Windows Antivirus System Removal Guide

Windows Antivirus System is a fake antivirus program that perform like a real antivirus such as Kaspersky Anti-Virus, AVG Free Antivirus, Avira AntiVir etc. Windows Antivirus System is distributed through the same fake Microsoft Security Essentials Alert trojan that many other rogue anti-spyware programs are propagated through, allowing Windows Antivirus System a stealthy entry. Windows Antivirus System infects the computer when the user accidentally downloads a trojan from a website which provide online videos. Windows Antivirus System include browser hijacks, dysfunctional security applications and unauthorized changes to system settings. Windows Antivirus System will start automatically when Windows boot. Then, Windows Antivirus System will scan the computer and produce fake scan results and display many fake alerts to urge the user to purchase the full version of Windows Antivirus System in order to remove the detected malwares. Full version or unregistered version of Windows Antivirus System can do nothing.

Windows Antivirus System can be removed by stopping the processes and removing the files by using Emsisoft HiJackFree. Then the user should remove the registry entries added or modified by Windows Antivirus System shown in the removal guide below. All files related to Windows Antivirus System must be deleted.

Windows Antivirus System should be removed immediately!

Windows Antivirus System Removal Guide
Kill Process
(How to kill a process effectively?)
[random].exe

Delete Registry
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM]"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[RANDOM]"
"Shell"="'C:\Documents and Settings\{username}\Application Data\Microsoft\bmemsl.exe'"
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings] "WarnOnHTTPSToHTTPRedirect"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe] "Debugger"="'svchost.exe'"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe] "Debugger"="'svchost.exe'"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe] "Debugger"="'svchost.exe'"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe] "Debugger"="'svchost.exe'"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe] "Debugger"="'svchost.exe'"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe] "Debugger"="'svchost.exe'"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe] "Debugger"="'svchost.exe'"
"Debugger"="'svchost.exe'"
"ConsentPromptBehaviorAdmin"="0" "ConsentPromptBehaviorUser"="0" "EnableLUA"="0"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] "WarnOnHTTPSToHTTPRedirect"="0"


Remove Folders and Files
%UserProfile%\Application Data\Microsoft\[random].exe
%Temp%\[random]