Monday, April 9, 2012

Removal of Windows Cleaning Tools malware to eliminate misleading security reports and prevent various damages induced by the rogue

Windows Cleaning Tools harms and disorders computers unfortunate to get its copy installed. On this background, it runs a fake scan, which is a scary showcase played for various purposes. Besides, there are plenty of alerts, some titled as though generated by operating system. Remarkably, the sneaky program fails to correctly identify the version of computer system which name it includes into its popups. For instance, in Windows XP the unskilled counterfeit may issue reports titled Windows Vista or Win 7, and vice versa.
Get rid of Windows Cleaning Tools as the rogue is a total ignorant in detecting viruses having no skill to at least identify operating system it has compromised.
As your current antivirus has failed to prevent the malware introduction or is missing, free scanner available here is a reliable tool for you to remove Windows Cleaning Tools adware.

Windows Cleaning Tools screenshot:


Windows Cleaning Tools manual removal guide:
 
Delete infected files:
%StartMenu%\Programs\Windows Cleaning Tools.lnk
%AppData%\NPSWF32.dll
%AppData%\Protector-{random 3 chars}.exe
%AppData%\result.db
%Desktop%\Windows Cleaning Tools.lnk
Delete Windows Cleaning Tools registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegedit” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “ID” = 4
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “net” = 2012-2-20_1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{random}.exe

No comments: