Windows User Satellite

16 February 2011 Rogue 1 Comment

Windows User Satellite is promoted as a rogue security software where in fact it has no capability to remove virus from a computer. Windows User Satellite usually installs by users who was deceive by pop-up alerts and messages. A pop-up alerts will be displayed when users visits a contracted web site stating that viruses were found. It will prompt to clean the virus by downloading an unregistered version of Windows User Satellite. After this unwanted application is completely loaded on the system, another rounds of virus detection is displayed. This time it will ask to purchase the registration key of Windows User Satellite in order to remove the threats.

Presence of rogue program on the PC will further endanger the system. It can connect to a remote server to download additional malware. Just like its other variants like Windows Optimal Settings and Windows Wise Protection, this additional rogue application is considered as dangerous. Antivirus applications will be disabled to prevent its own removal. Execution of any installed applications are also blocked and declare the file as infected. As you can see, all of these computer irregularities are brought about by the rogue program. Remove Windows Wise Protection to bring back computer to its normal state and good working condition.

Screen Shot Image:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Windows User Satellite Removal Procedures

Manual Removal:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “Windows User Satellite”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
(random).exe

2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the computer and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to Windows User Satellite Virus.
4. Registry entries created by Windows User Satellite must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of Windows User Satellite start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
(random).exe

7. Click Apply and restart Windows.

Windows User Satellite Removal Tool:
In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.

Using Portable SuperAntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be remove as well. Click here to download and run SAS Portable Scanner.

Technical Details and Additional Information:

Malicious Files Added by Windows User Satellite:

%UserProfile%\Application Data\.exe

Windows User Satellite Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon “Shell” = ‘%UserProfile%\Application Data\<random>.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe “Debugger” = ‘svchost.exe’