Explain the fraud trick of fake hard disk diagnostic tool "Win HDD"

"G Data SoftwareAccording to the information released by the company, the fake "system diagnostic tool" was first confirmed in October 2010, and so far there are already several "system defragmenter", "scan disk", "check disk" etc. Variations have appeared, the most common way to make it download just by displaying the site.

And the latest version of this camouflage diagnostic tool is "Win HDD". It is similar to malware that has been disguised as anti-virus software that has appeared so far, and what is displayed on the screen is a fake action screen to the last. Problems and problems of the system are pointed out, but it is only a tool for purchasing software that is false, actually useless.

So, let 's take a look at its signature. If you do not know it may be seriously done, so if you know, there is no loss.
Be aware of the fake system diagnostic tool "WinHDD"
http://gdata.co.jp/press/archives/2010/12/winhdd.htm

This is the main screen. It seems like it.


The place where this tool pretends to be doing system scan is also made public. It looks like it.

YouTube - Fake System Tool Win HDD - Installation and 'Scanning'


After fake defragmentation and optimization, several problems are left, and in order to solve this it is recommended that you purchase a paid version. If you want to purchase, the purchase site is displayed, but if you look closely at this page, the place of the URL is green and the key icon is displayed on the right side, it seems as if it is a safe site Although it is, the URL itself does not exist in the first place. In addition, at the bottom of the page, icons for giving a sense of security such as VeriSign are lined up, but only the part that takes the mail address or card information entered for payment functions correctly.

It is almost like this.

YouTube - Fake System Tool Win HDD - Registration and Extended Download Service


In order to make it even more like that, there is also an additional service of "fake" called "EDS", so if you purchase software for downloading and paying an additional amount, you will lose the file of the downloaded software by any chance or initialize the hard disk If you want to use it again after doing it, you can download the software again. It is a system that is often found on foreign software purchasing sites. Also, on the download link, an input screen like "Capture" which is image authentication appears, and it is also characteristic that it looks even more authentic. It is very fascinating.


Although it is still only in English version, it is highly likely that things will be upgraded and the screen will be in Japanese after that, and if you know that it is such a method in advance, it will be quite different from that.

◆ Removal method

According to the G Data Security Lab, the procedure to remove is as follows.

(1) Right-click the shortcut of "Win HDD" on the desktop and select "Properties".


(2) Confirm the name of the randomly generated executable file of "Win HDD" on the "Properties" screen (eg "98f82f.exe").
(3) Start "Windows Task Manager" with "Ctrl + Alt + Del" and select the "Process" tab.
(4) From "Image name", locate the executable file name confirmed in (2), select it, and click the "End process" button.
(5) Close the "Windows Task Manager" screen.
(6) Return to the "Properties" screen of the shortcut and click "Find Target" (Explorer window opens automatically).


(7) Remove the executable file (the same icon as the shortcut on the desktop). Close the Explorer window.
(8) Click on the "start" button at the bottom left of the screen, enter "regedit" in the "Search program and file" window, and start Registry Editor.
(9) Look for "HKEY_CURRENT_USER" from the list on the left side, click "+", click "+" of "Software" in the same way, and similarly display "Microsoft" "Windows" "CurrentVersion" "Run".


(10) Select the executable file icon of "Win HDD", right click, delete the registry value.
(11) Close the registry edit screen.
(12) Remove all the programs in the "Win HDD" folder from the desktop shortcuts and programs of "WinHDD".