Thursday, June 9, 2011

Windows Work Checker Removal Guide

Windows Work Checker Removal Guide
Windows Work Checker is a program that is used to cheat the money of people by showing error message in the computer such as the computer has been infected by malwares. Windows Work Checker adds a registry entries to make itself to start automatically when Windows boot. After that, Windows Work Checker will do fake scan on the computer and then issue fake warning by showing pop ups to tell the the user that the computer has been infected by malwares which can only be removed by the full version of Windows Work Checker. Thus, the user is urged to purchase it. Do not believe any report given by Windows Work Checker even the warning look so real. In fact, Windows Work Checker cannot detect and remove any error or malware on computer.

Windows Work Checker can be uninstalled by by stopping all processes with random name and also kill its files. Then, all registry entries added and modified by Windows Work Checker must be cleared by using Windows Registry Editor.

Windows Work Checker should be removed immediately!


Windows Work Checker Removal Guide
Kill Process
(How to kill a process effectively?)
[random].exe
Windows Work Checker.exe

Delete Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[random]"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[random]"
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell "%AppData%\Microsoft\[random].exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger" = 'svchost.exe'

Remove Folders and Files
%AppData%\Microsoft\[random].exe
%AppData%\Microsoft\Windows Work Checker.exe

No comments:

Post a Comment