Threat Database Rogue Anti-Spyware Program Windows Telemetry Center

Windows Telemetry Center

Threat Scorecard

Threat Level: 100 % (High)
Infected Computers: 15
First Seen: February 22, 2012
Last Seen: January 8, 2020
OS(es) Affected: Windows

ScreenshotWindows Telemetry Center is one of the many fake security programs in the FakeVimes family of malware. Bogus security applications like Windows Telemetry Center are a type of malware known as a rogue security application. Rogue security applications are part of a scam that involves attempting to prey on inexperienced computer users by convincing them that they need to purchase a useless security tool. Malware in the FakeVimes family uses a clear user interface that is constructed to mimic the appearance of Microsoft Security Essentials very closely. However, any resemblance between Windows Telemetry Center and Microsoft Security Essentials stops there. This is because, beyond its interface, Windows Telemetry Center has no way of fixing malware problems or protecting a computer system from a malware attack (especially because Windows Telemetry Center is a malware infection itself and requires other malware in order to infect a computer system). If Windows Telemetry Center is present on your hard drive, ESG security analysts strongly recommend automatic removal with the aid of a dependable anti-virus program. It is entirely possible to remove Windows Telemetry Center manually, but it is a process that usually requires a basic degree of compute knowledge in order to avoid causing harm to the integrity of your operating system. The fact that Windows Telemetry Center is distributed along with other malware threats also makes Windows Telemetry Center difficult to remove manually, since it is easy to miss one or more components of this multi-component threat.

Understanding the Windows Telemetry Center Scam

Clones of Windows Telemetry Center include Virus Melt, Presto TuneUp, Fast Antivirus 2009, Extra Antivirus, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, PC Live Guard, Live PC Care, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus, Smart Security, Windows Protection Suite, Windows Work Catalyst.

There are dozens of fake security programs in this family of rogue security applications. They typically spread through fake video codecs often bundled along with pirated movies or downloaded from adult video websites in order to view a fake video. Once Windows Telemetry Center has entered the victim's computer, Windows Telemetry Center displays constant error messages that attempt to convince the victim that a severe malware attack has been initiated and that a 'full version' of Windows Telemetry Center is needed in order to thwart the imaginary attackers. You should not pay for this bogus security program and, if you already have, you may communicate with your credit card company to block charges to your credit card since they are part of a scam. Remember, your security software should come from a reliable source and it should be researched thoroughly; supposed security software that appears on your computer system without your authorization or as a result of clicking on a pop-up window will typically be a rogue security program.ScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshot

SpyHunter Detects & Remove Windows Telemetry Center

Windows Telemetry Center Video

Tip: Turn your sound ON and watch the video in Full Screen mode.

File System Details

Windows Telemetry Center may create the following file(s):
# File Name MD5 Detections
1. Protector-guq.exe c9613998ed8847b4f562a437d8716c5c 1
2. %AppData%\Inspector-[3 RANDOM CHARACTERS].exe
3. %AppData%\npswf32.dll
4. %DesktopDir%\Windows Telemetry Center.lnk
5. %StartMenu%\Programs\Windows Telemetry Center.lnk
6. %AppData%\result.db

Registry Details

Windows Telemetry Center may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "rudbxijemb"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ERROR_PAGE_BYPASS_ZONE_CHECK_FOR_HTTPS_KB954312
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapsetup3001.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashDisp.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "net" = "2012-2-17_2"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tapinstall.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpcc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mostat.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "ID" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\platin.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\divx.exe

Messages

The following messages associated with Windows Telemetry Center were found:

Error
Keylogger activity detected. System information security is at risk.
It is recommended to activate protection and run a full system scan.
Error
Potential malware detected.
It is recommended to activate protection and perform a thorough system scan to remove the malware.
Error
Software without a digital signature detected.
Your system files are at risk. We strongly advise you to activate your protection.
Warning
Firewall has blocked a program from accessing the Internet.
Windows Media Player Resources
C:\Windows\system32\dllcache\wmploc.dll
C:\Windows\system32\dllcache\wmploc.dll is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server.
Warning! Virus Detected
Threat detected: FTP Server
Infected file: C:\Windows\System32\dllcache\wmploc.dll

Trending

Most Viewed

Loading...