Windows Instant Scanner

Posted: June 12, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	9

First Seen:	June 12, 2012
Last Seen:	January 8, 2020
OS(es) Affected:	Windows

Windows Instant Scanner is one of the newest expansions to the Win32/FakeVimes classification of scamware. Like the other rogue anti-malware scanners that Windows Instant Scanner is copied from, Windows Instant Scanner pretends to be able to detect a range of attacks against your PC, including malicious software like rootkits, spyware and Trojans, but Windows Instant Scanner's threat detection and elimination features are wholly fraudulent. SpywareRemove.com malware researchers recommend that you eject Windows Instant Scanner with a genuine anti-malware product, both because of Windows Instant Scanner's inability to perform positive functions and its likelihood of attacking your computer with browser hijacks and application blockades. Since Windows Instant Scanner may block programs that could be used for its removal, it's likewise encouraged for you to use common PC security techniques to shut Windows Instant Scanner down before you even attempt to scan your hard drive for Windows Instant Scanner's components.

Windows Instant Scanner: an Instant Load of Computer Problems

Windows Instant Scanner's predominant symptoms include the same types of fake warning messages and system scans that the rest of its family has achieved notoriety through using. Fake security pop-ups from Windows Instant Scanner can include alerts about specific types of hostile software, attacks against Windows components (like the Registry) or even apparent attempts at identity theft. SpywareRemove.com malware experts encourage ignoring all of the above, given that Windows Instant Scanner isn't designed to have any sort of actual PC threat-defending features that would benefit your computer. Such fake warnings are also common when victims attempt to launch programs that are blocked or damaged by Windows Instant Scanner – such as many types of security, anti-malware and OS diagnostic utilities.

Windows Instant Scanner may also attempt to redirect your web browser to unusual sites, particularly during any search engine usage. Sites that are promoted by Windows Instant Scanner should be avoided as a matter of course, since FakeVimes-based scamware like Windows Instant Scanner have been confirmed to promote web pages that contain hostile content. As a result of this hazard, SpywareRemove.com malware researchers suggest avoiding browser usage until you've disabled Windows Instant Scanner and can remove, at the very least, the components that are responsible for its browser redirects (which are, in most cases, unwarranted Hosts file changes).

The Fix to Windows Instant Scanner That's Faster Than Its 'Security' Features

Windows Instant Scanner's solution to the problems that Windows Instant Scanner causes are to make you spend a fee on its registration, but this is, naturally, not the ideal way to put an end to Windows Instant Scanner's pop-ups and other misbehavior. SpywareRemove.com malware researchers suggest contacting the relevant financial company if you've given Windows Instant Scanner's criminal company any personal data that could be used to attack your bank accounts or credit cards in the future. However, using free codes to register Windows Instant Scanner, such as '0W000-000B0-00T00-E0020,' can be considered safe.

Booting to Safe Mode or booting via a removable media drive can help to deactivate Windows Instant Scanner's startup routine, which is suggested during any attempt at removing Windows Instant Scanner. Any system scans should also be able to detect related PC threats, or you may find Windows Instant Scanner reinstalled – or one of its numerous clones, such as Privacy Guard Pro, PrivacyGuard Pro 2.0, Extra Antivirus, Fast Antivirus 2009, Presto TuneUp, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, Live PC Care, PC Live Guard, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus and Smart Security.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%APPDATA%\Protector-gjrt.exe

File name: Protector-gjrt.exe
Size: 1.93 MB (1938944 bytes)
MD5: ebfe32f3decca9d3f2c78962d48159b7
Detection count: 17
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%
Group: Malware file
Last Updated: January 8, 2020

Protector-[RANDOM CHARACTERS].exe

File name: Protector-[RANDOM CHARACTERS].exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "ID" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "net" = "2012-2-17_2"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "rudbxijemb"HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ERROR_PAGE_BYPASS_ZONE_CHECK_FOR_HTTPS_KB954312HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashDisp.exeHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\divx.exeHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exeHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpcc.exeHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tapinstall.exeHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapsetup3001.exeHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mostat.exeHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\platin.exe