Thursday, August 9, 2012

Remove Windows Virtual Security counterfeit taking into account the rogue often comes in a bundle with rootkit, trojan etc.

Windows Virtual Security does not provide for scanning for real. It is meant to make user convinced the PC undergoes scan so that antivirus program is in place. It is strongly recommended to remove Windows Virtual Security as yet another phony antivirus program.
Rootkits are widely applied nowadays to protect malware. Those rogue programs play the same role a genuine antivirus plays for harmless data. That is, rootkits protect malicious data from user’s and true antivirus extermination attempts, whereas security software product, if genuine and fair, is meant to protect computer system from rootkits and other infections.
Removal of Windows Virtual Security may need to be preceded by the rootkit deletion. However, the fake antivirus is independent, self-sufficient program, and may be installed as a single infection and in a bundle with various programs.
Click here to launch free scanner and get rid of Windows Virtual Security regardless of the circumstances of the malware invasion onto your PC.


 
Windows Virtual Security activation code (helps removal):
0W000-000B0-00T00-E0020
NOTE: "Activating" Windows Virtual Security is not enough. You need to remove related trojans \ rootkits using reliable malware removal solution.
It is important to fix Windows registry after malware removal using safe registry cleaner software.
 
Windows Virtual Security manual removal guide:
Delete infected files:
%AppData%\NPSWF32.dll
%AppData%\Protector-[random 3 characters].exe
%AppData%\Protector-[random 4 characters].exe
%AppData%\W34r34mt5h21ef.dat
%AppData%\result.db
%CommonStartMenu%\Programs\Windows Antivirus Release.lnk
%Desktop%\Windows Antivirus Release.lnk
Delete Windows Virtual Security registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegedit” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorAdmin” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorUser” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “EnableLUA” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “net” = “2012-4-27_2″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “UID” = “tovvhgxtud”
HKEY_CURRENT_USER\Software\ASProtect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\[random].exe

No comments: