Windows System Integrity

4 July 2011 Rogue 0 Comment

Windows System Integrity is a fake program that will promote itself as a trusted application.  This potentially unwanted program belongs to a large group of bogus hard drive optimization tools that currently propagates over the Internet. When Windows System Integrity virus reached a computer, it will begin to display continuous pop-up alerts and false messages indicating that errors were found. It also simulates a local scan and provide fabricated results to further convince its victims that a licensed version is needed to resolve all issues.

Ignore Windows System Integrity, since it was already categorized as rogue. This program was developed for the main purpose of scamming users and earn a profit from this illegal online activities. Remove Windows System Integrity virus with only trusted and known anti-malware or anti-virus program. Make sure that all files related to Windows System Integrity are removed to prevent its own spawning on the system.

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Windows System Integrity Removal Procedures

Manual Removal:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “Windows System Integrity”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
(random characters).exe

2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the system and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to Windows System Integrity Virus.
4. Registry entries created by Windows System Integrity must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of Windows System Integrity start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
(random characters).exe

7. Click Apply and restart Windows.

Windows System Integrity Removal Tool:
In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.

Using Portable SuperAntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be get rid as well. Click here to download and run SAS Portable Scanner.

Technical Details and Additional Information:

Malicious Files Added by Windows System Integrity:
%UserProfile%\Desktop\ Windows System Integrity.lnk
%Program Files%\Windows Vulnerabilities Rescuer\Windows Vulnerabilities Rescuer.exe
%AppData%\Microsoft\[RANDOM CHARACTERS].exe
%AppData%\Microsoft\[RANDOM CHARACTERS].exe

Windows System Integrity Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “02142491337984709710167344546694
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell “%AppData%\Microsoft\[RANDOM CHARACTERS].exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe “Debugger” = ‘svchost.exe’