Tuesday, June 5, 2012

Remove Windows Safety Wizard an avoid cleaning the intentional false positives even if you know the path

Windows Safety Wizard is a program developed by black hats to serve as a sort of blackmailing device. Its main mission is to generate a constant flow of popups posed as security alerts. The alerts may point to existing locations and files on your PC.
Warning! Please do not try checking whether the infections specified by the malware are present in the locations it has mentioned and are actually malicious performing their manual deletion. If a path is indicated, it most likely exposes absolutely harmless and probably precious entry; deletion of such item may badly corrupt your PC.
Whether the adware annoys with popups containing location info for threats reported or the popups simply mention virus names without providing location details, click here to get rid of Windows Safety Wizard . The suggested method is a free scanner that serves both the removal of Windows Safety Wizard and detection and extermination of true security threats.

Windows Safety Wizard snapshot:



Windows Safety Wizard activation code (helps removal):
0W000-000B0-00T00-E0020
NOTE: "Activating" Windows Safety Wizard is not enough. You need to remove related trojans \ rootkits using reliable malware removal solution.
It is important to fix Windows registry after Windows Safety Wizard malware removal using safe registry cleaner software.

Windows Safety Wizard manual removal guide:

Delete infected files:
%AppData%\NPSWF32.dll
%AppData%\Protector-[random 3 characters].exe
%AppData%\Protector-[random 4 characters].exe
%AppData%\W34r34mt5h21ef.dat
%AppData%\result.db
%CommonStartMenu%\Programs\Windows Safety Wizard.lnk
%Desktop%\Windows Safety Wizardl.lnk
Delete Windows Safety Wizard registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegedit” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorAdmin” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorUser” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “EnableLUA” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “net” = “2012-4-27_2″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “UID” = “tovvhgxtud”
HKEY_CURRENT_USER\Software\ASProtect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\[random].exe

No comments: