Security Central

7 July 2009 24 Comments

Security Central appears to provide real-time protection once installed on the computer. But in reality, this piece is another creation of rogue developers who also produce XP Police Antivirus. Security Central is a reinvented version. This new variant is presented with a new graphical user interface and much more dangerous than its previous forms. Typically, Security Central virus is obtained when a result from fake online virus scanner site is executed. The action may download and installed the rogue application on visitor’s computer unattended. As soon as it reaches the system, it quickly modify Windows registry to give itself an unmanned start when Windows is begins to initialize.

Common symptoms of Security Central that are very visible may include the following:

  • Excessive pop-up alerts and warning messages.
  • Automatic virus-scan after Windows operating system is loaded.
  • Internet browser redirection where-in search result is pointed to unwanted web sites.

Furthermore, Security Central frequently issue a number of fake security report that aims to trick user and make them believe that system si severely infected. Sample message are:

Security Central Firewall Alert
Your computer is being attacked from a remote machine!
Block Internet access to your computer to prevent system infection.

Security Central
Your computer is under the infections threat. Run instant shield protection to safe your data and prevent internet access to your credit card information. Select this to run instant shield.

Security Central Firewall Alert
Warning
Keylogger activity detected!
Your account in social network is under attack. Click here to block unauthorized modification by removing threats (Recommended).

It is vital to remove Security Central virus immediately before any further damage can be performed on compromised system. Follow the procedures below to eliminate the malware together with files it has dropped on the computer.

Screen Shot Images:

 

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Security Central Removal Procedures


Security Central REMOVAL TOOL:
In order to completely remove the threat, it is best to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected computer.


MANUAL REMOVAL PROCEDURE:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “Security Central”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
(random characters).exe

2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the system and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to Security Central Virus.
4. Registry entries created by Security Central must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of Security Central start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
(random characters).exe

7. Click Apply and restart Windows.

Technical Details and Additional Information:

Malicious Files Added by Security Central
%UsersProfile%\2ef60fed-027a-457c-9737-17ac37f7b7f7.dat
%AppData%\Microsoft\Internet Explorer\Quick Launch\Security Central.lnk
%UserProfile%\Desktop\Security Central.lnk
%Temp%ins3.tmp
%Temp%mv2.tmp
%Temp%wrk3.tmp

File Location for Windows Versions:

  • %UserProfile% for Vista/7 user is C:\Users\<Current User> for Windows Vista/7, for Windows XP/2000 this is C:\Documents and Settings\<Current User>.
  • %AppData% for Vista/7 refers to C:\Users\<Current User>\AppData\Roaming, while for Windows XP/2000 user it is C:\Documents and Settings\<Current User>\Application Data.
  • %Temp% refers to C:\Windows\Temp\.

Security Central Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “3dw46ews-261g-711wc-3523-54derr3r3r3″ (or any random characters)