SecureWarrior and SecureVeteran

2 October 2009 Rogue 0 Comment

SecureWarrior and SecureVeteran are other versions of a rogue security program that is a variant of TrustNinja and SaveDefender among others. All of these mentioned programs share the same Graphical User  Interface (GUI) and aims of deceiving Internet users by means of a fraudulent home page that will prompt visitors of possible virus infections. SecureWarrior will advise users to download and install the program accompanying with a promise of sure computer protection and will provide immediate threat removal.

Once SecureWarrior or SecureVeteran is installed and run, several pop-up messages will be displayed to intimidate users and this time, it will demand to purchase the licensed version of the program as the only acceptable solution to remove detected threats. SecureWarrior and the entire same rogue program have no proven computer security capability for both trial and registered version. They have no scanning engine that will intensely search computers for known threats and viruses. Purchasing SecureWarrior will not do any good on end users, it is only the author that will benefit from this fraudulent activities.

Screen Shot Images:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Added Registry Entries:

HKCU\Software\Microsoft\Windows\Current Version\Run "0urw56p0.exe"
HKCU\Software\Microsoft\Windows\Current Version\Run "SecureWarrior"
HKCU\Software\SecureWarrior
HKLM\SOFTWARE\Microsoft\Windows\Current Version\Uninstall\SecureWarrior
HKLM\SOFTWARE\SecureWarrior
HKLM\SYSTEM\CurrentControlSet\Enum\Root \LEGACY_SECUREWARRIORSVC
HKLM\SYSTEM\CurrentControlSet\Services \SecureWarriorSvc

Associated Files and Folders:

%Program Files%\SecureWarrior Software\SecureWarrior\license.txt
%Program Files%\SecureWarrior Software\SecureWarrior\securewarrior.exe
%Program Files%\SecureWarrior Software\SecureWarrior\uninstall.exe
%Documents and Settings%\All Users\Desktop\SecureWarrior.lnk
%Documents and Settings%\All Users\Start Menu\Programs\SecureWarrior
%Documents and Settings%\All Users\Start Menu\Programs\SecureWarrior\1 SecureWarrior.lnk
%Documents and Settings%\All Users\Start Menu\Programs\SecureWarrior\2 Homepage.lnk
%WINDOWS%\[Random].cpl
%WINDOWS%\[Random].dll

This guide requires a tool called Malwarebytes' Anti-Malware. It is a free tool designed to eradicate various computer infections. MBAM scanner is distributed for free.

Boot Windows in Safe Mode With Networking

1. First thing to do is to reboot the computer in Safe Mode with Networking to avoid SecureWarrior and SecureVeteran from loading at start-up. You may want to print this procedure as we have to restart the computer to complete the removal process.
- Restart the computer.
- Before Windows begins to load, press F8 on your keyboard.
- It will display an Advanced Boot Options menu. Please select Safe Mode with Networking.
- Windows will now start in Safe Mode.

Remove SecureWarrior and SecureVeteran with MalwareBytes' Anti-Malware

2. Download removal tool from this page and save it on your Desktop or any location on your PC.
3. When finish downloading, double-click on the file to install the application.
4. Follow the prompts and install with default configuration.
5. Before the installation completes, you need to update the database.

6. Click Finish. Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
7. When finished updating, the tool will run. Select Perform full scan on main screen to check your computer thoroughly.
8. When scanning is finished click on Show Results.
9. Make sure that all detected threats are checked, click on Remove Selected. This will delete all files and registry entries that belongs to SecureWarrior and SecureVeteran.
10. Restart your computer.

Note: If SecureWarrior and SecureVeteran prevents mbam-setup.exe from downloading. Download the software from another computer. Renaming it to something like 'anything.exe' can help elude the malware.