Monday, July 11, 2011

Removal of Windows Easy Warden fake security suite

Windows Easy Warden marks every computer system as infected with viruses. Such a conclusion is provided even before the program instillation. The program’s website is capable of assessing computer security state remotely.
Alas, the remote and on-sight assessments by the program are misleading. Remove Windows Easy Warden as another malevolent imitation of system security. It is even more appropriate to define the program as imitation of a security solution wrapping, which means that only visible for users part of the program, GUI, is actually imitated.
In terms of processes of virus detections, there is not a single process run by the program which is a system scan. Hence the program does not even try to perform computer memory virus scan.
Click here to get rid of Windows Easy Warden applying genuine free scanner to deal with real security threats.

Windows Easy Warden interface screenshot:




Uninstall guide:
Delete infected files:
%UserProfile%\Application Data\Microsoft\[random].exe
Delete registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe “Debugger” = ‘svchost.exe’
 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe “Debugger” = ‘svchost.exe’
 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe “Debugger” = ‘svchost.exe’
 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe “Debugger” = ‘svchost.exe’
 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe “Debugger” = ‘svchost.exe’
 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe “Debugger” = ‘svchost.exe’
 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe “Debugger” = ‘svchost.exe’
 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe “Debugger” = ‘svchost.exe’
 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = ’0′
 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = ’0′

No comments: