Saturday, June 23, 2012

Remove Windows Control Series that appears in skins of antivirus and turns to be a virus

Windows Control Series enters computer systems hiding its malicious payload under the appearance of a security solution. The program thus has been defined as a counterfeited antivirus.
It is installed into special folder, which items are attributed as hidden . The attribute is assigned to prevent user from accessing the malware’s components.
The items get reflected in system registry as the installation provides for a set of changes, including in the section of the Registry responsible for setting the order for self-launching programs. Where security settings so provide, the malware installation ads a log to the Registry that ensures its popups are shown immediately at the beginning of Windows session.
Click here to start free scan and get rid of Windows Control Series popups contaminating your operating system. Please note the malware may be programmed to alter spans of idleness and intensive alerting, hence removal of Windows Control Series is required, even if the rogue currently remains silent.

Windows Control Series screenshot:


Windows Advanced Toolkit activation code (helps removal):

0W000-000B0-00T00-E0020
NOTE: "Activating" Windows Control Series is not enough. You need to remove related trojans \ rootkits using reliable malware removal solution.
It is important to fix Windows registry after Windows Control Series malware removal using safe registry cleaner software.

Windows Control Series manual removal guide:
Delete infected files:
%AppData%\NPSWF32.dll
%AppData%\Protector-[random 3 characters].exe
%AppData%\Protector-[random 4 characters].exe
%AppData%\W34r34mt5h21ef.dat
%AppData%\result.db
%CommonStartMenu%\Programs\Windows Control Series.lnk
%Desktop%\Windows Control Series.lnk
Delete Windows Control Series registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegedit” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorAdmin” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorUser” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “EnableLUA” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “net” = “2012-4-27_2″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “UID” = “tovvhgxtud”
HKEY_CURRENT_USER\Software\ASProtect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\[random].exe

No comments: