Monday, June 6, 2011

Windows Protection Alarm Removal Guide

Windows Protection Alarm Removal Guide
Windows Protection Alarm is a fake antivirus program Windows Protection Alarm cannot detect and remove any malware, trojan or virus. Windows Protection Alarm can just provide fake alert (e.g. There are many files are infected by malwares). Once Windows Protection Alarm is installed in the computer, it will definitely do a fake scan in the computer and will state that the computer is in danger repeatedly so that to urge the user to purchase the full version of Windows Protection Alarm which cannot remove any kind of errors found in the system.

Windows Protection Alarm can be removed by stopping all the processes with random name and name which contain "Windows Protection Alarm". Then the user has to remove the files of the processes. Finally, the registry settings have to be restored by removing the registry keys stated below.

Windows Protection Alarm should be removed immediately!

Windows Protection Alarm Removal Guide
Kill Process
(How to kill a process effectively?)
[random].exe

Delete Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore "DisableSR " = '1'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = '0'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe "Debugger" = 'svchost.exe'

Remove Folders and Files
%UserProfile%\Application Data\Microsoft\[random].exe

No comments:

Post a Comment