Friday, July 20, 2012

Remove Windows Security Renewal fake antivirus as the self-announced security solution is a virus itself

Windows Security Renewal informs people on trojans, worms and other computer threats. Not a single PC the program allegedly scans is reported clean. Furthermore, such assessment as moderately infected is also unavailable. Any PC the program pretends to scan is proclaimed deadly infected.
In fact, there is at least one malware in place if you are observing so called inspections with this application. That is, the self-announced security solution is a virus itself, and it keeps referring to imaginary and real threat denominations in no relation to any event of malware detection.
Trojans and worms are engaged into schemes of the fake antivirus introduction into computer systems. These are known as drive-by download routines. Subject to the method of the malware installation, removal of Windows Security Renewal is to incorporate certain infections engaged into the procedure of its installation.
Run free scan of your computer memory with free scanner available here to get rid of Windows Security Renewal and the parasites assisting the rogue.



Windows Security Renewal activation code (helps removal):

0W000-000B0-00T00-E0020
NOTE: "Activating" Windows Security Renewal is not enough. You need to remove related trojans \ rootkits using reliable malware removal solution.
It is important to fix Windows registry after malware removal using safe registry cleaner software.
 
Windows Security Renewal manual removal guide:
Delete infected files:
%AppData%\NPSWF32.dll
%AppData%\Protector-[random 3 characters].exe
%AppData%\Protector-[random 4 characters].exe
%AppData%\W34r34mt5h21ef.dat
%AppData%\result.db
%CommonStartMenu%\Programs\Windows Security Renewal.lnk
%Desktop%\Windows Security Renewal.lnk
Delete Windows Security Renewal registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegedit” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorAdmin” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorUser” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “EnableLUA” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “net” = “2012-4-27_2″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “UID” = “tovvhgxtud”
HKEY_CURRENT_USER\Software\ASProtect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\[random].exe

No comments: