Windows Work Checker

Windows Work Checker Image

Windows Work Checker is a new addition to a group of rogue anti-spyware applications that initially pretend to be Microsoft Security Essentials upgrades. This kind of spyware application preys on inexperienced individuals, scaring them into thinking that their computer is infected by some kind of virus or Trojan. This is why this kind of harmful program is also known as scareware. The program becomes an annoyance, locking up the system and changing preferences, icons, and browser settings. Often these kinds of programs make the computer more vulnerable to other malware infections. The main aim of these kinds of rogue anti-spyware programs is to make the scared user enter his credit card information, to try and rid the computer system of the supposed infection. Unfortunately, the supposed infection is Windows Work Checker itself.

How Did Windows Work Checker Get in Your System?

Most of the time, programs like Windows Work Checker are downloaded inadvertently by the user. The most common ways to get infected by Windows Work Checker are by visiting suspicious websites that have been infected and downloading an executable file that is disguised as some other kind of file. For example, a supposed video codec from an adult website could really be an executable file (with the extension .exe) that acts as a delivery system for one of many different rogue anti-spyware programs. Be careful of clicking on any pop-up windows; alert messages, banners, or advertisements on suspicious websites; visiting adult websites; or using file sharing services. These are well known as places where it is possible to be infected by Windows Work Checker.

Windows Work Checker Installation and Operation

For the program to be installed, the user will first receive a fake notification from Windows Security Essentials. Windows Work Checker will claim to have found a virus or Trojan, and will suggest for the user to download a specific application to get rid of it. These programs are basically different skins for the same essential rogue anti-spyware application. They change constantly, and there can be several new versions per week of the same infection. Once Windows Work Checker is operating on your system, Windows Work Checker will claim to have found several different infections, often harmless files, infections that are completely made up, or in the worst cases actual infections installed by the same program. Windows Work Checker will prompt the user to enter his credit card information and will refuse to close or be uninstalled.

What Makes Windows Work Checker Dangerous for Your Computer?

A rogue anti-spyware program is not something that should be taken lightly. Some users may simply want to ignore the warnings, skip the program's splash screen, and continue using their computer as normal. There are several reasons why this is a terrible idea. Windows Work Checker uses Trojans to do the following:

- Compromise your security, leaving your computer vulnerable to potential new viruses, Trojans, and other kinds of infections.

- May affect your web browsing, often tracking the sites you visit and your personal information, and sending it to a third party.

- May install new programs on your system, affecting your computer's performance, and gradually making it run slower and less efficiently.

File System Details

Windows Work Checker may create the following file(s):
# File Name Detections
1. %AppData%\Microsoft\[RANDOM CHARACTERS].exe
2. %AppData%\Microsoft\Windows Work Checker.exe

Registry Details

Windows Work Checker may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe "Debugger" = 'svchost.exe'

Trending

Most Viewed

Loading...