Tuesday, March 15, 2011

Remove Windows Remedy scareware

Windows Remedy  is yet another program that pretends to be a troubleshooter promptly responding to computer threats.  Just like other tricky troubleshooters of this kind, it makes troubles itself. However, even if the software would like to fix the problem, it would not be able to fulfill its intention: get rid of Windows Remedy as the program includes self-advertising and destructive facilities only and no tool to recover the damage it does. This goes without saying that other threats and damages are out of scope of so called protection provided by the badware.
Click here to start in-depth system examination to ensure removal of Windows Remedy, as well as extermination of other threats found.


Windows Remedy screenshot:



Windows Remedy removal tool:



Windows Remedy manual removal guide:
Delete Windows Remedy files:
%UserProfile%\Application Data\.exe
Delete Windows Remedy registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore "DisableSR " = '1'

No comments: