Home Malware Programs Rogue Anti-Spyware Programs Windows Malware Sleuth

Windows Malware Sleuth

Posted: March 4, 2012

Threat Metric

Threat Level: 2/10
Infected PCs: 15
First Seen: March 4, 2012
OS(es) Affected: Windows

Windows Malware Sleuth Screenshot 1Windows Malware Sleuth is a fresh addition to a family of fake anti-virus scanners that are known for showing inaccurate threat alerts, blocking critical Windows applications and attacking your web browser. Like its brethren, Windows Malware Sleuth has no ability to follow through on its claims to protect your computer from viruses, phishing attacks and other PC threats, and SpywareRemove.com malware researchers recommended that you remove Windows Malware Sleuth as soon as it's possible to alleviate the symptoms noted above. In its attempt to come across as a real anti-malware product, Windows Malware Sleuth may provide its own removal utility, but Windows Malware Sleuth should always be deleted by appropriate anti-malware software that can insure that all of its components and related threats (such as Trojan droppers) are also removed.

Sorting Through the Evidence of Windows Malware Sleuth's Numerous Crimes

Windows Malware Sleuth's aesthetics are built off of a Windows Security Center-based template that's rotated throughout the FakeVimes family of scamware, each member of which bears a different name but the same goal in mind – to annoy and frighten you until you buy a full version of the software in question. While Windows Malware Sleuth and other fake anti-virus scanners from the Rogue.FakeVimes group are able to create very convincing warning messages and alerts that can be displayed in various ways (such as within your web browser or as a taskbar notification), SpywareRemove.com malware researchers emphasize that Windows Malware Sleuth isn't able to provide any system information that isn't fraudulent.
As is typical for fake anti-virus scanners of its ilk, Windows Malware Sleuth also subscribes to a philosophy of refusing to be uninstalled or even disabled. On Windows-based computers, Windows Malware Sleuth will launch itself automatically and conduct its fake alerts, system scans and other attacks without your consent. SpywareRemove.com malware analysts note that Safe Mode, also commonly available on most Windows PCs, is one of the easiest ways to disable Windows Malware Sleuth so that you can scan your PC and remove Windows Malware Sleuth without further problems. Similar tactics are also effective against clones of Windows Malware Sleuth, such as Privacy Guard Pro, PrivacyGuard Pro 2.0, Extra Antivirus, Fast Antivirus 2009, Presto TuneUp, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, Live PC Care, PC Live Guard, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus and Smart Security.

The Final Windows Malware Sleuth Attacks That Seal the Deal

While poor threat detection is worth labeling Windows Malware Sleuth a nuisance, SpywareRemove.com malware research team recommends that you treat Windows Malware Sleuth as an actively malicious threat to your PC, since Windows Malware Sleuth and similar Rogue.FakeVimes-based PC threats are known for additional hostilities. Common issues that can persist until Windows Malware Sleuth is deleted by appropriate anti-malware products include such problems as:

  • Browser-based redirect attacks. Redirects may be used to display fake warning messages, control your search results, take you to Windows Malware Sleuth's website or block PC security sites.
  • Blocked applications. In most cases, Windows Malware Sleuth will block programs by displaying an inaccurate warning message, but with regards to the Task Manager and Registry Editor, Windows Malware Sleuth actually will replace them with its own Advanced Process Control window.


Windows Malware Sleuth Screenshot 2Windows Malware Sleuth Screenshot 3Windows Malware Sleuth Screenshot 4Windows Malware Sleuth Screenshot 5Windows Malware Sleuth Screenshot 6Windows Malware Sleuth Screenshot 7Windows Malware Sleuth Screenshot 8Windows Malware Sleuth Screenshot 9Windows Malware Sleuth Screenshot 10Windows Malware Sleuth Screenshot 11Windows Malware Sleuth Screenshot 12Windows Malware Sleuth Screenshot 13Windows Malware Sleuth Screenshot 14

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%AppData%\NPSWF32.dll File name: %AppData%\NPSWF32.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%AppData%\result.db File name: %AppData%\result.db
Mime Type: unknown/db
Group: Malware file
%AppData%\Protector-[RANDOM 3 CHARACTERS].exe File name: %AppData%\Protector-[RANDOM 3 CHARACTERS].exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%CommonStartMenu%\Programs\Windows Malware Sleuth.lnk File name: %CommonStartMenu%\Programs\Windows Malware Sleuth.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file
%Desktop%\Windows Malware Sleuth.lnk File name: %Desktop%\Windows Malware Sleuth.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "net" = 2012-3-4_1HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "wbukxhryfk"HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoupdate.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpdos32.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirus.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hbinst.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jdbgmrg.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brasil.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csc.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qh.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchostc.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbust.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win32us.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\exe.avxw.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nav.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nupgrade.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsrte.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsTray.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityFighter.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ERROR_PAGE_BYPASS_ZONE_CHECK_FOR_HTTPS_KB954312HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"

Additional Information

The following messages's were detected:
# Message
1Error
Keylogger activity detected. System information security is at risk.
It is recommended to activate protection and run a full system scan.
2Warning! Virus Detected
Threat detected: FTP Server
Infected file: C:\Windows\System32\dllcache\wmpshell.dll
3Warning
Firewall has blocked a program from accessing the Internet
C:\program files\internet explorer\iexplore.exe
is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server.

Related Posts

2 Comments

  • casey benson says:

    This is not my computer I am useing to cantact you. My computer will not stay online long enough to down load your anti spy ware program. Windows sleuth is killing me, I have to do all my stuff at work. Not good if I am cought by my boss. Can you help me.

  • casey benson says:

    I can not get online because of windows sleuth ink. What can I do I can not keep useing the work computer.

Loading...