Security Central

7 July 2009 Rogue 24 Comments

Security Central appears to provide real-time protection once installed on the computer. But in reality, this piece is another creation of rogue developers who also produce XP Police Antivirus. Security Central is a reinvented version. This new variant is presented with a new graphical user interface and much more dangerous than its previous forms. Typically, Security Central virus is obtained when a result from fake online virus scanner site is executed. The action may download and installed the rogue application on visitor’s computer unattended. As soon as it reaches the system, it quickly modify Windows registry to give itself an unmanned start when Windows is begins to initialize.

Common symptoms of Security Central that are very visible may include the following:

  • Excessive pop-up alerts and warning messages.
  • Automatic virus-scan after Windows operating system is loaded.
  • Internet browser redirection where-in search result is pointed to unwanted web sites.

Furthermore, Security Central frequently issue a number of fake security report that aims to trick user and make them believe that system si severely infected. Sample message are:

Security Central Firewall Alert
Your computer is being attacked from a remote machine!
Block Internet access to your computer to prevent system infection.

Security Central
Your computer is under the infections threat. Run instant shield protection to safe your data and prevent internet access to your credit card information. Select this to run instant shield.

Security Central Firewall Alert
Warning
Keylogger activity detected!
Your account in social network is under attack. Click here to block unauthorized modification by removing threats (Recommended).

It is vital to remove Security Central virus immediately before any further damage can be performed on compromised system. Follow the procedures below to eliminate the malware together with files it has dropped on the computer.

Screen Shot Images:

 

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Added Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "3dw46ews-261g-711wc-3523-54derr3r3r3" (or any random characters)
Associated Files and Folders:
%UsersProfile%\2ef60fed-027a-457c-9737-17ac37f7b7f7.dat
%AppData%\Microsoft\Internet Explorer\Quick Launch\Security Central.lnk
%UserProfile%\Desktop\Security Central.lnk
%Temp%ins3.tmp
%Temp%mv2.tmp
%Temp%wrk3.tmp
File Location for Windows Versions:
  • %UserProfile% for Vista/7 user is C:\Users\<Current User> for Windows Vista/7, for Windows XP/2000 this is C:\Documents and Settings\<Current User>.
  • %AppData% for Vista/7 refers to C:\Users\<Current User>\AppData\Roaming, while for Windows XP/2000 user it is C:\Documents and Settings\<Current User>\Application Data.
  • %Temp% refers to C:\Windows\Temp\.

How to Remove Security Central

Restore Windows Components

If "Security Central" enters your system, there is a big chance that Windows files, registry entries and other essential components are also infected. System Restore can reinstate clean system files by restoring the configuration to an earlier date. If you have a saved restore point before this virus infiltrates the computer, please restore Windows to previous settings.

Manual Removal Procedure

1. Press Ctrl+Alt+Del on keyboard to stop the process associated to "Security Central". When Windows Task Manager opens, go to Processes tab. Find and end this process.
(random characters).exe

2. You need to update your installed antivirus software. Please connect to the Internet and download the most recent database. This is a one-click process from your AV program’s console.

3. Thoroughly scan the computer and remove any threats found by your antivirus program. If delete option is not available, your best next choice is to quarantine the infected file. There is also a need to manually locate and delete malicious files. Please see the file section for items that are relevant to Security Central.

4. Next, you need to remove registry entries created by Security Central. Please refer to registry section to view entries related to the rogue program.
- (Windows 2000/XP) Go to Start > Run, type "regedit" on dialog box then press Enter on keyboard.
- (Windows Vista/7) Go to Start > Search Program and Files, type "regedit" and press Enter.

5. Exit registry editor when you are done.

6. Get rid of Security Central start-up entry by going to Start > Run, type msconfig on the "Open" dialog box. It will launch a new window containing System Configuration Utility. Click on the Startup tab and uncheck the following item.
(random characters).exe

7. Click Apply. You need to restart the computer.

Security Central Removal Tool

To remove Security Central from your computer completely, we suggest scanning it with Malwarebytes Anti-Malware. This is a free tool. Some Trojans will block the downloading of MBAM to avoid removal. If that happens, download the tool from a clean computer and rename the executable file before executing on the infected machine.

What to do next...