Windows Inviolability System

30 June 2011 Rogue 0 Comment

Windows Inviolability System is a computer threat that can penetrate a system without being detected by an anti-virus program. Windows Inviolability System will fall under the category of rogue security application because of its characteristics and ways to deceive users with false information regarding security of the PC. It is usually delivered by a fake security warnings that will be displayed on contracted web sites. There are also instances that Windows Inviolability System virus can be downloaded from file-sharing networks when it pretends to be a legitimate program and mimic others executable files. Fake multimedia web sites are also known to propagate this kind of virus and will disguise itself as a multimedia player required to view online movies.

Avoid Windows Inviolability System virus buy installing an anti-malware program that will block visits and redirection to malicious web sites. If already infected, immediately run a full scan of the computer using anti-virus and anti-malware application. Ignore every message and alerts being displayed by Windows Inviolability System, all of there are fake and was just a part of its unfair marketing strategy. Only legitimate security product can remove viruses and malware like Windows Inviolability System.

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Windows Inviolability System Removal Procedures

Manual Removal:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “Windows Inviolability System”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
(random characters).exe

2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the computer and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to Windows Inviolability System Virus.
4. Registry entries created by Windows Inviolability System must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of Windows Inviolability System start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
(random characters).exe

7. Click Apply and restart Windows.

Windows Inviolability System Removal Tool:
In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.

Using Portable SuperAntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be remove as well. Click here to download and run SAS Portable Scanner.

Technical Details and Additional Information:

Malicious Files Added by Windows Inviolability System:
%AppData%\Microsoft\[RANDOM CHARACTERS].exe
C:\Documents and Settings\[username]\Local Settings\Application Data\Microsoft\[Random 6 Characters].exe
Windows Inviolability System Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Internet Settings “WarnOnHTTPSToHTTPRedirect” = ’0?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Internet Settings “WarnOnHTTPSToHTTPRedirect” = ’0?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Image File Execution Options\afwserv.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Image File Execution Options\avastsvc.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Image File Execution Options\avastui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Image File Execution Options\egui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Image File Execution Options\msascui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Image File Execution Options\msmpeng.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Image File Execution Options\msseces.exe “Debugger” = ‘svchost.exe’