Home Malware Programs Rogue Anti-Spyware Programs Windows Verifying Center

Windows Verifying Center

Posted: June 11, 2011

Windows Verifying Center is a fake security program that's closely related to other fake security application threats like Windows Anticrashes Utility and Windows Averting System. Although Windows Verifying Center uses the Windows icon and a user-friendly security interface to make you believe that it helps monitor your PC's security, Windows Verifying Center only creates falsified threat alerts and other inaccurate data. Windows Verifying Center may also hijack your web browser or prevent you from using other programs and could be typically installed by Trojans like Fake Microsoft Security Essentials Alert.

How Windows Verifying Center Gets to Your Computer Without Your Permission

You might download Windows Verifying Center from a malicious website that promotes it as a useful security program, but more often than not, your computer will become infected with Windows Verifying Center after being attacked by a Fake Microsoft Security Essentials Alert Trojan. This Trojan uses errors that imitate a Microsoft Security Essentials Alert popup, as you can see from the sample below:

Microsoft Security Essentials Alert
Potential Threat Details
Microsoft Security Essentials detected potential threats that might compromise your private or damage your computer. Your access to these items may be suspended until you take an action. Click 'show details' to learn more.

In addition to Windows Verifying Center, Fake Microsoft Security Essentials Alert Trojans can also install similar rogue threats like Windows Averting System, Windows Necessary Firewall, Windows Anticrashes Utility and Windows Examination Utility, among many other possibilities.

After Windows Verifying Center is installed, it will begin detecting threats that aren't really on your PC, as well as using fake security scores and system scans to keep up the illusion of multiple and unrelated attackers. Some of Windows Verifying Center's standard errors include:

System Security Warning
Attempt to modify register key entries is detected. Register entries analysis is recommended.

Warning! Database update failed!
Database update failed!
Outdated viruses databases are not effective and can't [sic] guarantee adequate protection and security for your PC!
Click here to get the full version of the product and update the database!

System component corrupted!
System reboot error has occurred due to lsass.exe system process failure.
This may be caused by severe malware infections.
Automatic restore of lsass.exe backup copy completed.
The correct system performance can not be resumed without eliminating the cause of lsass.exe corruption.

Warning! Running trial version!
The security of your computer has been compromised!
Now running trial version of the software!
Click here to purchase the full version of the software and get full protection for your PC!

Warning!
Location: [application file path]
Viruses: Backdoor.Win32.Rbot

Warning!
Name: [application file name]
Name: [application file path]
Application that seems to be a key-logger is detected. System information security is at risk. It is recommended to enable the security mode and run total System scanning.

Windows Verifying Center will request that you purchase the 'full' version of Windows Verifying Center to combat these threats, but Windows Verifying Center has no real threat-removal features and should never be purchased. If you've already purchased Windows Verifying Center before realizing that it's a rogue program, you should speak to your credit card company and have the card revoked for a new and non-compromised one.

The Real Functions That Make Windows Verifying Center a Challenge to Remove

Even though Windows Verifying Center can't do anything that it says it can do, Windows Verifying Center does have some functional features that will prevent you from using security-related software or websites:

  • Windows Verifying Center can block programs, often with an accompaniment of fake warnings that inform you that the program is infected.
  • Windows Verifying Center may not block your web browser only to hijack it for malicious purposes. Windows Verifying Center can control your homepage settings, the websites you visit and even insert advertisements, fake errors or links into online content. Many Windows Verifying Center hijacks may redirect you towards its own website, which can cause more infections via drive-by download script exploits.

To get rid of Windows Verifying Center with no other problems, it's recommended that you use a good anti-malware software product, as opposed to deleting Windows Verifying Center's files without help. Windows Verifying Center makes alterations to the Registry and other sophisticated changes that can harm your computer if you remove them improperly.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %UserProfile%\Application Data\Microsoft\[RANDOM CHARACTERS].exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = '0'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore "DisableSR " = '1'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = '0'

Additional Information on Windows Verifying Center

  • The following messages's were detected:
    # Message
    1 Warning!
    Location: [application file path]
    Viruses: Backdoor.Win32.Rbot
    2 Warning!
    Name: [application file name]
    Name: [application file path]
    Application that seems to be a key-logger is detected. System information security is at risk. It is recommended to enable the security mode and run total System scanning.
    3 Warning! Running trial version!
    The security of your computer has been compromised!
    Now running trial version of the software!
    Click here to purchase the full version of the software and get full protection for your PC!
    4 Warning! Database update failed!
    Database update failed!
    Outdated viruses databases are not effective and can't [sic] guarantee adequate protection and security for your PC!
    Click here to get the full version of the product and update the database!
    5 System component corrupted!
    System reboot error has occurred due to lsass.exe system process failure.
    This may be caused by severe malware infections.
    Automatic restore of lsass.exe backup copy completed.
    The correct system performance can not be resumed without eliminating the cause of lsass.exe corruption.
    6 System Security Warning
    Attempt to modify register key entries is detected. Register entries analysis is recommended.
Loading...