Memory Scan

21 January 2011 Rogue 0 Comment

Memory Scan is totally fake Windows hard drive tool that commonly spread over the Internet and have evolve in various variants. Just like older released like Memory Optimizer and Smart Scan, this additional member will mimic everything, from the graphical user interface up to the method and process how it can get itself into the victims computer. As expected, Memory Optimizer virus will utilize a Trojan that is capable of sneaking into the system without being detected by installed security application. By using rootkit technology, Trojans can hide themselves and remain invincible under AV radar. Once it has penetrated the PC, Memory Optimizer will be installed without users knowledge. If installation is done, expect that several false alerts will be displayed on the computer and some of them are:

Critical Error
A critical error has occurred while indexing data stored on hard drive. System restart required.

System Restore
The system has been restored after a critical error. Data integrity and hard drive integrity verification required.

These fake alerts are bogus, what it shows does not really exists on the system. In fact, these warning messages will be displayed on different computers as long as they got infected with Memory Scan virus. The purpose is to persuade users into obtaining the paid version of the program. Don’t become a victim of this potentially unwanted application. Remove Memory Scan as soon as a presence was detected. We have provided simple removal procedures on this page.

Screen Shot Image:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista

Added Registry Entries:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random]“
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”

Associated Files and Folders:

%UserProfile%\Desktop\Memory Scan.lnk
%UserProfile%\Start Menu\Programs\Memory Scan\
%UserProfile%\Start Menu\Programs\Memory Scan\Memory Scan.lnk
%UserProfile%\Start Menu\Programs\Memory Scan\Uninstall Memory Scan.lnk
%AllUsersProfile%\~[random]
%AllUsersProfile%\~[random]r
%AllUsersProfile%\[random].dll
%AllUsersProfile%\[random].exe
%AllUsersProfile%\[random]
%AllUsersProfile%\[random].exe

Manual Removal Procedure

1. Press Ctrl+Alt+Del on keyboard to stop the process associated to "Memory Scan". When Windows Task Manager opens, go to Processes tab. Find and end this process.
(random characters).exe

2. You need to update your installed antivirus software. Please connect to the Internet and download the most recent database. This is a one-click process from your AV program’s console.
3. Thoroughly scan the computer and remove any threats found by your antivirus program. If delete option is not available, your best next choice is to quarantine the infected file. There is also a need to manually locate and delete malicious files. Please see the file section for items that are relevant to Memory Scan Virus.

4. Next, you need to remove registry entries created by Memory Scan. Please refer to registry section to view entries related to the rogue program. [how to edit registry]
5. Exit registry editor when you are done.

6. Get rid of Memory Scan start-up entry by going to Start > Run, type msconfig on the "Open" dialog box. It will launch a new window containing System Configuration Utility. Click on the Startup tab and uncheck the following item.
(random characters).exe

7. Click Apply. You need to restart Windows.

Memory Scan Virus Removal Tool

For not so technical users that cannot comprehend with the manual removal. This automatic detection and cleaner is recommended. However, you need to download and install a tool to complete this process. The tool is free to download. We highly advise the use of this program to automatically delete all files and registry entries created by Memory Scan. Remember that erasing system files required by the operating system may cause erratic behavior. It may also lead to system malfunction. Proceed with Memory Scan automatic removal.

Use A Portable SuperAntiSpyware:
For complete removal of the virus, carry out a separate scan using different security program. This may catch infected items that evade your previous scan. Download and run SAS Portable Scanner.