Windows Supervision Center

9 May 2011 Rogue 2 Comments

Windows Supervision Center is a misleading security and utility application or most commonly known as rogue software. Windows Supervision Center will be downloaded on to victims computer automatically by means of an associated Trojan. Be careful on visiting web sites that will pretend as free online video source. This site will prompt its visitors about a necessary player needed to play movies online. Without knowing that the player has an embedded Trojan, users may be easily get infected when it is installed. Compromised computer will suffer from browser hijacking. The Trojan will modify Internet browser settings of the infected computer that will redirect its browser to a malicious online virus scanner. On these bogus security web sites, one may download Windows Supervision Center thinking that it was a legitimate program.

If this fake software is loaded on to the computer, it will start to display a barrage of warnings and alert messages. An entry will also be placed on Windows registry that will allow the unwanted program to be executed automatically when Windows is started. This will mean an automatic scan of the system. All of the time, the scan results provided by Windows Supervision Center are fabricated. This was meant to lure users to purchased the licensed version and gain a profit for its creators. Never patronized this rogue product. In fact, Windows Supervision Center must be removed immediately before it can further harm the computer.

Screen Shot Image:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Windows Supervision Center Removal Procedures

Manual Removal:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “Windows Supervision Center”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
(random characters).exe

2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the computer and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to Windows Supervision Center Virus.
4. Registry entries created by Windows Supervision Center must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of Windows Supervision Center start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
(random characters).exe

7. Click Apply and restart Windows.

Windows Supervision Center Removal Tool:
In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.

Using Portable SuperAntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be remove as well. Click here to download and run SAS Portable Scanner.

Scan with Norton Power Eraser:
A free removal tool from Norton Antivirus was developed to remove unfamiliar threats without using the traditional AV signatures. Download the tool from this location and start scanning the computer for viruses.

Technical Details and Additional Information:

Malicious Files Added by Windows Supervision Center:
%UserProfile%\Application Data\Windows Supervision Center\
%UserProfile%\Application Data\Windows Supervision Center\cookies.sqlite
%UserProfile%\Application Data\Windows Supervision Center\Instructions.ini
%Documents and Settings%\All Users\Application Data\[random characters]\
%Documents and Settings%\All Users\Application Data\[random characters]\[random characters].exe
%Documents and Settings%\All Users\Application Data\[random characters]\[random characters].mof
%Documents and Settings%\All Users\Application Data\[random characters]\[random characters].dll
%Documents and Settings%\All Users\Application Data\[random characters]\[random characters].ocx
%Documents and Settings%\All Users\Application Data\[random characters]\[random characters]\

Windows Supervision Center Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Windows Supervision Center?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options “Debugger” = “svchost.exe”
HKEY_CLASSES_ROOT\PersonalSS.DocHostUIHandler
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “RunInvalidSignatures” = “1?
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyServer” = “http=127.0.0.1?