Windows AntiHazard Center

Posted: March 22, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	2/10
Infected PCs:	41

First Seen:	March 22, 2012
OS(es) Affected:	Windows

Windows Antihazard Center is one of the latest variants in the Win32/FakeVimes family of fake anti-virus scanners. Other than its name, Windows Antihazard Center strongly resembles its recent ancestors in terms of creating fake system information, displaying warnings about threats that aren't in evidence and, in general, misrepresenting its capabilities to have a chance at your money and financial information. Both pop-ups and scanner information from Windows Antihazard Center should be completely eschewed as viable sources of security-related advice, since attempting to remove the nonexistent threats that Windows Antihazard Center warns you against may damage your PC. As a preferable alternative, SpywareRemove.com malware researchers suggest that you delete Windows Antihazard Center with a trustworthy brand of anti-malware software, particularly since Windows Antihazard Center may also harm your computer with browser hijacks and application-blocking attacks until Windows Antihazard Center is removed.

The Real Hazard That Windows Antihazard Center Keeps Mum Over

Windows Antihazard Center pretends to be a unique and useful security program with system-scanning features, phishing-prevention functionality and even the ability to monitor your memory processes for contamination. Like all types of scamware, however, Windows Antihazard Center writes a check that's too big to cash and is readily observable to have no real anti-virus or security features whatsoever. SpywareRemove.com malware researchers recommend ignoring any pop-up messages or other types of alerts that Windows Antihazard Center may throw your way, all of which should be easily identified due to their exaggerated and inaccurate diagnostic information.

As a fraudulent AV program, Windows Antihazard Center isn't capable of helping your PC in any way, but that will not slow down Windows Antihazard Center's requests that you purchase its complete version. Buying Windows Antihazard Center is both unnecessary for removing Windows Antihazard Center and needless for stopping other symptoms of a Windows Antihazard Center infection, and SpywareRemove.com malware researchers discourage it on the basis of Windows Antihazard Center handing your financial information over to criminals.

Cleaning Up After a Windows Antihazard Center Infection Clambers into Your Hard Drive

As one of the newer versions of FakeVimes-based scamware, Windows Antihazard Center doesn't feature significant differences from previous types of rogue anti-virus programs from its group, but may require updates to your security software before you can detect and remove Windows Antihazard Center. Under normal conditions, manual removal of Windows Antihazard Center is recommended only as a last resort, since Windows Antihazard Center will alter the Windows Registry and make other efforts at concealing some of its components.

Windows Antihazard Center attacks may also extend to attempts to control your web browser with hijacks or block you from using common types of anti-malware programs (as well as competing rogue security products). If these issues prevent you from using appropriate software to delete Windows Antihazard Center, SpywareRemove.com malware researchers have found Safe Mode and, in more serious circumstances, booting the OS from a remote source (such as a removable drive device) to both be very effective at disabling Windows Antihazard Center. Once disabled, you can easily delete Windows Antihazard Center in a system scan without having to give in to its product purchase demands.

Recent clones of Windows Antihazard Center from the same family include Privacy Guard Pro, PrivacyGuard Pro 2.0, Extra Antivirus, Fast Antivirus 2009, Presto TuneUp, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, Live PC Care, PC Live Guard, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus and Smart Security.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%APPDATA%\Protector-nhfo.exe

File name: Protector-nhfo.exe
Size: 1.82 MB (1824768 bytes)
MD5: fee16c9ff7dce49a02269aada600f44a
Detection count: 92
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%
Group: Malware file
Last Updated: March 23, 2012

%AppData%Protector-.exe

File name: %AppData%Protector-.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

%AppData% esult.db

File name: %AppData% esult.db
Mime Type: unknown/db
Group: Malware file

%AppData%NPSWF32.dll

File name: %AppData%NPSWF32.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file

%CommonStartMenu%ProgramsWindows AntiHazard Center.lnk

File name: %CommonStartMenu%ProgramsWindows AntiHazard Center.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file

%Desktop%Windows AntiHazard Center.lnk

File name: %Desktop%Windows AntiHazard Center.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem "DisableRegedit" = 0HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem "DisableRegistryTools" = 0HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem "DisableTaskMgr" = 0HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciessystem "ConsentPromptBehaviorAdmin" = 0HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciessystem "ConsentPromptBehaviorUser" = 0HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciessystem "EnableLUA" = 0HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun "Inspector"HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionSettings "net" = "2012-3-22_1"HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionSettings "UID" = "okanrqfdwk"HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsatro55en.exeHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsesafe.exeHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsinstall[4].exeHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmssmmc32.exeHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionspcip10117_0.exeHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsscrscan.exeHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsutpost.exeHKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings "WarnOnHTTPSToHTTPRedirect" = 0