Monday, August 6, 2012

Remove Windows Interactive Safety as a tool meant to cheat credulous people

Windows Interactive Safety is desperate to prove its ability of detecting threats. Its task is to get user convinced that any PC is infected.
For that purpose, series of popups dressed up as scan progress and results, individual threat alerts are generated by the program. As the program fakes antivirus, it does not perform actual detections. The info it generates is meant to cheat credulous users.
The rogue exists in online and resident versions. However, the online version is powered by resident infection too: there is a browser hijacker that keeps redirecting compromised browser to the malware’s website. In both cases removal of Windows Interactive Safety is needed.
Click here to launch free scanner and get rid of Windows Interactive Safety fake antimalware so that actual security tool could ensure your PC is protected from real malware. 



Windows Interactive Safety activation code (helps removal):

0W000-000B0-00T00-E0020
NOTE: "Activating" Windows Interactive Safety is not enough. You need to remove related trojans \ rootkits using reliable malware removal solution.
It is important to fix Windows registry after malware removal using safe registry cleaner software.
 
Windows Interactive Safety manual removal guide:
Delete infected files:
%AppData%\NPSWF32.dll
%AppData%\Protector-[random 3 characters].exe
%AppData%\Protector-[random 4 characters].exe
%AppData%\W34r34mt5h21ef.dat
%AppData%\result.db
%CommonStartMenu%\Programs\Windows Interactive Safety.lnk
%Desktop%\Windows Interactive Safety.lnk
Delete Windows Interactive Safety registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegedit” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorAdmin” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorUser” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “EnableLUA” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “net” = “2012-4-27_2″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “UID” = “tovvhgxtud”
HKEY_CURRENT_USER\Software\ASProtect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\[random].exe

No comments: