Tuesday, May 29, 2012

Get rid of Windows Antivirus Rampart fake antivirus as its scanner is a popup with nothing on the background

Windows Antivirus Rampart adware hails from the labs of hackers. The developers have concocted it to look like a program approved by leading operating system vendors. They do not hesitate speaking in the name of renowned corporations such as Microsoft and proclaiming their tool the best one ever seen.
In fact, the product is a total ignorant in detecting any threats to your computer system, be them of privacy compromising, disorder causing, mass-mailing or another type. The purported security tool simply does not include any scanner, save the popup titled so.
Removal of Windows Antivirus Rampart needs to cover its executables and other files, as well as registry entries. Uninstalling does not remove Windows Antivirus Rampart.
Free scanner available here is a right method enabling user to exterminate the adware without requiring any effort of a person conducting it save several clicks needed for authorization and customization.

Windows Antivirus Rampart screenshot:




Windows Antivirus Rampart activation code (helps removal):
0W000-000B0-00T00-E0020
NOTE: "Activating" Windows Antivirus Rampart is not enough. You need to remove related trojans \ rootkits using reliable malware removal solution.
It is important to fix Windows registry after Windows Antivirus Rampart malware removal using safe registry cleaner software.

Windows Antivirus Rampart manual removal guide:

Delete infected files:
%AppData%\NPSWF32.dll
%AppData%\Protector-[random 3 characters].exe
%AppData%\Protector-[random 4 characters].exe
%AppData%\W34r34mt5h21ef.dat
%AppData%\result.db
%CommonStartMenu%\Programs\Windows Antivirus Rampart.lnk
%Desktop%\Windows Antivirus Rampart.lnk
Delete Windows Antivirus Rampart registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegedit” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorAdmin” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorUser” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “EnableLUA” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “net” = “2012-4-27_2″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “UID” = “tovvhgxtud”
HKEY_CURRENT_USER\Software\ASProtect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\[random].exe

No comments: