Wednesday, June 6, 2012

Remove Windows Maintenance Suite self-announced antivirus that has proven to be worse than many viruses

Windows Maintenance Suite spoofs unsophisticated users. Few users are inclined to trust programs of this sort though, but nearly all of them are badly irritated with its popups.
The popups by the program pretend to disclose current threats on the PC it has managed to get installed on. Some of them look like a full-featured reflection of memory scan. The only problem there is no scan in the actuality.
Others inform on programs that have allegedly caused issues on which the program surprisingly timely notify user. For example, the sneaky parasite has been observed to terminate web-browser, but, of course, it instantly provides a deceptive explanation referring to random trojan or system error.
Removal of Windows Maintenance Suite thus goes beyond the elimination of informational attack. Let free scanner inspect your PC for actual viruses and get rid of Windows Maintenance Suite as yet another rogue antispyware that plays tricks inherent to viruses.

Windows Maintenance Suite screenshots:



Windows Maintenance Suite activation code (helps removal):
0W000-000B0-00T00-E0020
NOTE: "Activating" Windows Maintenance Suite  is not enough. You need to remove related trojans \ rootkits using reliable malware removal solution.
It is important to fix Windows registry after Windows Maintenance Suite malware removal using safe registry cleaner software.

Windows Maintenance Suite manual removal guide:
Delete infected files:
%AppData%\NPSWF32.dll
%AppData%\Protector-[random 3 characters].exe
%AppData%\Protector-[random 4 characters].exe
%AppData%\W34r34mt5h21ef.dat
%AppData%\result.db
%CommonStartMenu%\Programs\Windows Maintenance Suite.lnk
%Desktop%\Windows Maintenance Suite.lnk
Delete Windows Maintenance Suite registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegedit” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorAdmin” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorUser” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “EnableLUA” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “net” = “2012-4-27_2″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “UID” = “tovvhgxtud”
HKEY_CURRENT_USER\Software\ASProtect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\[random].exe

No comments: