Friday, July 6, 2012

Remove Windows Expert Series phony security tool as another guru of fake scan

Windows Expert Series informs users on inexistent cases of malware detection. Threats it refers to might exist, but the problem is the declared infections have not been actually observed.
Removal of Windows Expert Series is recommended as an extermination of another fake security solution.
The program is distributed via worldwide web through two categories of websites. One category comprises hidden droppers of the malware while another is meant to refer to websites that pretend to be remote examiners of computer memory, online scanners. Under the pretext of finding exceeding number of parasites on the PC allegedly undergoing the online inspection the fake scan website prompt its visitor to download and install the program for further memory inspection and cleanup.
Click here to trigger free memory inspection and get rid of Windows Expert Series as inevitable part of computer disinfection. 

Windows Expert Series screenshot:


Windows Expert Series activation code (helps removal):


0W000-000B0-00T00-E0020
NOTE: "Activating" Windows Expert Series is not enough. You need to remove related trojans \ rootkits using reliable malware removal solution.
It is important to fix Windows registry after Windows Expert Series malware removal using safe registry cleaner software.
 
Windows Expert Series manual removal guide:
Delete infected files:
%AppData%\NPSWF32.dll
%AppData%\Protector-[random 3 characters].exe
%AppData%\Protector-[random 4 characters].exe
%AppData%\W34r34mt5h21ef.dat
%AppData%\result.db
%CommonStartMenu%\Programs\Windows Expert Series.lnk
%Desktop%\Windows Expert Series.lnk
Delete Windows Expert Series registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegedit” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorAdmin” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorUser” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “EnableLUA” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “net” = “2012-4-27_2″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “UID” = “tovvhgxtud”
HKEY_CURRENT_USER\Software\ASProtect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\[random].exe

No comments: