, Extra Antivirus, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, PC Live Guard, Live PC Care, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus, Smart Security, Windows Protection Suite, Windows Work Catalyst. If you find that a suspicious security program has entered your computer system and that it is spamming you with security alerts, it is highly likely that your computer has become infected with malware, especially if the security program in question cannot be removed easily through normal means.

Taking a Closer Look at the Windows Stability Maximizer Scam

The Windows Stability Maximizer scam has proven to be quite effective in fooling inexperienced computer users into giving up their money. It basically consists in making computer users believe that their computer is under a malware attack (that is, from malware apart from Windows Stability Maximizer itself). To do this, Windows Stability Maximizer is designed to display fake error messages and misleading system alerts. It can also affect an infected computer system's performance by making it slow, unstable or affecting its files and desktop.

The goal of this campaign of harassment is to convince the victim to buy a 'full version' of Windows Stability Maximizer in order to fix these supposed problems on the infected computer system. However, there is no difference between Windows Stability Maximizer's supposed full version and a normal Windows Stability Maximizer infection. Once the victim has paid for this useless program, the infected computer will likely remain the same until a real anti-malware program is used to remove Windows Stability Maximizer.

Windows Stability Maximizer Video

Tip: Turn your sound ON and watch the video in Full Screen mode.

File System Details

Windows Stability Maximizer may create the following file(s):
# File Name Detections
1. %AppData%\Protector-.exe
2. %AppData%\NPSWF32.dll
3. %Desktop%\Windows Stability Maximizer.lnk
4. %CommonStartMenu%\Programs\Windows Stability Maximizer.lnk
5. %AppData%\result.db

Registry Details

Windows Stability Maximizer may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorUser" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "net" = "2012-4-8_2"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clean.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portdetective.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorAdmin" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswRegSvr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netmon.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winservn.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "EnableLUA" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "vyyralfxdd"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iedriver.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smrtdefp.exe

URLs

Windows Stability Maximizer may call the following URLs:

galaxyact.ru

Messages

The following messages associated with Windows Stability Maximizer were found:

Error
Trojan activity detected. System data security is at risk.
It is recommended to activate protection and run a full system scan.
Warning
Firewall has blocked a program from accessing the Internet
C:\program files\internet explorer\iexplore.exe
is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server.
Warning! Identity theft attempt Detected
Hidden connection IP: 58.82.12.124
Target: Your passwords for sites

Trending

Most Viewed

Loading...