Windows Security Renewal is a "newly-born" rogue. Be careful of it!!!

Windows Security Renewalcomes from the FakeVimes virus clan. It states it’s there to help you combat viruses, the actual plan is to trick you out of some money. The above characteristic makes this program a rogue anti-spyware that infects PCs and then keeps trying to persuade the victims that the system will go down the drain unless the paid version of the software is purchased.

Windows Security Renewal does not get on a workstation like normal trustworthy piece of software do. It invades the host system, being preceded by some trojans that manage to sneak by the firewall and other security measures. Although tiny, this trojan opens up a gateway for dragging in the rest of malicious files and other malware components. The rogueware starts with a scan which first pops up when the program’s installation completes and further keeps showing up every time you launch Windows. This scan looks real but isn’t such at all. It comes up with results that must not possibly be considered real or credible whatsoever. The idea there is to scare you and try to convince you that the multiple alleged infections on your computer are going to ruin it. That way, it’s definitely easy for the junkware to get its victims paying the fee for registering the full build. Hopefully, none of you reading this entry has actually paid for this scam. If someone has paid, it is necessary to contact credit card company and revoke all charges. The next, not less important, step you should do is to remove this infection from your workstation without lingering. Loaris Trojan Remover will help you in it. You you need to install Loaris Trojan Remover and run full scan with it. Make sure to update the program before you run it. Then, when the scan has been completed, remove all infections it finds and reboot your system. If you have difficulties deleting this virus please contact us via support channels available at this site.

3. Files

In the process of the installation, Windows Security Renewal copies the following files to the hard disk.

Protector-[rnd].exe in %AppData% folder

4. System registry

Windows Virus Hunter creates the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
Inspector = %AppData%\Protector-[random].exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\a.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\aAvgApi.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\About.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\adaware.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\advxdwin.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\agent.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentsvr.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentw.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\alertsvc.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\alevir.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\alogserv.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV.exe\
Debugger = svchost.exe

Windows Virus Hunter automatic remover