Zentom System Guard

By Domesticus in Rogue Anti-Spyware Program

Threat Scorecard

Threat Level:	100 % (High)
Infected Computers:	53

First Seen:	July 20, 2011
Last Seen:	February 25, 2023
OS(es) Affected:	Windows

Zentom System Guard Image

Zentom System Guard is a clone of the fake anti-spyware program Zentom System Guard Protection. These fake security applications are what are known by computer security experts as "rogueware". Rogue anti-spyware programs like Zentom System Guard are programs designed to resemble legitimate security utilities; however, in reality they use a variety of underhanded tactics to trick computer users into disclosing their credit card information. Regardless of Zentom System Guard's marketing and genuine-looking appearance, Zentom System Guard is not a real anti-spyware application. If you have installed Zentom System Guard on your computer, remove Zentom System Guard immediately with a real anti-spyware program.

Table of Contents

How Zentom System Guard Tries to Trick You

Zentom System Guard uses several approaches to make you believe that your computer is in trouble. Zentom System Guard's actions are typical of most rogue security programs. Typically, a Zentom System Guard infection will follow these steps:

Zentom System Guard is installed on a computer, usually using misleading advertising or is delivered by a Trojan infection.
Zentom System Guard will then display a fake computer scan showing numerous fake infections on the computer. This will be accompanied by numerous fake security alerts and pop-up notifications.
To reinforce the idea that the computer is infected, Zentom System Guard will cause several problems on the infected computer. Some of these include blocked Internet access, failure to launch executable files and legitimate security applications, and severely decreased system performance.
Zentom System Guard will refuse to fix any of the supposed "infections" unless the computer user is willing to enter his credit card information to "upgrade" to a full version of Zentom System Guard.

Of course, since Zentom System Guard is causing problems in the first place, giving Zentom System Guard your credit card information is completely useless and will only leave you vulnerable to identity theft and your money being stolen. You should not be fooled by Zentom System Guard's realistic-looking interface. This program has absolutely no security capabilities; Zentom System Guard is comprised solely of the interface and a collection of Trojans and harmful scripts that cause the computer problems mentioned above.

Removing Zentom System Guard for Good

A properly updated anti-malware application should take care of rogue anti-spyware programs like Zentom System Guard. However, it may be difficult to gain access to your security software, because Zentom System Guard tries to protect itself from removal. Two ways in which Zentom System Guard protects itself are by blocking access to Internet browsers and redirecting browsing to prevent the computer user from getting help online and by blocking legitimate security applications from running. To avoid Zentom System Guard's tactics, it is recommended that you launch Windows in Safe Mode (by pressing F8 during start-up) and then run your anti-malware program as normal.

SpyHunter Detects & Remove Zentom System Guard

Zentom System Guard Video

Tip: Turn your sound ON and watch the video in Full Screen mode.

File System Details

Zentom System Guard may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	hookdll.dll	0aebcc563df1a5a7f8996df00ae16c69	10
Name: hookdll.dll MD5: 0aebcc563df1a5a7f8996df00ae16c69 Size: 16.89 KB (16896 bytes) Detections: 10 Type: Dynamic link library Path: C:\Documents and Settings\<username>\Application Data\F6EDEB5506B2D31CE66D78C4F7EBBB25\hookdll.dll Group: Malware file Last Updated: October 23, 2021
2.	vcc70dep2r.exe	21872480abb724db4b9c2bec68bab7f7	7
Name: vcc70dep2r.exe MD5: 21872480abb724db4b9c2bec68bab7f7 Size: 1.7 MB (1705984 bytes) Detections: 7 Type: Executable File Path: C:\Documents and Settings\<username>\Application Data\F6EDEB5506B2D31CE66D78C4F7EBBB25\vcc70dep2r.exe Group: Malware file Last Updated: October 23, 2021
3.	%APPDATA%\Adobe\plugs\KB2721125.exe
Name: %APPDATA%\Adobe\plugs\KB2721125.exe Type: Executable File Group: Malware file
4.	%AppData%\[RANDOM CHARACTERS]\hookdll.dll
Name: %AppData%\[RANDOM CHARACTERS]\hookdll.dll Type: Dynamic link library Group: Malware file
5.	%APPDATA%\Adobe\plugs\KB2692265.exe
Name: %APPDATA%\Adobe\plugs\KB2692265.exe Type: Executable File Group: Malware file
6.	%AppData%\[RANDOM CHARACTERS]\[RANDOM CHARACTERS].exe
Name: %AppData%\[RANDOM CHARACTERS]\[RANDOM CHARACTERS].exe Type: Executable File Group: Malware file
7.	%APPDATA%\205BA7C8FC5F7E32A2A4797AFBB34F61\hookdll.dll
Name: %APPDATA%\205BA7C8FC5F7E32A2A4797AFBB34F61\hookdll.dll Type: Dynamic link library Group: Malware file
8.	%APPDATA%\205BA7C8FC5F7E32A2A4797AFBB34F61\nv716saver.exe
Name: %APPDATA%\205BA7C8FC5F7E32A2A4797AFBB34F61\nv716saver.exe Type: Executable File Group: Malware file
9.	%TEMP%\2B88A7.dmp
Name: %TEMP%\2B88A7.dmp Group: Malware file
10.	%TEMP%\2AD39F.dmp
Name: %TEMP%\2AD39F.dmp Group: Malware file
11.	%AppData%\[RANDOM CHARACTERS]\
Name: %AppData%\[RANDOM CHARACTERS]\ Group: Malware file
12.	%TEMP%\WER14.tmp
Name: %TEMP%\WER14.tmp Type: Temporary File Group: Malware file
13.	%TEMP%\WER15.tmp.dir00\appcompat.txt
Name: %TEMP%\WER15.tmp.dir00\appcompat.txt Group: Malware file
14.	%USERPROFILE%\Start Menu\Programs\Zentom System Guard\Zentom System Guard.lnk
Name: %USERPROFILE%\Start Menu\Programs\Zentom System Guard\Zentom System Guard.lnk Type: Shortcut Group: Malware file
15.	%USERPROFILE%\Start Menu\Zentom System Guard.lnk
Name: %USERPROFILE%\Start Menu\Zentom System Guard.lnk Type: Shortcut Group: Malware file
16.	%AppData%\[RANDOM CHARACTERS]\enemies-names.txt
Name: %AppData%\[RANDOM CHARACTERS]\enemies-names.txt Group: Malware file
17.	%StartMenu%\Programs\Zentom System Guard\
Name: %StartMenu%\Programs\Zentom System Guard\ Group: Malware file
18.	%UserProfile%\Desktop\Zentom System Guard.lnk
Name: %UserProfile%\Desktop\Zentom System Guard.lnk Type: Shortcut Group: Malware file
19.	%TEMP%\FY11.tmp
Name: %TEMP%\FY11.tmp Type: Temporary File Group: Malware file
20.	%TEMP%\WER13.tmp
Name: %TEMP%\WER13.tmp Type: Temporary File Group: Malware file
21.	%APPDATA%\205BA7C8FC5F7E32A2A4797AFBB34F61\local.ini
Name: %APPDATA%\205BA7C8FC5F7E32A2A4797AFBB34F61\local.ini Group: Malware file
22.	%TEMP%\44d18f1b51a1182dac79e4320ec31538310a8c5f
Name: %TEMP%\44d18f1b51a1182dac79e4320ec31538310a8c5f Group: Malware file
23.	%TEMP%\WER14.tmp.dir00\appcompat.txt
Name: %TEMP%\WER14.tmp.dir00\appcompat.txt Group: Malware file
24.	%TEMP%\WER16.tmp.dir00\appcompat.txt
Name: %TEMP%\WER16.tmp.dir00\appcompat.txt Group: Malware file
25.	%USERPROFILE%\Start Menu\Programs\Zentom System Guard\Uninstall.lnk
Name: %USERPROFILE%\Start Menu\Programs\Zentom System Guard\Uninstall.lnk Type: Shortcut Group: Malware file
26.	%AppData%\[RANDOM CHARACTERS]\local.ini
Name: %AppData%\[RANDOM CHARACTERS]\local.ini Group: Malware file
27.	%StartMenu%\Programs\Startup\Zentom System Guard.lnk
Name: %StartMenu%\Programs\Startup\Zentom System Guard.lnk Type: Shortcut Group: Malware file
28.	%StartMenu%\Programs\Zentom System Guard\Zentom System Guard.lnk
Name: %StartMenu%\Programs\Zentom System Guard\Zentom System Guard.lnk Type: Shortcut Group: Malware file
29.	%TEMP%\WER15.tmp
Name: %TEMP%\WER15.tmp Type: Temporary File Group: Malware file
30.	%TEMP%\2A9473.dmp
Name: %TEMP%\2A9473.dmp Group: Malware file
31.	%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Zentom System Guard.lnk
Name: %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Zentom System Guard.lnk Type: Shortcut Group: Malware file
32.	%TEMP%\2A8F24.dmp
Name: %TEMP%\2A8F24.dmp Group: Malware file
33.	%TEMP%\WER13.tmp.dir00\appcompat.txt
Name: %TEMP%\WER13.tmp.dir00\appcompat.txt Group: Malware file
34.	%TEMP%\2AE6AA.dmp
Name: %TEMP%\2AE6AA.dmp Group: Malware file
35.	%USERPROFILE%\Start Menu\Programs\Startup\Zentom System Guard.lnk
Name: %USERPROFILE%\Start Menu\Programs\Startup\Zentom System Guard.lnk Type: Shortcut Group: Malware file
36.	%AppData%\[RANDOM CHARACTERS]\lsrslt.ini
Name: %AppData%\[RANDOM CHARACTERS]\lsrslt.ini Group: Malware file
37.	%StartMenu%\Zentom System Guard.lnk
Name: %StartMenu%\Zentom System Guard.lnk Type: Shortcut Group: Malware file
38.	%StartMenu%\Programs\Zentom System Guard\Uninstall.lnk
Name: %StartMenu%\Programs\Zentom System Guard\Uninstall.lnk Type: Shortcut Group: Malware file

Registry Details

Zentom System Guard may create the following registry entry or registry entries:

File name without path

Zentom System Guard.lnk

Regexp file mask

%AppData%\????????????????????????????????\newsecureapp70700.exe

HKEY..\..\..\..{RegistryKeys}

HKEY_CURRENT_USER\Software\ZentomSystemGuard

HKEY_CURRENT_USER\Software\ZentomSystemGuard\Zentom System Guard

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS].exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Zentom System Guard

Messages

The following messages associated with Zentom System Guard were found:

Firewall file transfer detected
Hidden file transfer to remote host was detected
Zentom System Guard has detected that somebody is trying to transfer Your private data via internet. We strongly recommend you to block attack immediately.

Network intrusion detected!
Warning! Network attack detected!
Process is trying to steal your passwords listed below. It is highly recommended to block this threat now.
Your computer is being attacked from a remote PC.
Attack from: 145.7.151.43:34630

Protection Center Alert
To help protect your computer, Zentom System Guard has blocked some features of this program
Zentom System Guard has detected unauthorized activity, but unfortunately trial version cannot remove viruses, keyloggers and other treats. Your personal data under serious risk. It is strongly recommended to register Your copy of Zentom System Guard and prevent intrusion for future.
Do You want to block this suspicious software?
Name: Trojan.Win32.Autoit.agg
Alert level: High
Description: It is highly recommended to remove this threat from your PC

Trojan.Spy threat has been detected.
This threat module advertises websites with explicit content. Be advised of such content being possibly illegal. Please click button below to locate and remove this threat now.

Warning!
Infections on your PC can cause:
- Applications won't start
- Unwanted advertising displaying
- Loss of Internet communication
- Lost documents and settings
- Some files can disappear from PC
- You need registered version of Zentom System Guard to remove these infections.
Click "Remove threats" to activate protection and eliminate these security hazards.

Warning! Removed attack detected!
Zentom System Guard has detected that somebody is trying to stole Your private data remotely via Trojan.Win32.Generic!BT.
Transfer for Your private data via internet will start in: 10 seconds
We strongly recommend You to block attack immediately.

Warning! Threat detected!
Threat module detected on your PC!
Zlob.Porn.Ad threat has been detected. This threat module advertises websites with explicit content. Be advised of such content being possibly illegal. Please click button below to locate and remove this threat now.

Zentom System Guard - Hacker attack detected
Your computer is subjected to hacker attack. Zentom System Guard has detected that somebody is trying to transfer Your private data via internet. We strongly recommend you to block attack immediately.

Enigma Software Group Prevails Over Malwarebytes at the Ninth Circuit

Search

Change Region

Zentom System Guard

Threat Scorecard

EnigmaSoft Threat Scorecard

How Zentom System Guard Tries to Trick You

Removing Zentom System Guard for Good

SpyHunter Detects & Remove Zentom System Guard

Zentom System Guard Video

File System Details

Registry Details

Messages

Submit Comment

Trending

Rzfu Ransomware

'YouPorn' Email Scam

Rzkd Ransomware

Most Viewed

Is Lookmovie.io Safe?

How To Fix 'Printer Driver is Unavailable' Error

Discord Shows Black Screen when Sharing Screen