Monday, February 21, 2011

Windows Safety Guarantee Removal Guide

Windows Safety Guarantee Removal Guide
Windows Safety Guarantee is a fake antivirus program that cannot detect and remove any kind of virus, malware or trojan. However, Windows Safety Guarantee pretends to be a legitimate antivirus which can protect computers from the attack malwares. Once Windows Safety Guarantee is installed on the computer, it will start automatically when Windows boot. Then Windows Safety Guarantee will do a fake scan on the computer and will definitely scare the user with pop ups which shows that the computer has been infected by a lot of malwares. Windows Safety Guarantee will repeatedly shows the pop ups to urge the user to purchase the full version of Windows Safety Guarantee so that to remove all the threats. However, Windows Safety Guarantee cannot detect and remove any kind of virus, malware and trojan.

Windows Safety Guarantee can be removed by stopping the processes and removing the files by using Emsisoft HiJackFree. Then the user should remove the registry entries added or modified by Windows Safety Guarantee shown in the removal guide below. All files related to Windows Safety Guarantee must be deleted.

Windows Safety Guarantee should be removed immediately!

Windows Safety Guarantee Removal Guide
Kill Process
(How to kill a process effectively?)
%AppData%\[random].exe
%AppData%\svchost.exe

Delete Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore "DisableSR " = '1'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe "Debugger" = 'svchost.exe'

Remove Folders and Files
%AppData%\[random].exe
%AppData%\svchost.exe

No comments:

Post a Comment