Remove Smart HDD (Smart HDD Uninstall Guide)

Another branch of the FakeHDD family of rogues has appeared, and its name is Smart HDD. There is no dispute over the name of the rogue – it is Smart, indeed, but it is not an optimization and analysis tool. Smart HDD, just like all other members of this corrupt family, is a fake program, which has been created by cyber criminals who want to gain profit by selling the fake licensed versions of such malware pieces.

Figure 1. Smart HDD Virus screenshot

Smart HDD manages to sneak inside vulnerable computers with the help of Trojans, which come as part of hacked websites. When you click through the website, the Trojans exploit any possible security loop-hole in your security in order to break inside. A great part of security vulnerabilities is caused by outdated software. Therefor, security experts recommend keeping all your programs up-to-date. Once Trojans sneak into the system, they download Smart HDD and assist it in its installation process.

Upon its installation, Smart HDD configures itself to start automatically every time you turn on your computer. It also immediately begins to produce counterfeit security alerts. They appear to be coming from your Task Bar, and this is why a lot of people tend to believe they are real. In fact, these warnings are all made-up just to scare you into believing there is a number of errors in your PC and them prompt you to buy Smart HDD.

The S.M.A.R.T. Check is just another trick, used by Smart HDD. It uses this trick to convince you that you need to spend your money on its licensed version. The S.M.A.R.T. Check pretends to be looking for hard drive errors, but it is not. However, at the end of the scan, it shows a whole list of them. The diagnostic report displayed is a big con. If you decide to repair these errors with Smart HDD’s help, it would ask you to activate its full version. Keep in mind that the presumable full version is fake, and you will only send your money away to hackers if you obtain it.

Hiding random files in your PC is also part of Smart HDD’s scam-game, but it includes deleting shortcuts, as well. The backups of the deleted shortcuts are stored in your %Temp%\smtmp folder. Therefore, in case of a Smart HDD infection, you should be very careful not to delete any files from this folder. As for the missing files from your computer – do not panic, they are only hidden, and everything will fall back to place when you get rid of the malware.

Smart HDD may also block some of your other programs. The alerts you see below are used by the malware to make you think that you cannot start the applications due to hard drive errors.

Windows detected a hard drive problem.
A hard drive error occurred while starting the application.

Windows cannot find notepad. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.

To sum up, Smart HDD should not be let to operate undisturbed on your PC, because it can only harm your computer system and open various cracks in your computer security so that other viruses can sneak inside. Use a real AV tool and remove Smart HDD now.

UPDATE (April 05 2012)

Security specialists again report about a new release of the malicious attacker Smart HDD. This creation of hackers is known to have appeared again in March 2012, and since then it has been targeting computers. There are some changes in the way this deceitful application works in comparison to its earlier version. Smart HDD pretends to make a S.M.A.R.T. Check of the user’s hard drive and then wants to mislead the victim into thinking this tool can repair hard drive problems. Smart HDD also relies on its trustworthy layout to mislead unaware users into thinking they can entrust the safety of their machines to the full version of this bogus software.

Although Smart HDD pretends to be a hard drive optimization tool, all of the information displayed by this program is fake. Smart HDD mimics reliable scan results and system warnings. However, all of the hard drive errors do not exist and, in fact, legitimate scanners would not report about them in the same way as Smart HDD.

Smart HDD reports about the following hard drive errors and problems:

Hard drive boot sector reading error
During I/O system initialization, the boot device driver might have failed to initialize the boot device. File System initialization might have failed because it did not recognize the data on the boot device.

Your computer is in a critical state. Hard disk error detected.
As a result, it can lead to hard disk failure and potential loss of data. It is highly recommended to repair all found errors to prevent loss of files, applications and documents stored on your computer.

Error 0×00000024 – NTFS_FILE_SYSTEM

If you are scared by all of these frightening messages about serious hard drive errors, do not be. In fact, if a hard drive boot sector error is displayed, you will not be able to start your PC at all. What is more, if there are problems with your hard drive, they will not be reported by some unknown application. A blue screen will be displayed, and a warning about the hard drive error that has occurred will be shown. As you can see, there is no need to worry about the errors reported by Smart HDD, as they do not exist.

Another trick used by Smart HDD is that the deceitful intruder hides some of your icons in the Start Menu, as well as other files. This is done to mislead you into thinking some of your documents and programs have been deleted. There is no need to panic, because your information is not lost. You can use a reliable tool to get all your files back in place.

In order to stop the fake messages and temporary disable Smart HDD, use a registration key found by our resaerchers. To register this key you can use a fake email address. Do not submit your personal email. This is the registry code you can use for the new version of Smart HDD:

15801587234612645205224631045976

Know that even if you register Smart HDD, the attacker is still present on your computer and it has to be removed. Although you do not see the annoying messages and scan reports, Smart HDD still hides in the computer system and poses a great risk at your PC and information. To protect your personal and financial details, as well as all the information stored on your computer, use a trustworthy AV program. Also, to stop other malicious creations of hackers from entering your computer, you have to get rid of Smart HDD as soon as possible.

To remove Smart HDD and fix your system, use a reliable and effective security program to scan your PC.

Smart HDD Manual Removal Instructions:

Stop These Smart HDD Processes:
(Learn how to do this)
(random letters).exe like 2362636.exe and pigrfbngn.exe
Find and Delete These Smart HDD Files:
(Learn how to do this)
%Temp%\(random letters)
%Temp%\(random letters).exe
%Temp%\(random letters).dll
%Temp%\dfrg
%Temp%\dfrgr
%Documents and Settings%\[User_Name]\Desktop\Smart HDD.lnk
%Documents and Settings%\[User_Name]\Start Menu\Programs\Smart HDD
%Documents and Settings%\[User_Name]\Start Menu\Programs\Smart HDD\Smart HDD.lnk
%Documents and Settings%\[User_Name]\Start Menu\Programs\Smart HDD\Uninstall Smart HDD.lnk
Remove These Smart HDD Registry Values:
(Learn how to do this)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “(random letters)”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “(random letters).exe”

Free Antispyware Scan
Filed Under: Featured, Spyware Removal Tagged With: , , , , ,

Remove Antivirus Protection 2012

It is reported that there is another fake AV tool that targets computers all over the world. Antivirus Protection 2012 is known to be a malicious application that pretends to be a reliable and effective security tool which can scan your computer and report system threats and infected files. The truth is that Antivirus Protection 2012 wants to sneak inside your PC without your knowledge. Although it imitates a legitimate anti-spyware program, Antivirus Protection 2012 is not able to protect your computer. On the contrary, it even makes it vulnerable to other infections and computer viruses that are hiding on the Internet. The aim of Antivirus Protection 2012 is to mislead PC users into paying for the useless services of the tool. People will waste their money if they buy the full version of the software, and they will not be provided with any services after that.

Figure 1. Antivirus Protection 2012 fake scan

Antivirus Protection 2012 is believed to be a member of the same family as Security Defender and AntiMalware Defender. The fake tool Antivirus Protection 2012 is also known to be created as a copy of Windows Defender, which is a genuine AV tool developed by Microsoft. This means that Antivirus Protection 2012 is disguised as Windows Defender and is aimed at tricking unsuspecting computer users into entrusting the safety of their PCs to the bogus software. Just as all the other members of this rogueware family, Antivirus Protection 2012 is trying to convince PC users that they need to pay for the services of the fake tool to fix their machines. The user is not aware that all the infected files and computer threats reported by the applications are not real and are shown only to scare him into thinking he has to buy Antivirus Protection 2012.

Security specialists claim that there are two ways in which Antivirus Protection 2012 penetrates into targeted computers. The bogus tool can use malicious web pages that are able to exploit vulnerabilities in running programs and then use them to transfer Antivirus Protection 2012 to the targeted PC. Another way of transferring Antivirus Protection 2012 is via fake online scanners. The computer owner is redirected to a malicious web page that promotes some free online scanner. If the user is tricked into scanning his PC with the fake tool, he is told that there are many compromised files in the system. To fix the problem, the user is advised to download an unknown file. The person is not aware that this file will transfer the deceitful program Antivirus Protection 2012 to his PC and infect it.

To mislead users into thinking their machines are compromised with severe infections, and there are many system errors, Antivirus Protection 2012 displays many pop-up messages. All of these messages are aimed at showing fake problems and non-existent threats. The messages will pop up again, and again and they will not stop showing even if the user tries to stop them. The warnings will report the following problems:

Antivirus Protection 2012 Firewall Alert
Your computer is being attacked from a remote machine!
Block Internet access to your computer to prevent system infection.
Attacker IP: [ip address]
Attack type: RCPT exploit

Antivirus Protection 2012
Spyware.IEMonster process is found. The virus is going to send your passwords from Internet browser (Explorer, Mozilla Firefox, Outlook & others) to the third-parties. Click here for further protection of your data with Antivirus Protection 2012.

Antivirus Protection 2012 Firewall Alert
Suspicious activity in your registry system space was detected. Rogue malware detected in your system. Data leaks and system damage are possible. Please use a deep scan option.

Moreover, Antivirus Protection 2012 will make a fake scan of the system and say that it has detected many compromised files. Antivirus Protection 2012 will also say that these files have to be removed immediately. However, you will not be allowed to delete them manually, as Antivirus Protection 2012 will tell you that you need to purchase its full version to do that.

Do not be tricked by any of these fake messages. Antivirus Protection 2012 will take your money, but it will not protect your PC. Remove the attackers as soon as you can.

Antivirus Protection 2012 Manual Removal Instructions:

Stop These Antivirus Protection 2012 Processes:
(Learn how to do this)
AntivirusProtection2012.exe
rundll32.exe
.exe,
2010yo.exe
472a10e2ebxd9.exe
56493.exe
cosock.exe
cowceb.exe
d20mes.exe
dc_3.exe
ddoll3342.exe
destroyer.exe
exppdf_w.exe
hhbboll_2.exe
jofcdks.exe
lols.exe
puzpup.exe
sycre.exe
winifi.exe
wwwsssgen.exe
securityhelper.exe
securitymanager.exe
Find and Delete These Antivirus Protection 2012 Files:
(Learn how to do this)
%AppData%\Antivirus Protection\
%AppData%\Antivirus Protection\AntivirusProtection2012.exe
%AppData%\Antivirus Protection\IcoActivate.ico
%AppData%\Antivirus Protection\IcoHelp.ico
%AppData%\Antivirus Protection\IcoUninstall.ico
%AppData%\Antivirus Protection\securityhelper.exe
%AppData%\Antivirus Protection\securitymanager.exe
%AppData%\Microsoft\Internet Explorer\Quick Launch\Antivirus Protection.lnk
%StartMenu%\Programs\Antivirus Protection.lnk
%StartMenu%\Programs\Antivirus Protection\
%StartMenu%\Programs\Antivirus Protection\Activate Antivirus Protection.lnk
%StartMenu%\Programs\Antivirus Protection\Antivirus Protection.lnk
%StartMenu%\Programs\Antivirus Protection\Help Antivirus Protection.lnk
%StartMenu%\Programs\Antivirus Protection\How to Activate Antivirus Protection.lnk
%Temp%\2010yo.exe
%Temp%\472a10e2ebxd9.exe
%Temp%\56493.exe
%Temp%\cosock.exe
%Temp%\cowceb.exe
%Temp%\d20mes.exe
%Temp%\dc_3.exe
%Temp%\ddoll3342.exe
%Temp%\destroyer.exe
%Temp%\exppdf_w.exe
%Temp%\hhbboll_2.exe
%Temp%\jofcdks.exe
%Temp%\lols.exe
%Temp%\puzpup.exe
%Temp%\sycre.exe
%Temp%\winifi.exe
%Temp%\wwwsssgen.exe
.exe
Remove These Antivirus Protection 2012 Registry Values:
(Learn how to do this)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “”
HKEY_CURRENT_USER\Software\Antivirus Protection
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Antivirus Protection”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Antivirus Protection 2012 SM”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antivirus Protection

Free Antispyware Scan
Filed Under: Spyware Removal Tagged With: , , , ,

Remove Windows Care Taker

Fake anti-virus programs appear on a daily basis and hackers become more and more creative when inventing them. Windows Care Taker is one of the latest bogus AV tools, which is advertised by cyber criminals as a legitimate product in an attempt to sell its phony licensed version.

Figure 1. Windows Care Taker screenshot

Counterfeit applications such as Windows Care Taker are classified as rogues. They use a variety of scare-strategies, mixed with malicious and aggressive advertising methods in order to reach their initial goal – forcing through their paid versions. Despite the fact that the interface of Windows Care Taker resembles real AV tools, this program doesn’t have any of the functions of security software. Just the opposite- if it manages to penetrate a machine, it lessens the PC’s security, so that other viruses can easily sneak inside, as well.

Windows Care Taker manages to infect the targeted computers with the help of phony online scanner and dangerous Trojans. The fake scanners are placed in corrupted websites, and they offer free scans of every visitor’s PC. The result of all of these scans is that the computer has been infected. Then, the malevolent scanners prompt the user to download and install Windows Care Taker. It is always best to check online and see whether a given program is legitimate or not before you decide to download it on your machine.

Trojans, which assist Windows Care Taker in its download on a computer, are also hidden in hacked websites. Unlike the scanners, they do not need and never ask for user authorization. They simply need a person to click through the website. Then, they search for security vulnerabilities in the system and sneak through them. Their main task when on the inside of a PC is to download Windows Care Taker.

The actions that Windows Care Taker undertakes inside the machine are not connected to the way it has used to sneak inside. It starts with some malicious configurations, which help it run automatically right after Windows loads. When launched, the fake program pretends to be scanning the system for viruses, but no actual process is taking place. At the end, it presents a preliminary list of viruses and urges you to spend your money on its full version, but a full version does not actually exist. Everything connected with Windows Care Taker is a scam via which hackers try to gain profit.

Windows Care Taker also displays many security alerts on the infected PC, and they are all phony. The text varies, but hints at the presence of security threats. It is funny that the only security threat in the machine is the very program that warns about them – Windows Care Taker. Windows Care Taker may even try to block some of your applications and ascribe this to an unknown infection. You, being aware that Windows Care Taker is a con, will not fall for these tricks.

You should treat Windows Care Taker respectively – eliminate it via a real AV tool as soon as you spot it producing bogus scans and pop-ups.

Windows Care Taker Manual Removal Instructions:

Stop These Windows Care Taker Processes:
(Learn how to do this)
Protector-{3 symbols}.exe
Find and Delete These Windows Care Taker Files:
(Learn how to do this)
%AppData%\NPSWF32.dll
%AppData%\Protector-{3 symbols}.exe
%AppData%\result.db
%CommonStartMenu%\Programs\Windows Managing System.lnk
%Desktop%\Windows Managing System.lnk
Remove These Windows Care Taker Registry Values:
(Learn how to do this)
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Policies\\System “DisableRegedit” = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Policies\\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Policies\\System “DisableTaskMgr” = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Run “Inspector”
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Settings “net” = “2012-3-11_2?
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Settings “UID” = “origkboryd”
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\\InternetExplorer\\Main\\FeatureControl\\FEATURE_ERROR_PAGE_BYPASS_ZONE_CHECK_FOR_HTTPS_KB954312
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\atcon.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\bipcp.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\ecengine.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\infwin.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\msconfig
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\PavFnSvr.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\sahagent.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\titaninxp.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\wsbgate.exe

Free Antispyware Scan
Filed Under: Spyware Removal Tagged With: , , , , , ,

Remove Windows Custodian Utility (Uninstall Instructions)

Windows Custodian Utility is reported to be another harmful virus which threatens computers and puts users` information in danger. This is a deceitful creation of cyber criminals. It pretends to be a reliable anti-spyware application. In fact, it has nothing to do with genuine AV software. Windows Custodian Utility cannot provide security-related services.

On the contrary, Windows Custodian Utility puts computers in danger. Moreover, it threatens users` personal and financial information. Windows Custodian Utility imitates the actions and layout of reliable and effective anti-spyware applications. The fake security program displays misleading warnings, and inaccurate scan results to scare users into thinking their computers are compromised. All of this is done to trick users into buying the full version of Windows Custodian Utility. In this way, hackers make more and more money without providing users with security services.

Figure 1. Windows Custodian Utility screenshot

Windows Custodian Utility is aimed at entering into targeted computer without letting their users know that it is a deceitful application. Windows Custodian Utility pretends to be a reliable and legitimate security program. Windows Custodian Utility is not able to scan your PC for infected files or warn you about system threats. On the contrary, Windows Custodian Utility poses a risk at your system and information. This malicious attacker makes it possible for other creations of cyber criminals to enter into your computer.

Windows Custodian Utility is a part of the rogueware family Rogue.FakeVimes. All the members of this malicious family are aimed at tricking PC users into paying for their useless full versions. There are two ways in which Windows Custodian Utility gains access to targeted computers. Windows Custodian Utility is transferred via malicious web sites which exploit vulnerable programs running on targeted PCs. Also, this deceitful creation of hackers is spread via fake online scanners. These automated tools promote Windows Custodian Utility and beguile PC users into thinking they have to download the malicious application.

After Windows Custodian Utility has sneaked into a targeted PC, the deceitful intruder is configured to start automatically when you turn your computer on. After that, Windows Custodian Utility starts displaying fake warnings. All of these messages tell the user of the infected computer about serious system problems. The user is warned that a malicious application is blocked. Moreover, the user is alarmed that software without a digital signature is detected.

The messages display the following information:

Error
Software without a digital signature detected.
Your system files are at risk. We strongly advise you to activate your protection.

Warning
Firewall has blocked a program from accessing the Internet
C:\program files\internet explorer\iexplore.exe
is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server.

Warning! Identity theft attempt Detected
Hidden connection IP: 58.82.12.124
Target: Your passwords for sites

Windows Custodian Utility also makes a fake scan of the system. The system seems to be seriously infected, and there are many compromised files that have to be removed immediately. However, the user is not allowed to delete these files, unless he buys and uses the registered version of Windows Custodian Utility.

Do not be misled by any of the messages displayed by Windows Custodian Utility. They are used to trick you into thinking your PC is in serious danger, and you need to use Windows Custodian Utility to fix your PC. Remove Windows Custodian Utility immediately.

Windows Custodian Utility Manual Removal Instructions:

Stop These Windows Custodian Utility Processes:
(Learn how to do this)
Protector-{3 symbols}.exe
Find and Delete These Windows Custodian Utility Files:
(Learn how to do this)
%AppData%\NPSWF32.dll
%AppData%\Protector-{3 symbols}.exe
%AppData%\result.db
%CommonStartMenu%\Programs\Windows Managing System.lnk
%Desktop%\Windows Managing System.lnk

Remove These Windows Custodian Utility Registry Values:
(Learn how to do this)
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Policies\\System “DisableRegedit” = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Policies\\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Policies\\System “DisableTaskMgr” = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Run “Inspector”
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Settings “net” = “2012-3-11_2?
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Settings “UID” = “origkboryd”
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\\InternetExplorer\\Main\\FeatureControl\\FEATURE_ERROR_PAGE_BYPASS_ZONE_CHECK_FOR_HTTPS_KB954312
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\atcon.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\bipcp.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\ecengine.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\infwin.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\msconfig
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\PavFnSvr.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\sahagent.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\titaninxp.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\wsbgate.exe

Free Antispyware Scan
Filed Under: Spyware Removal Tagged With: , , , , , ,

Remove Windows Warding System

Windows Warding System pretends to be able to protect your computer from deceitful creations of cyber criminals. However, this fraudulent attacker does not tell PC users that it is a scam tool itself. Windows Warding System cannot provide reliable and effective security services. Moreover, Windows Warding System cannot scan your PC and warn you about infected files or potential system threats.

Figure 1. Windows Warding System screenshot

The only aim of Windows Warding System is to enter into your PC unnoticed and then infect the system. After Windows Warding System has managed to compromise your computer, this intruder starts trying to mislead you into thinking there are serious system errors and problems that need to be fixed immediately. Although Windows Warding System is aimed at tricking you into believing you can fix your system using the full version of the bogus tool, this malicious application is not a trustworthy program. It cannot provide you with effective security services.

Windows Warding System cannot protect your system from computer infections and attackers. This fake AV program is a part of the Rogue.FakeVimes family. All the other members of this rogueware family are reported to be malicious creations of cyber criminals. They are aimed at entering into computers and infecting them. Just as all the other members of this malicious family Windows Warding System is transferred to computers in two ways.

The first of them is through the use of malicious web sites. They have the ability to detect and exploit security holes in programs running on targeted computers. Using these vulnerabilities, Windows Warding System is transferred to targeted machines without the knowledge of their users. Furthermore, Windows Warding System does not need to ask for permission to enter the system.

The other way of getting inside machines is via fake online scanners. People are beguiled into thinking they need to download Windows Warding System to fix their computers and remove infected files. If a person is tricked into downloading Windows Warding System, this fraudulent intruder infects his computer.

Then, Windows Warding System is configured to launch itself on system start up. Windows Warding System displays annoying messages. They warn the user of the infected PC about serious system errors and problem. The owner of the computer is alarmed that his passwords are targeted by a hidden IP address. Moreover, there is an unauthorized attempt to modify his registry entries.

The problems reported are the following:

Warning
Firewall has blocked a program from accessing the Internet
C:\program files\internet explorer\iexplore.exe
is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server.

Warning! Identity theft attempt Detected
Hidden connection IP: 58.82.12.124
Target: Your passwords for sites

Error
Attempt to modify registry key entries detected. Registry entry analysis is recommended.

To scare people into thinking they need to buy the full version of Windows Warding System, the fake tool starts a fake system scan. The final results of the scan show many infected files. Windows Warding System tells the user to remove these files immediately. However, it turns out that the only way to delete the detected threats is to buy and use the registered version of Windows Warding System.

Do not be tricked and remove Windows Warding System as soon as possible. It is a scam tool aimed at taking your money.

Windows Warding System Manual Removal Instructions:

Stop These Windows Warding System Processes:
(Learn how to do this)
Protector-{3 characters}.exe
Find and Delete These Windows Warding System Files:
(Learn how to do this)
%AppData%\NPSWF32.dll
%AppData%\Protector-{3 characters}.exe
%AppData%\result.db
%CommonStartMenu%\Programs\Windows Managing System.lnk
%Desktop%\Windows Managing System.lnk
Remove These Windows Warding System Registry Values:
(Learn how to do this)
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Policies\\System “DisableRegedit” = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Policies\\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Policies\\System “DisableTaskMgr” = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Run “Inspector”
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Settings “net” = “2012-3-11_2?
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Settings “UID” = “origkboryd”
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\\InternetExplorer\\Main\\FeatureControl\\FEATURE_ERROR_PAGE_BYPASS_ZONE_CHECK_FOR_HTTPS_KB954312
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\atcon.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\bipcp.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\ecengine.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\infwin.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\msconfig
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\PavFnSvr.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\sahagent.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\titaninxp.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\wsbgate.exe

Free Antispyware Scan
Filed Under: Spyware Removal Tagged With: , , , , ,

Remove Windows Efficiency Reservoir

Windows Efficiency Reservoir is known to be targeting computers and infecting them. This is a fake security application. It pretends to be a reliable anti-spyware application. To deceive PC users into thinking it can detect system threats and report about them, Windows Efficiency Reservoir uses the same layout as legitimate security applications. Moreover, Windows Efficiency Reservoir imitates their actions and the services they provide.

Figure 1. Windows Efficiency Reservoir screenshot

Windows Efficiency Reservoir is reported to be a member of the Rogue.FakeVimes family. Windows Efficiency Reservoir uses the same tricks as all the other members of this malicious family. Moreover, all the members of this rogueware family are created by hackers. These programs are malicious applications aimed at entering into targeted computers. Other members of this malicious family are known to be Windows Care Taker and Windows Custodian Utility.

To sneak into targeted computers these malicious programs use different techniques. Windows Efficiency Reservoir is spread via malicious web sites which use vulnerabilities in programs running on targeted computers. Windows Efficiency Reservoir sneaks into a targeted computer unnoticed. It does not ask the user for a permission to enter into his computer. The user is even not alarmed that a malicious program is entering into his machine.

Windows Efficiency Reservoir is also spread via fake online scanners. PC users are taken to malicious web pages that promote fake online scanners. These scanners pretend to provide reliable results. When a person scans his system using the fake automated tool, the person is scared into thinking his computer is compromised. Then, the user is told to download Windows Efficiency Reservoir to fix his machine. However, the user is not alarmed about the malicious nature of this intruder. In this way, Windows Efficiency Reservoir enters into targeted computers without any difficulties.

After this fake security application has gained access to a targeted PC, Windows Efficiency Reservoir modifies Registry entries. The bogus tool is configured to start automatically when Windows is loaded. The next step of Windows Efficiency Reservoir is to make a fake scan of the system. The scan results show many compromised files and the user is told to remove these files immediately. However, Windows Efficiency Reservoir wants to scare you into thinking you can remove the specified files only using its full version.

Windows Efficiency Reservoir also displays fake warnings. They alarm the user about many system errors that need to be fixed immediately. Otherwise, the system may crash. The messages report about the following problems:

Warning
Firewall has blocked a program from accessing the Internet
C:\program files\internet explorer\iexplore.exe
is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server.

Error
System data security is at risk.
To prevent potential PC errors, run a full system scan.

Warning! Identity theft attempt Detected
Hidden connection IP: 58.82.12.124
Target: Your passwords for sites

The truth is that Windows Efficiency Reservoir is not a reliable and effective AV program. It is aimed at making you pay for its useless full version. Also, Windows Efficiency Reservoir wants to trick PC users into submitting their financial and personal details. Then, this information will be sent to hackers.

Do not be misled and know that Windows Efficiency Reservoir cannot protect your computer. Remove the attacker immediately. Do not submit your personal or bank account details to his deceitful intruder.

Windows Efficiency Reservoir Manual Removal Instructions:

Stop These Windows Efficiency Reservoir Processes:
(Learn how to do this)
Protector-{3 symbols}.exe
Find and Delete These Windows Efficiency Reservoir Files:
(Learn how to do this)
%AppData%\NPSWF32.dll
%AppData%\Protector-{3 symbols}.exe
%AppData%\result.db
%CommonStartMenu%\Programs\Windows Managing System.lnk
%Desktop%\Windows Managing System.lnk

Remove These Windows Efficiency Reservoir Registry Values:
(Learn how to do this)
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Policies\\System “DisableRegedit” = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Policies\\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Policies\\System “DisableTaskMgr” = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Run “Inspector”
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Settings “net” = “2012-3-11_2?
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Settings “UID” = “origkboryd”
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\\InternetExplorer\\Main\\FeatureControl\\FEATURE_ERROR_PAGE_BYPASS_ZONE_CHECK_FOR_HTTPS_KB954312
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\atcon.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\bipcp.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\ecengine.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\infwin.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\msconfig
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\PavFnSvr.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\sahagent.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\titaninxp.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\wsbgate.exe

Free Antispyware Scan
Filed Under: Spyware Removal Tagged With: , , , , ,

Remove Windows Stability Maximizer

Nowadays, it is of vital importance to use a reliable and effective anti-malware application. This is due to the fact that hackers create malicious attackers that target computers and infect them. There are fake security applications, such as Windows Stability Maximizer, which are aimed at entering into users` computers without being noticed. Then, Windows Stability Maximizer scares the users into thinking there are serious problems with their computers. The one and only aim of Windows Stability Maximizer is to trick PC users into thinking they need to buy the full version of this bogus software to fix their machines.

Figure 1. Windows Stability Maximizer screenshot

To sneak into targeted computers, Windows Stability Maximizer uses malicious tricks. The bogus tool does not alarm the victims that it is a malicious application aimed at taking their money. On the contrary, it presents itself as a genuine security program, which can protect PCs from computer infections. Windows Stability Maximizer belongs to the Rogue.FakeVimes family. All the members of this rogueware family are spread in two ways. Windows Stability Maximizer can sneak via malicious web sites that promote fake online scanners. The malicious web site will tell the user that he needs to download Windows Stability Maximizer to fix his machine. If the user is tricked into downloading Windows Stability Maximizer, his computer will be infected.

Another way of spreading Windows Stability Maximizer is through the use of compromised web sites which exploit vulnerabilities in programs running on targeted PCs. Through the use of vulnerabilities, Windows Stability Maximizer is transferred to targeted machines without the knowledge of their users. Moreover, Windows Stability Maximizer does not need to ask for the user’s approval to root itself deep into the system.

Windows Stability Maximizer sneaks into targeted machines. Then the attacker starts showing annoying messages. They alarm the user about serious system errors. These messages report about an unauthorized keylogger activity. Moreover, Windows Stability Maximizer reports legitimate and reliable applications to be malicious tools that threaten the safety of your PC. The messages will show the following problems:

Warning
Firewall has blocked a program from accessing the Internet
C:\program files\internet explorer\iexplore.exe
is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server.

Error
Keylogger activity detected. System information security is at risk.
It is recommended to activate protection and run a full system scan.

Warning! Identity theft attempt Detected
Hidden connection IP: 58.82.12.124
Target: Your passwords for sites

Windows Stability Maximizer will also make a fake scan of the system. The results of the scan will be frightening. Windows Stability Maximizer will report that there are many infected files on your PC. The fake security program will tell you that you need to remove these files immediately to protect your system from a serious crash. However, you will notice that you are not allowed to remove the files manually. Windows Stability Maximizer will insist that you buy its full version. The user will be taken to the web page of Windows Stability Maximizer where he will be asked to submit his personal and credit card details. This web site provides little information about Windows Stability Maximizer itself.

Do not be tricked and do not pay for this bogus software. Also, do not submit your personal or credit card details to Windows Stability Maximizer. They will be sent to hackers. Remove Windows Stability Maximizer immediately.

Windows Stability Maximizer Manual Removal Instructions:

Stop These Windows Stability Maximizer Processes:
(Learn how to do this)
Inspector-{some letters}.exe
Protector-{some letters}.exe
Find and Delete These Windows Stability Maximizer Files:
(Learn how to do this)
%AppData%\Inspector-{some letters}.exe
%AppData%\Protector-{some letters}.exe
Remove These Windows Stability Maximizer Registry Values:
(Learn how to do this)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ERROR_PAGE_BYPASS_ZONE_CHECK_FOR_HTTPS_KB954312
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegedit” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “ID” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “net” = “2012-2-17_2″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “UID” = “rudbxijemb”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpcc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashDisp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\divx.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mostat.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\platin.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tapinstall.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapsetup3001.exe

Free Antispyware Scan
Filed Under: Spyware Removal Tagged With: , , , , , ,

Remove Windows Trouble Taker

Windows Trouble Taker is a fake anti-virus application which pretends to be a reliable anti-malware program. This deceitful application is not a legitimate security program. It cannot protect your computer from bogus software, which is trying to infect the system.

Despite its reliable name, Windows Trouble Taker is,in fact, a trouble maker. This deceitful creation of cyber criminals is aimed at entering into your computer and taking control over the system. The malicious intruder imitates reliable security services provided by legitimate AV programs. Although it uses the same layout as genuine anti-spyware software, this tool cannot provide the same security services. In fact, Windows Trouble Taker is not able to warn you about computer threats or infected files. On the contrary, this deceitful intruder can make it possible for other deceitful creations of hackers to enter your system and compromise it.

Figure 1. Windows Trouble Taker screenshot

As you can see, Windows Trouble Taker is a harmful attacker, and it is not your friend in protecting your PC from malicious attackers. Windows Trouble Taker is a part of the fake Rogue.FakeVimes family. This is a malicious family, which consists of deceitful applications that are trying to scare PC users into thinking their computers are compromised, and the victims need to buy the full versions of the bogus tools.

The members of this rogueware family are spread in two different ways. Windows Trouble Taker can be transferred to targeted PCs via malicious pages, which promote fake online scanners. These online tools promote the bogus software Windows Trouble Taker and try to trick users into voluntarily downloading this fake security application to their computers.

Another way of getting infected with Windows Trouble Taker is when visiting insecure web sites that can exploit vulnerabilities in programs running on targeted PCs. Using these vulnerabilities Windows Trouble Taker is downloaded to the targeted machine without asking the user for his permission. The victim is not alarmed that Windows Trouble Taker is sneaking into his system.

Then, Windows Trouble Taker installs itself on the infected PC. This fraudulent creation of hackers hijacks the Internet browser and redirects the PC user to compromised web sites. Moreover, Windows Trouble Taker modifies some Registry entries. Also, the fake program makes it impossible for the user to launch the Task Manager.

To mislead PC users into thinking their computers are in danger, Windows Trouble Taker displays fake messages. All of them warn users about serious system errors and threats. The person is alarmed about an identity theft attempt and other serious threats.

Windows Trouble Taker reports about the following problems:

Warning
Firewall has blocked a program from accessing the Internet
C:\program files\internet explorer\iexplore.exe
is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server.

Error
Attempt to modify registry key entries detected. Registry entry analysis is recommended.

Warning! Identity theft attempt Detected
Hidden connection IP: 58.82.12.124
Target: Your passwords for sites

Also, Windows Trouble Taker pretends to scan the system for infected files and malicious attackers. The scan results confirm that there are many compromised files, and they have to be removed immediately. However, it turns out that these files can be removed only using the full version of Windows Trouble Taker.

As you can see, Windows Trouble Taker is the real attacker. This deceitful intruder has to be removed as soon as possible.

Windows Trouble Taker Manual Removal Instructions:

Stop These Windows Trouble Taker Processes:
(Learn how to do this)

Find and Delete These Windows Trouble Taker Files:
(Learn how to do this)

Remove These Windows Trouble Taker Registry Values:
(Learn how to do this)

Free Antispyware Scan
Filed Under: Spyware Removal Tagged With: , , , , , , ,

Security Shield Virus (Removal Instructions)

A new version of the malicious malware Security Shield 2012, which is already well-known by security researchers, is reported to be periodically detected by reliable AV tools. As this rogueware application turns out to be a really threatening intruder, it deserves to be examined in details in order to be able to protect our computers from its attacks. In the past, it was discussed in great detail what this deceitful creation of hackers does. However, the severity of this infection requires us pay special attention to its symptoms and misleading actions again. Due to the fraudulent nature and great risk that this infection poses to your PC and information, you have to remove Security Shield 2012 immediately.

Figure 1. Security Shield 2012 screenshot

Security Shield 2012 is spread via infected web links. These links promote also other malicious tools created by hacker and aimed at infecting your computer. You have to be aware that Security Shield 2012 is a fake security program and although it claims to be a legitimate AV tool, it is not. On the contrary, it is a scam program developed by cyber criminals and aimed at taking your money and stealing your information. Because of this, if you see Security Shield 2012, do not be scared and ignore all the deceitful scan results and warnings telling you about serious infections and problems detected on your computer. Remove Security Shield 2012 without delay.

Security Shield 2012 wants to mislead you into believing your PC is infected with various malicious intruders such as rogueware applications, worms, spyware, malware. All of these threats are also confirmed by the fake scan made by Security Shield 2012. This scan mimics a reliable and effective check of the system. This scan will be launched every time you start your PC without asking for your approval or permission.

No matter if you speak German, English, Spanish, Italian or French, you may see Security Shield 2012 in your native language, trying to trick you into buying its full version. For example, if you live in France, it is much likely that Security Shield 2012 will present itself in French. However, regardless of the language in which this fake security application is shown, it is a very harmful attacker and you have to remove Security Shield 2012 as soon as you notice its presence.

If you are a victim of this deceitful attacker, it will annoy you with its fake security warnings and alerts that notify you about serious system errors and threats. These messages will pop up again and again and thus bother your work process. These are some of the scary messages displayed by Security Shield 2012:

Security Shield 2012 Warning
Spyware.IEMonster process is found. This is virus that is trying to send your passwords from Internet browser (Explorer, Mozilla Firefox, Outlook & others) for the third-parties.
Click here to protect your data with Security Shield 2012.

Security Shield 2012 Warning
Security Shield 2012 has found viruses at your system.
We highly recommended to get license for Security Shield 2012 to remove harmful software now.

Security Shield 2012 Warning
Your computer is under the infections threat. Turn on instantshield protection to safe your data and prevent internet attacks for your credit card information.
Select this to turn instantshield on.

Security Shield 2012 is aimed at misleading you into replacing your legitimate and reliable AV tool with this bogus software. Do not be tricked into thinking Security Shield 2012 can protect your PC from rogueware programs. On the contrary, this deceitful creation of hackers makes it even easier for hackers to gain access to your system and steal your personal and financial information. Moreover, if you do not remove Security Shield 2012 in a timely manner, this intruder will take your money.

Security Shield Manual Removal Instructions:

Stop These Security Shield Processes:
(Learn how to do this)
{random_name}.exe
Find and Delete These Security Shield Files:
(Learn how to do this)
%UserProfile%\Start Menu\Programs\SecurityShield 2012.lnk
%AppData%\Microsoft\Internet Explorer\Quick Launch\SecurityShield 2012.lnk
%AppData%\SecurityShield 2012
%AppData%\SecurityShield 2012\IcoActivate.ico
%StartMenu\%Programs\SecurityShield 2012\How to Activate SecurityShield 2012.lnk
%StartMenu\%Programs\SecurityShield 2012\SecurityShield 2012.lnk
%StartMenu%\ProgramsSecurityShield 2012\Help SecurityShield 2012.lnk
%StartMenu\%Programs\SecurityShield 2012
%StartMenu\%Programs\SecurityShield 2012
Remove These Security Shield Registry Values:
(Learn how to do this)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[RANDOM CHARACTERS]”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “SecurityShield 2012″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\SecurityShield 2012
HKEY_CURRENT_USER\Software\SecurityShield 2012

Free Antispyware Scan
Filed Under: Spyware Removal Tagged With: , , , , , , ,

Remove PC Clean Pro

There is another malicious application which claims to be a reliable and effective AV tool, but, in fact, has nothing to do with genuine security applications. PC Clean Pro is reported to be a deceitful tool created by cyber criminals to mislead unsuspecting victims into thinking they need the services of this attacker. PC users are tricked into believing PC Clean Pro is a reliable program which can provide them with information about the state of their machines and any infected files. PC Clean Pro makes everything possible to make more and more PC owners think their computers are infected with a severe computer virus, and users need to buy the bogus application to remove the attacker. However, the truth is that PC Clean Pro is just another scam application which is aimed at taking your money. PC Clean Pro is not able to detect real computer threats. Not only that, but PC users who see this intruder on their machines have to know that it will put their personal and financial information in real danger.

Figure 1. PC Clean Pro fake screen

Security specialists say that this malicious infection is also known as PC CleanerPro and PCCleanerPro. The attacker uses vulnerabilities in running programs to penetrate into a targeted machine. Another way of gaining access to a PC is through the use of fake online scans. People are offered a free system scan. However, the final results of the scan claim that there are many compromised files on the PC and to solve the problems, the user has to download some file. Nevertheless, the user does not suspect that he will become the next victim of PC Clean Pro if the file is downloaded. This is how PC Clean Pro is spread and enters targeted system.

After PC Clean Pro has penetrated into a PC, it is ready to start its fraudulent plan. PC Clean Pro fake AV tool will start displaying annoying messages. All of them will warn the user about numerous system problems and errors. The intruder will warn the user that these system errors may have fatal consequences and lead to a serious system crash. The messages will inform about the following problems:

PC Clean Pro has detected 487 unwanted and compromising items on your computer.
These items are very likely to jeopardize your privacy. You must clean your PC now.

Another trick used by PC Clean Pro is the fake system scan it makes. PC Clean Pro will pretend to scan your system and then it will let you know about many compromised files. PC Clean Pro will try to convince you that you have to remove the files immediately. Otherwise, you may lose the information saved on your PC. The truth is that even if you try to delete the files, you will not be allowed to do that. PC Clean Pro will claim that the only way to remove the infected files is with the help of the full version of the fake tool. PC Clean Pro wants to make you pay for its services and scare you into submitting your personal and financial data to its creators.

PC Clean Pro will take you to its web page, and it will try to make you pay for its useless services. However, if you have a closer look at the site, you will see that it does not provide almost any information about the creators of the program and the services it provides. There is a detailed billing form, but there are no contact details. The page is unknown and it cannot be classified as a reliable and safe site.

In fact, none of the messages displayed by PC Clean Pro show reliable information. PC Clean Pro pretends to have detected many infected files, but the truth is that these files are created by the malicious attacker itself. Do not disclose your personal or bank account details to the attacker and make sure that you remove the program as soon as possible.

PC Clean Pro Manual Removal Instructions:

Stop These PC Clean Pro Processes:
(Learn how to do this)
PCCleanPro_Installer_eng[1].exe
PC Clean Pro.exe
Find and Delete These PC Clean Pro Files:
(Learn how to do this)
%AppData%\PC Clean Pro
Uninstall PC Clean Pro.lnk
PCCleanPro_Installer_eng[1].exe
PC Clean Pro.exe
pcprosd.dll
Start PC Clean Pro.lnk
%AllUsersProfile%\Start Menu\Programs\PC Clean Pro
PC Clean Pro.lnk
%ProgramFiles%\PC Clean Pro
Register PC Clean Pro.lnk
Remove These PC Clean Pro Registry Values:
(Learn how to do this)
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run PCCleanPro
HKEY_CLASSES_ROOT\allfilesystemobjects\shellex\contextmenuhandlers\pcprosd.dll
HKEY_CLASSES_ROOT\clsid\{5c5de06d-cf99-47d6-9bab-61001fee4721}\
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run pc clean pro
HKEY_CURRENT_USER\software\pc clean pro
{5c5de06d-cf99-47d6-9bab-61001fee4721}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\pc clean pro
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\pc clean pro displayname
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\pc clean pro uninstallstring
HKEY_LOCAL_MACHINE\software\pc clean pro
HKEY_LOCAL_MACHINE\software\pc clean pro info
HKEY_LOCAL_MACHINE\software\pc clean pro pstatus
HKEY_LOCAL_MACHINE\software\pc clean pro version
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run pc clean pro

Free Antispyware Scan
Filed Under: Spyware Removal Tagged With: , ,
« Older Posts
Newer Posts »