Threat Database Rogue Anti-Spyware Program Windows Ultimate Booster

Windows Ultimate Booster

Threat Scorecard

Threat Level: 100 % (High)
Infected Computers: 5
First Seen: January 28, 2014
Last Seen: June 26, 2018
OS(es) Affected: Windows

Windows Ultimate Booster is a rogue security program from the infamous FakeVimes family of threats. Windows Ultimate Booster presents a threat to computers and is used to steal money from inexperienced computer users. Windows Ultimate Booster carries out a well known tactic that involves making computer users believe that their computer is severely infected with threats and that to remove it the user must be helped by Windows Ultimate Booster. If Windows Ultimate Booster is installed on your computer, malware researchers strongly advise removing Windows Ultimate Booster immediately with the help of a real security program. Since Windows Ultimate Booster is not a real security program or system optimization application, computer users should refrain from following its instructions or attempting to use Windows Ultimate Booster in any way.

Why Windows Ultimate Booster Enters a Computer

Windows Ultimate Booster is used to steal money from computer users by scamming them using a well known procedure. Rogue security programs like Windows Ultimate Booster have been trying to fool computer users for more than a decade and, over time, have become increasingly sophisticated. Among the many Windows Ultimate Booster clones are Virus Melt, Presto TuneUp, Fast Antivirus 2009, Extra Antivirus, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, PC Live Guard, Live PC Care, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus, Smart Security, Windows Protection Suite, Windows Work Catalyst. However, the basic strategy has not changed much since the first variants of rogue security applications. Threats like Windows Ultimate Booster may take the following steps when trying to infect a computer and steal a computer user's money:

  1. Windows Ultimate Booster is installed automatically, often by bundling Windows Ultimate Booster with other software or using threat delivery methods.
  2. Once Windows Ultimate Booster is installed, Windows Ultimate Booster makes harmful changes to the affected computer's settings, taking over the infected computer in order to carry out its scam.
  3. Windows Ultimate Booster bombards computer users with constant bogus error messages and fake threat scans, claiming that the victim's computer is severely infected with viruses and Trojans.
  4. Trying to use Windows Ultimate Booster to fix these supposed threats results in supplementary error messages asserting that it is necessary to buy an expensive 'full version' of Windows Ultimate Booster to remove these imaginary problems. However, since Windows Ultimate Booster is a threat itself, malware analysts strongly advise against paying for Windows Ultimate Booster or allowing this fake security program to remain on the affected computer.

SpyHunter Detects & Remove Windows Ultimate Booster

File System Details

Windows Ultimate Booster may create the following file(s):
# File Name MD5 Detections
1. svc-mamk.exe 66ee52202658adec75f352c4a57e4be0 2
2. %AppData%\svc-[RANDOM CHARACTERS].exe
3. %AppData%\data.sec

Registry Details

Windows Ultimate Booster may create the following registry entry or registry entries:
File name without path
Windows Ultimate Booster.lnk
".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;"
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" = "%AppData%\svc-.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "EnableLUA" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "GuardSoftware" = %AppData%\svc-.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorUser" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\k9filter.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bckd "ImagePath" = "123123.sys"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" =
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = 1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorAdmin" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "EnableVirtualization" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bckd

Messages

The following messages associated with Windows Ultimate Booster were found:

Error
System data security is at risk!
To prevent potential PC errors, run a full system scan.
Error
Trojan activity detected. System integrity at risk.
Full system scan is highly recommended.
Firewall has blocked a program from accessing the Internet
C:Program FilesInternet Exploreriexplore.exe
is suspected to have infected your PC.
This type of virus intercepts entered data and transmits them
to a remote server.
Warning! Identity theft attempt detected
Hidden connection IP: xx.xxx.xxx.xxx
Target: Microsoft Corporation keys
Your IP: 127.0.0.1

Trending

Most Viewed

Loading...