Friday, May 11, 2012

Windows Abnormality Checker uninstall guide

Windows Abnormality Checker is the installation name for infection classified as a fake antivirus. Once installed, it provides a graphic user’s interface posed as Windows Pro Solutions, or similar name is utilized.
In many instances, the fake antivirus successfully bypasses installation routines so that Win users, even if they do not authorize the program to install itself, may find it running on their computers.
The aim of its installation is that users buy a subscription to the fake antivirus using online purchase order form. In addition to that the purchase will be a waste of money, it will also put your financial credentials at risk. In the meantime, Windows Abnormality Checker removal is still needed, even if it is activated.
If you have been enticed to activate it, click here to get rid of Windows Abnormality Checker. If you filled in credit card information into the form provided by the hackers, it is strongly recommended to ensure your banking data is not compromised contacting relevant authority.

Windows Abnormality Checker snapshot:



Windows Abnormality Checker activation code (helps removal):
0W000-000B0-00T00-E0020
NOTE: "Activating" Windows Abnormality Checker is not enough. You need to remove related trojans \ rootkits using reliable malware removal solution.
It is important to fix Windows registry after Windows Abnormality Checker malware removal using safe registry cleaner software.
 
Windows Abnormality Checker manual removal guide:


Delete infected files:
%AppData%\NPSWF32.dll
%AppData%\Protector-[random 3 characters].exe
%AppData%\Protector-[random 4 characters].exe
%AppData%\W34r34mt5h21ef.dat
%AppData%\result.db
%CommonStartMenu%\Programs\Windows Abnormality Checker.lnk
%Desktop%\Windows Abnormality Checker.lnk
Delete Windows Abnormality Checker registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegedit” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorAdmin” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorUser” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “EnableLUA” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “net” = “2012-4-27_2″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “UID” = “tovvhgxtud”
HKEY_CURRENT_USER\Software\ASProtect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\[random].exe

No comments: