Windows Anticrashes Utility

1 June 2011 Rogue 0 Comment

Windows Anticrashes Utility is a rogue software that belongs to a large group of malware. This bogus product uses fake Microsoft Security Essentials Alert to deliver the corrupt code to every computer users. Windows Anticrashes Utility will be very successful in spreading itself all over the Internet with the help of a Trojan that will sneak into the system by exploiting software vulnerabilities. Once inside the PC, it will modify major system settings, allowing it to control the operation of victim’s computer. Blocking of programs, killing anti-virus process and browser redirection what you can expect from this malware.

Just like its other variants namely Windows Necessary Firewall and Windows Profile System, Windows Anticrashes Utility virus will attempt to mislead computer users by flashing fake warning alerts and messages stating that system is under attack. At this point, it will endorse the said program as the sole removal of the infection. Any attempt to remove detected viruses will open a new browser Window that will point victim to a payment web site. Credit card details are collected to settle the payment. Having the licensed version of Windows Anticrashes Utility will not help in resolving computer issues, it is just a waste of money for the end user.

Screen Shot Image:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Malware Behavior
This rogue security application, when present on the system will cause obstruction. Windows Anticrashes Utility will detect numerous threats. This detection is misleading. It attempts to force victims into purchasing the full version of the rogue program. As already mentioned, this harmful software will display some fake alerts containing false messages. Here are some examples.

Microsoft Security Essentials Alert
Potential Threat Details
Microsoft Security Essentials detected potential threats that might compromise your private or damage your computer. Your access to these items may be suspended until you take an action. Click ‘show details’ to learn more.

System Security Warning
Attempt to modify register key entries is detected. Register entries analysis is recommended.

Added Registry Entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = ’0?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore “DisableSR ” = ’1?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe “Debugger” = ‘svchost.exe’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = ’0?

Associated Files and Folders:

%UserProfile%\Application Data\Microsoft\(random characters).exe 

1. Stop Windows Anticrashes Utility process by pressing Ctrl+Alt+Del on your keyboard. It will open Windows Task Manager. Look for the following and click on End Process.
(random characters).exe

2. You need to update your installed antivirus software. Please connect to the Internet and download the most recent database. This is a one-click process from your AV program’s console.
3. Run a full system scan. You must clean all detected files. If cleaning is not possible, you may delete or quarantine the item.

4. Edit your Windows registry. Find and delete Windows Anticrashes Utility entries as shown in the registry section. [how to edit registry]
5. Exit registry editor when you are done.

6. Remove Windows Anticrashes Utility start-up entry by going to Start > Run. Type msconfig on the "Open" dialog box. System Configuration Utility will open. Go to Startup tab and remove the check mark on the following items.
(random characters).exe
7. Click Apply and restart Windows.

Windows Anticrashes Utility Removal Tool

In order to remove the threat completely, you need to download and run Malwarebytes Anti-Malware. This is a free malware removal tool. If Trojan infection blocks the downloading of this program, get it using a clean computer. Rename the executable file before executing on the infected PC.

Scan with Portable Antivirus:
Most of the time, Trojan associated with a rogue program will disable Windows functionalities and prevent execution of any application including antivirus program locally installed. If this happens, you can try using a McAfee Portable Antivirus called Stinger. It can be downloaded for free.

Online Virus Scanner

Another way to remove a virus without the need to buy extra anti-virus software is to do a system check thorough Online Virus Scanner. This tool is available on official web sites of several anti-virus maker.