Microsoft Security Essentials Enhanced Protection Mode

Posted: July 28, 2011

Rather than being the Microsoft product that its name implies, Microsoft Security Essentials Enhanced Protection Mode is a rogue security program that fakes being part of Security Essentials so that Microsoft Security Essentials Enhanced Protection Mode can disable your computer's security. PCs that have a Microsoft Security Essentials Enhanced Protection Mode infection may seem to be fully-protected, but this is a dangerous illusion that's created Microsoft Security Essentials Enhanced Protection Mode while it quietly shuts down all real Microsoft Security Essentials features. Since this may lead to remote attacks by criminals or attempts to install spyware, Trojans, worms or other malicious software, our SpywareRemove.com malware researchers recommend removing Microsoft Security Essentials Enhanced Protection Mode with expediency and an accommodating anti-malware scanner.

Don't Think That Microsoft Won't Disown Microsoft Security Essentials Enhanced Protection Mode

Microsoft Security Essentials Enhanced Protection Mode is another member of a burgeoning family of rogue anti-virus programs that use well-known PC anti-virus brands to hide their infections. Our SpywareRemove.com research team has managed to find quite a few new members of this rapidly-growing group, including Microsoft Defender Enhanced Protection Mode, McAfee Enhanced Protection Mode, Comodo Enhanced Protection Mode, Dr.Web Enhanced Protection Mode, Avira Enhanced Protection Mode and Avast Enhanced Protection Mode.

You can differentiate between Microsoft Security Essentials Enhanced Protection Mode and a normal Microsoft Security Essentials program by keeping an eye out for the following giveaway signs:

The appearance of Microsoft Security Essentials Enhanced Protection Mode on your PC will coincide with the appearance of a new Windows taskbar icon. If you happen to click this icon, an unfamiliar red-hued pop-up will appear and show the following text:
"Attention! [Rogue security program name] operates under enhanced protection mode. This is a temporary measure necessary for immediate response to threat from virus. No action is required from you."

However, there is no real 'enhanced protection mode' in Microsoft Security Essentials, and this pop-up doesn't detect any real virus-related infections on your PC.
Microsoft Security Essentials Enhanced Protection Mode will also attempt to make it appear as though your Security Essentials threat databases are always up-to-date. Microsoft Security Essentials Enhanced Protection Mode does this by changing the 'last updated' statistics to match whatever day and time it was when you last logged in to your computer. Microsoft Security Essentials Enhanced Protection Mode does not, of course, actually bother to update your threat databases.

The Real Functions Behind Microsoft Security Essentials Enhanced Protection Mode's Back

While Microsoft Security Essentials Enhanced Protection Mode is making you think that all is well with false info like the above, Microsoft Security Essentials Enhanced Protection Mode actually will try to disable Microsoft Security Essentials and other security programs. Our SpywareRemove.com malware analysts have found that these actions will leave your computer vulnerable to other attacks, including remote attacks that control your entire PC. Since deleting Microsoft Security Essentials Enhanced Protection Mode should use real security software when possible, you may want to reboot from an external storage device or use Safe Mode to access any software that Microsoft Security Essentials Enhanced Protection Mode has blocked.

Although Microsoft Security Essentials Enhanced Protection Mode isn't related to the last-known family of rogue anti-virus programs that are installed by Fake Microsoft Security Essentials Alert, any Microsoft Security Essentials Enhanced Protection Mode infection is still likely to come along with other infections such as ZlobTrojans. Our SpywareRemove.com malware experts have spotted Microsoft Security Essentials Enhanced Protection Mode being distributed by fake Flash update links, and you should take extra care to acquire your media updates only from legitimate sources.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%Users%\[UserName]\Downloads\OTS.exe

File name: %Users%\[UserName]\Downloads\OTS.exe
File type: Executable File
Mime Type: unknown/exe

%Windows%\sysdriver32.exe

File name: %Windows%\sysdriver32.exe
File type: Executable File
Mime Type: unknown/exe

%Windows%\systemup.exe

File name: %Windows%\systemup.exe
File type: Executable File
Mime Type: unknown/exe

%Windows%\l1rezerv.exe

File name: %Windows%\l1rezerv.exe
File type: Executable File
Mime Type: unknown/exe

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINE\Software\Microsoft Security Essentials Enhanced Protection ModeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Microsoft Security Essentials Enhanced Protection Mode"

Additional Information

The following messages's were detected:

#	Message
1	Microsoft Security Essentials ENHANCED PROTECTION MODE Attention! Microsoft Security Essentials operates under enhanced protection mode. This is temporary measure necessary for immediate response to the threat from virus. No action is required from you.