Windows Software Protection

7 February 2011 Rogue 1 Comment

Windows Software Protection is a bogus security product created for Windows operating system. Windows Software Protection virus can penetrate a target computer by providing misleading alerts about the status of the computer. This malicious software is promoted on fake Microsoft Security Essentials alert. When you visit an infected web sites related to this malware, you might see this pop-up message:

Microsoft Security Essentials Alert
Potential Threat Details
Microsoft Security Essentials detected potential threats that might compromise your private or damage your computer. Your access to these items may be suspended until you take an action. Click ‘show details’ to learn more.

Executing this warning will lead you to download and install a trial version of Windows Software Protection. If loaded on the computer, it will modify the registry to make itself to run every time you start using Windows. Then, the virus begins to scan your PC and quickly exhibit dozens of threats it recommends to remove as soon as possible. However, it will not permit you to proceed. Cleaning the computer will only function if you obtain the full version of Windows Software Protection.

Keep in mind that Windows Software Protection virus was created in the sole mean of earning a profit from this fraudulent act. It will ask for your credit card details to process the payment. However, aside from the software license fee, other charges may be debited to your account. Worst, attacker may use your credit card data for unknown transactions. You must avoid this harmful software. As much as possible, remove Windows Software Protection using only trusted anti-virus programs.

Screen Shot Image:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Added Registry Entries:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" = '%UserProfile%\Application Data\[random].exe'
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe "Debugger" = 'svchost.exe'
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe "Debugger" = 'svchost.exe'
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe "Debugger" = 'svchost.exe'
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger" = 'svchost.exe'
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe "Debugger" = 'svchost.exe' 

Associated Files and Folders:

%UserProfile%\Application Data\[random].exe 

Automatic Removal Procedures

Windows Software Protection Removal Tool:
In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.

Using Portable SuperAntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be remove as well. Click here to download and run SAS Portable Scanner.

Online Virus Scanner:
Another way to remove a virus without the need to install additional anti-virus application is to perform a thorough scan with free Online Virus Scanner that can be found here or on websites of legitimate anti-virus and security provider.