Saturday, August 4, 2012

Windows Ultimate Safeguard description and removal

Windows Ultimate Safeguard is the latest fake security software that may be installed through system security holes or with the help of rootkit or trojan horses. It may redirect your searches to malicious web-sites, generate fake security alerts and misleading warnings. Remember that Windows Ultimate Safeguard have nothing common with real AV product, actually it's a virus. Download free-scan tool to eliminate this malware as soon as possible.




Windows Ultimate Safeguard activation code (helps removal):

0W000-000B0-00T00-E0020
NOTE: "Activating" Windows Ultimate Safeguard is not enough. You need to remove related trojans \ rootkits using reliable malware removal solution.
It is important to fix Windows registry after malware removal using safe registry cleaner software.
Windows Ultimate Safeguard manual removal guide:

Delete infected files:
%AppData%\NPSWF32.dll
%AppData%\Protector-[random 3 characters].exe
%AppData%\Protector-[random 4 characters].exe
%AppData%\W34r34mt5h21ef.dat
%AppData%\result.db
%CommonStartMenu%\Programs\Windows Ultimate Safeguard.lnk
%Desktop%\Windows Ultimate Safeguard.lnk
Delete Windows Ultimate Safeguard registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegedit” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorAdmin” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorUser” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “EnableLUA” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “net” = “2012-4-27_2″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “UID” = “tovvhgxtud”
HKEY_CURRENT_USER\Software\ASProtect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\[random].exe

No comments: