remove-malware.net » Fake Security Programs http://remove-malware.net The ultimate resource for malware removal and virus protection Tue, 07 Feb 2012 18:40:37 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 Remove Win32/WinMaximizer to cure your PC and stop the pop-ups http://remove-malware.net/remove-win32winmaximizer-to-cure-your-pc-and-stop-the-pop-ups/ http://remove-malware.net/remove-win32winmaximizer-to-cure-your-pc-and-stop-the-pop-ups/#comments Tue, 07 Feb 2012 18:40:37 +0000 admin http://remove-malware.net/?p=9285 Malware Description:
Win32/WinMaximizer (alias: WinMaximizer or Win Maximizer) is an application to avoid because it denotes malicious software. The name stands for a family of counterfeit system tune-up programs rotated with the intent to gain profit by means of tricking PC users. Therefore, if your security software is reporting a threat named Win32/WinMaximizer or similar, you should get busy checking your machine for malicious activity such as trojans and fake antivirus or optimizers. Examine your desktop, system tray and recently installed programs and see if there has appeared anything suspicious that you didn’t install. However, even if you find something of that kind and try to find some deletion options there, you’ll probably fail. That’s because this type of software does not feature user uninstall abilities – due to hackers’ unwillingness to lose advantage of the users infected. Some of the things that might be happening because of Win32/WinMaximizer’s activity are bogus system scans, persistent pop-ups, browser usage problems and overall computer slowdown. These are additional symptoms of the infection and some more stimuli to get rid of it. We made a comprehensive tutorial for you to learn how Win Maximizer problem can be solved.

Malware Type: Fake Security Programs

Threat Level: High

Advice: Immediately remove

Win32/WinMaximizer Free Scanner and Remover: Download Now

Win32/WinMaximizer GUI Screenshot:

Win32/WinMaximizer

How to remove Win32/WinMaximizer manually:
Manual removal of this infection is a feasible objective if you have sufficient expertise in dealing with program files, processes, .dll files and registry entries.

The files to be deleted are listed below:

  • %Windows%\Tasks\WinMaximizer-Administrator-Startup.job
  • %ProgramFiles%\WinMaximizer\WinMaximizer.exe
  • %AllUsersProfile%\Start Menu\Programs\WinMaximizer\WinMaximizer.lnk

The registry entries that need to be removed are as follows:

  • HKEY_CURRENT_USER\Software\WinMaximizer
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{6C4BA010-69C2-46C7-B559-DC513EEB0B5F}_is1

Please be aware that manual removal of Win32/WinMaximizer is a cumbersome process and does not always ensure complete deletion of the malware, due to the fact that some files might be hidden or may get reanimated automatically afterwards. Moreover, manual interference of this kind may cause damage to the system. That’s why we strongly recommend automatic removal Win32/WinMaximizer, which will save your time and enable avoiding any system malfunctions and guarantee the needed result.

Download Win32/WinMaximizer Automatic Remover

]]> http://remove-malware.net/remove-win32winmaximizer-to-cure-your-pc-and-stop-the-pop-ups/feed/ 0 System Check fraudware removal to save you some money and nerves http://remove-malware.net/system-check-fraudware-removal-to-save-you-some-money-and-nerves/ http://remove-malware.net/system-check-fraudware-removal-to-save-you-some-money-and-nerves/#comments Mon, 09 Jan 2012 10:10:01 +0000 admin http://remove-malware.net/?p=9252 Malware Description:
The rogue pc performance optimizer called System Check has been causing computer users a great deal of trouble during the last week or so – since it went live. This invention of the international cyber criminals is both misleading and potentially dangerous for the machine it gets into. As far as the functional scheme is concerned, System Check is in no way original as compared to some of its forerunners such as System Fix, Data Restore and many others. As you can easily discern from our previous posts, even the looks of their GUIs are pretty much the same but for the app’s name of course. If you are surfing the Internet a lot, chances are you fall victim to this scam after clicking something you deemed safe and even useful, without being aware of the downloader trojan embedded into those links or files. Once the trojan jumps over to your computer, it’s all going to take place in no time. This piece of malware creates the preliminary malicious environment for System Check’s trialware to start acting. Those are bad files, devastating Registry keys and unwanted browser add-ons. Such radical modifications will lead to the following symptoms of the virus’ activity: it’s going to keep popping up in the shape of fake scanners, deceitful alert messages etc. All of them are definitely going to tell you that your PC is working at its full capacity and that the system is encountering critical errors with the HDD, RAM memory, data readability and so on. Then, to help you fix these, System Check states you need to get down to repairing measures immediately. However, if you decide to indulge in this you’ll realize that it won’t do without your making a payment for registering this chameleon program. In other words, you are being tricked into purchasing an application you don’t need and which can cause further damage to your OS. To avoid all of this, you need to get rid of System Check scareware without delay.

Malware Type: Fake Security Programs

Threat Level: Critical

Advice: Immediately remove and scan for additional malware

System Check Free Scanner and Remover: Download Now

System Check GUI Screenshot:

System Check

How to remove System Check manually:
Manual removal of System Check is a feasible objective if you have sufficient expertise in dealing with program files, processes, .dll files and registry entries.

The files to be deleted are listed below:

  • %Documents and Settings%\[User Name]\Local Settings\System Check\[random]
  • %Documents and Settings%\[User Name]\Local Settings\System Check\[random].exe
  • %Documents and Settings%\[User Name]\Local Settings\Application Data\~[random]
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\1
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\2
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\3
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\4
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\System Check\
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\System Check\System Check.lnk
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\System Check\Uninstall System Check.lnk
  • %Documents and Settings%\[User Name]\Desktop\System Check.lnk

The registry entries that need to be removed are as follows:

  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘Yes’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop “NoChangingWallPaper” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = ‘/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer “NoDesktop” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random]“
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “Hidden” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “ShowSuperHidden” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU “MRUList”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “DisableTaskMgr” = ’1′

Please be aware that manual removal of System Check is a cumbersome process and does not always ensure complete deletion of the malware, due to the fact that some files might be hidden or may get reanimated automatically afterwards. Moreover, manual interference of this kind may cause damage to the system. That’s why we strongly recommend automatic removal System Check, which will save your time and enable avoiding any system malfunctions and guarantee the needed result.

Download System Check Automatic Remover

]]> http://remove-malware.net/system-check-fraudware-removal-to-save-you-some-money-and-nerves/feed/ 0 Remove Computer Fix malware posing as something else http://remove-malware.net/remove-computer-fix-malware-posing-as-something-else/ http://remove-malware.net/remove-computer-fix-malware-posing-as-something-else/#comments Sun, 20 Nov 2011 16:51:02 +0000 admin http://remove-malware.net/?p=9203 Malware Description:
Computer Fix is a pathetic copy of an average system optimization tool. On the outside, it appears to perform the same old tasks that are inherent to PC performance analysis and improvement utilities. But deep down, it does nil of what it should. Falsity of Computer Fix is a proven thing and calls forth absolutely no doubt in cyber community. Malware watchers state this application’s affiliation with a family of bogus optimizers which has existed for over a year by now. Some of the examples of its former counterparts are System Fix and Data Restore. Predictably, this program follows the same guidelines in terms of what it does when integrated into the host machine. The first signal you should pay attention to is a scan generated by Computer Fix. This scanner is counterfeit and it on most occasions pops up after the next system reboot you make since your workstation got infected with this trojan. The results list you get to see when this pseudo system check is through is definitely not something you can trust. The app says you are in trouble because tons of errors were detected during the scan. For instance, it claims to have spotted critically low hard drive rotational speed, drive C initializing error, badly damaged system files etc. Of course those messages sound alarming but once you realize Computer Fix is rogue software, it all becomes clear – you are simply being scammed by false positives about some imaginary problems you don’t have for real. This is why following this solution’s recommendations is pointless and certainly not an option. A correct algorithm of your action is to complete Computer Fix removal as soon as possible. This junkware does not belong on any Operating System, yours being no exception to this rule.

Malware Type: Fake Security Programs

Threat Level: Critical

Advice: Immediately remove and scan for additional malware

Computer Fix Free Scanner and Remover: Download Now

How to remove Computer Fix manually:
Manual removal of Computer Fix is a feasible objective if you have sufficient expertise in dealing with program files, processes, .dll files and registry entries.

The files to be deleted are listed below:

  • %Documents and Settings%\[User Name]\Local Settings\Application Data\[random]
  • %Documents and Settings%\[User Name]\Local Settings\Application Data\[random].exe
  • %Documents and Settings%\[User Name]\Local Settings\Application Data\~
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\1
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\2
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\3
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\4
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\Computer Fix\
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\Computer Fix\Computer Fix.lnk
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\Computer Fix\Uninstall Computer Fix.lnk
  • %Documents and Settings%\[User Name]\Desktop\Computer Fix.lnk

The registry entries that need to be removed are as follows:

  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘Yes’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop “NoChangingWallPaper” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = ‘/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer “NoDesktop” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random]“
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “Hidden” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “ShowSuperHidden” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU “MRUList”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “DisableTaskMgr” = ’1′

Please be aware that manual removal of Computer Fix is a cumbersome process and does not always ensure complete deletion of the malware, due to the fact that some files might be hidden or may get reanimated automatically afterwards. Moreover, manual interference of this kind may cause damage to the system. That’s why we strongly recommend automatic removal Computer Fix, which will save your time and enable avoiding any system malfunctions and guarantee the needed result.

Download Computer Fix Automatic Remover

]]> http://remove-malware.net/remove-computer-fix-malware-posing-as-something-else/feed/ 0 Remove System Fix fake PC optimizer http://remove-malware.net/remove-system-fix-fake-pc-optimizer/ http://remove-malware.net/remove-system-fix-fake-pc-optimizer/#comments Tue, 15 Nov 2011 09:36:20 +0000 admin http://remove-malware.net/?p=9193 Malware Description:
System Fix program and fixing anything that is wrong with one’s computer are two unrelated things. It’s all even worse because the application called that way is in fact a phony computer optimizer. It gives you multiple vain promises to enhance your system’s performance, speed up the PC and eliminate all errors it has. Entering a computer is a piece of cake for System Fix. It can do that without having to be permitted by the user. It’s usually a matter of a trojan downloader virus that drops on to your PC as a result of some accidental or careless downloads made by the fraud victims. Typically, these files are disguised as something useful but actually simply serve to deliver the installer for the associated rogue inside your machine. When the trespassing phase is completed, System Fix goes on turning things upside down. It twists facts about the performance level of your system by triggering absurd scanners and different bogus system tray alerts. We got no doubt these ads are falsified. They tell you that a whole bunch of severe errors were found on your computer and must be addressed immediately. There is but one direction System Fix lures you towards: getting you to purchase its commercial copy. It assures you that doing so will become a miracle cure for all the internal illnesses your machine allegedly has. We strongly recommend you do contrariwise, i.e. delete System Fix badware and ignore all of the tips it gives you. Once the pest is gone, all these problems will vanish as well.

Malware Type: Fake Security Programs

Threat Level: Critical

Advice: Immediately remove and scan for additional malware

System Fix Free Scanner and Remover: Download Now

System Fix GUI Screenshot:

System Fix

How to remove System Fix manually:
Manual removal of System Fix is a feasible objective if you have sufficient expertise in dealing with program files, processes, .dll files and registry entries.

The files to be deleted are listed below:

  • %Documents and Settings%\[User Name]\Local Settings\Application Data\[random]
  • %Documents and Settings%\[User Name]\Local Settings\Application Data\[random].exe
  • %Documents and Settings%\[User Name]\Local Settings\Application Data\~
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\1
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\2
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\3
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\4
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\System Fix\
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\System Fix\System Fix.lnk
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\System Fix\Uninstall System Fix.lnk
  • %Documents and Settings%\[User Name]\Desktop\System Fix.lnk

The registry entries that need to be removed are as follows:

  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘Yes’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop “NoChangingWallPaper” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = ‘/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer “NoDesktop” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random]“
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “Hidden” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “ShowSuperHidden” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU “MRUList”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “DisableTaskMgr” = ’1′

Please be aware that manual removal of System Fix is a cumbersome process and does not always ensure complete deletion of the malware, due to the fact that some files might be hidden or may get reanimated automatically afterwards. Moreover, manual interference of this kind may cause damage to the system. That’s why we strongly recommend automatic removal System Fix, which will save your time and enable avoiding any system malfunctions and guarantee the needed result.

Download System Fix Automatic Remover

]]> http://remove-malware.net/remove-system-fix-fake-pc-optimizer/feed/ 0 Remove Data Restore unbearable scareware http://remove-malware.net/remove-data-restore-unbearable-scareware/ http://remove-malware.net/remove-data-restore-unbearable-scareware/#comments Thu, 29 Sep 2011 13:55:58 +0000 admin http://remove-malware.net/?p=9079 Malware Description:
Data Restore ought not to be mistaken for a program that provides actual computer optimization services. We know it looks like one, but the real state of things calls forth a lot of doubts in this regard. First off, Data Restore typically skips the user authorization part when installing on your machine. This flow usually takes place unnoticeably for you and gets obscurely triggered by your accidental click on some ad or a downloaded file disguised as something useful or interesting. Another fact that led us to the conclusion that the application is rogue is it creates a startup entry on Windows registry to subsequently get launched in an automatic mode each time your OS loads. Now that we have considered the intrusion specificity and the first manipulations with the host system, let’s see what happens as Data Restore is operating. It appears to be configured to display scanners and system tray notifications that are all phony. The malware does not list any spyware infections etc. but it does list problems affecting the way your machine works. It says you have damaged hard drive clusters, operating memory issues, complications with the available disk space and similar malfunctions. Normally, your awareness of these problems with your workstation would be an instruction for action such as registry repairing and general system healing. That’s what Data Restore counts on when recommending you an ‘easy’ fix of its own which implies your registering the full-functional version of it. But since this is a clearly fraudulent scheme, you must react accordingly. We mean no paying for Data Restore activation and definitely removal of this malcode from your PC.

Malware Type: Fake Security Programs

Threat Level: Critical

Advice: Immediately remove and scan for additional malware

Data Restore Free Scanner and Remover: Download Now

Data Restore Screenshot:

Data Restore

How to remove Data Restore manually:
Manual removal of Data Restore is a feasible objective if you have sufficient expertise in dealing with program files, processes, .dll files and registry entries.

The files to be deleted are listed below:

  • %Documents and Settings%\[User Name]\Local Settings\Application Data\[random]
  • %Documents and Settings%\[User Name]\Local Settings\Application Data\[random].exe
  • %Documents and Settings%\[User Name]\Local Settings\Application Data\~
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\1
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\2
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\3
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\4
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\Data Restore\
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\Data Restore\Data Restore.lnk
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\Data Restore\Uninstall Data Restore.lnk
  • %Documents and Settings%\[User Name]\Desktop\Data Restore.lnk

The registry entries that need to be removed are as follows:

  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘Yes’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop “NoChangingWallPaper” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = ‘/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer “NoDesktop” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random]“
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “Hidden” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “ShowSuperHidden” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU “MRUList”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “DisableTaskMgr” = ’1′

Please be aware that manual removal of Data Restore is a cumbersome process and does not always ensure complete deletion of the malware, due to the fact that some files might be hidden or may get reanimated automatically afterwards. Moreover, manual interference of this kind may cause damage to the system. That’s why we strongly recommend automatic removal Data Restore, which will save your time and enable avoiding any system malfunctions and guarantee the needed result.

Download Data Restore Automatic Remover

]]> http://remove-malware.net/remove-data-restore-unbearable-scareware/feed/ 0 Remove Data Repair fake system fix tool http://remove-malware.net/remove-data-repair-fake-system-fix-tool/ http://remove-malware.net/remove-data-repair-fake-system-fix-tool/#comments Wed, 28 Sep 2011 09:35:29 +0000 admin http://remove-malware.net/?p=9070 Malware Description:
Irrespective of how nice the Data Repair application looks and how seemingly efficiently it acts, be advised it’s a virus. This type of malware is generally classified as a rogue system optimizer, i.e. a tool pretending to improve the work of your computer but actually doing none of that. Data Repair and the recent Data Recovery fraudware are clones. They have so many things in common that one might find it hard to differentiate between them if it weren’t for the different names. Concerning their activity, the two badwares follow a basically identical path. They attack your PC using software exploits, blackhat Search Engine Optimization and rootkit techniques that hardly yield to any exposure. As Data Repair begins to operate on your machine, it applies an intricate scheme of giving you a major brainwash. It mimics a scan of your OS and, once through with that, says you have serious problems. Here are just some examples of the false positives generated by this scareware with the intent to mislead you: “HDD clusters are partly damaged. Segment load failure”, “A potential disk failure may cause loss of files, applications and documents stored on the hard disk”, “The system has detected a problem with one or more installed IDE / SATA hard disks”, “An error occurred while reading system files” etc. Those messages sound spooky, don’t they? Of course they do – and that is exactly what the hackers want you to think. But a much more reasonable approach is to disregard any and all alerts by Data Repair, bearing in mind that they report pseudo problems, no doubt about that. This tactic is aimed at forcing you to eventually purchase the licensed copy of the program, or as its GUI reads “Activate full-functional version”. It’s obvious that buying Data Repair means donating to the development of the international cyber underworld composed of the bad guys. So you’d better be on top of it and refrain from surrendering them. This is why Data Repair malware removal is your only option.

Malware Type: Fake Security Programs

Threat Level: Critical

Advice: Immediately remove and scan for additional malware

Data Repair Free Scanner and Remover: Download Now

Data Repair Fake Scanning Interface Screenshot:

Data Repair

How to remove Data Repair manually:
Manual removal of Data Repair is a feasible objective if you have sufficient expertise in dealing with program files, processes, .dll files and registry entries.

The files to be deleted are listed below:

  • %Documents and Settings%\[User Name]\Local Settings\Application Data\[random]
  • %Documents and Settings%\[User Name]\Local Settings\Application Data\[random].exe
  • %Documents and Settings%\[User Name]\Local Settings\Application Data\~
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\Data Repair\
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\Data Repair\Data Repair.lnk
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\Data Repair\Uninstall Data Repair.lnk
  • %Documents and Settings%\[User Name]\Desktop\Data Repair.lnk
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\1
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\2
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\3
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\4

The registry entries that need to be removed are as follows:

  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘Yes’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop “NoChangingWallPaper” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = ‘/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer “NoDesktop” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random]“
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “Hidden” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “ShowSuperHidden” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU “MRUList”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “DisableTaskMgr” = ’1′

Please be aware that manual removal of Data Repair is a cumbersome process and does not always ensure complete deletion of the malware, due to the fact that some files might be hidden or may get reanimated automatically afterwards. Moreover, manual interference of this kind may cause damage to the system. That’s why we strongly recommend automatic removal Data Repair, which will save your time and enable avoiding any system malfunctions and guarantee the needed result.

Download Data Repair Automatic Remover

]]> http://remove-malware.net/remove-data-repair-fake-system-fix-tool/feed/ 0 Remove Data Recovery malware as it is alien to your computer http://remove-malware.net/remove-data-recovery-malware-as-it-is-alien-to-your-computer/ http://remove-malware.net/remove-data-recovery-malware-as-it-is-alien-to-your-computer/#comments Wed, 14 Sep 2011 05:05:28 +0000 admin http://remove-malware.net/?p=9033 Malware Description:
We are not going to tell you about the generic phrase of “Data Recovery” in this entry. This is the name of a recent rogue system diagnostics utility. Its misleading plan is about getting you to think something is seriously wrong with your computer, namely with the way it is working and the processes running inside of it. Data Recovery tries to make the stress and accent on the system functioning problems. To be more precise, those are the alleged issues because the fact this program reports malfunctions does not mean they are there at all. Let’s put it the other way: this fake application scans your PC and then finds tons of inexistent errors with it. The snapshot of this bad program’s scanning screen below reflects the initiation of this pseudo system check. As you can see, it purportedly monitors your machine for related problems with “My Computer”, HDD, RAM Memory and OS Registry. A regular optimization tool performs genuine operations while its scan is in progress, but Data Recovery merely depicts something it was coded to. This entire drama is such as sham in fact. The software we are analyzing does not and cannot really fulfill the functions it declares to implement. Despite this absolute truth, it still reports tons of errors in its PC Performance & Stability analysis report. Once you receive these results, the pest insists that you activate its full-functional version by clicking the associated button at the bottom of its interface (see image). So in every single case, it all comes to a payment you are required to make before you can take advantage of Data Recovery’s so-called services. Do not build castles in the sky; uninstall Data Recovery virus as it is not on your computer to help.

Malware Type: Fake Security Programs

Threat Level: Critical

Advice: Immediately remove and scan for additional malware

Data Recovery Free Scanner and Remover: Download Now

Data Recovery Fake Scanning Interface Screenshot:

Data Recovery

How to remove Data Recovery manually:
Manual removal of Data Recovery is a feasible objective if you have sufficient expertise in dealing with program files, processes, .dll files and registry entries.

The files to be deleted are listed below:

  • %Documents and Settings%\[User Name]\Local Settings\Application Data\[random]
  • %Documents and Settings%\[User Name]\Local Settings\Application Data\[random].exe
  • %Documents and Settings%\[User Name]\Local Settings\Application Data\~
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\Data Recovery\
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\Data Recovery\Data Recovery.lnk
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\Data Recovery\Uninstall Data Recovery.lnk
  • %Documents and Settings%\[User Name]\Desktop\Data Recovery.lnk
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\1
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\2
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\3
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\4

The registry entries that need to be removed are as follows:

  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘Yes’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop “NoChangingWallPaper” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = ‘/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer “NoDesktop” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random]“
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “Hidden” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “ShowSuperHidden” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU “MRUList”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “DisableTaskMgr” = ’1′

Please be aware that manual removal of Data Recovery is a cumbersome process and does not always ensure complete deletion of the malware, due to the fact that some files might be hidden or may get reanimated automatically afterwards. Moreover, manual interference of this kind may cause damage to the system. That’s why we strongly recommend automatic removal Data Recovery, which will save your time and enable avoiding any system malfunctions and guarantee the needed result.

Download Data Recovery Automatic Remover

]]> http://remove-malware.net/remove-data-recovery-malware-as-it-is-alien-to-your-computer/feed/ 0 Remove System Recovery pseudo optimizer to make your PC happy http://remove-malware.net/remove-system-recovery-pseudo-optimizer-to-make-your-pc-happy/ http://remove-malware.net/remove-system-recovery-pseudo-optimizer-to-make-your-pc-happy/#comments Sun, 04 Sep 2011 11:16:15 +0000 admin http://remove-malware.net/?p=9005 Malware Description:
System Recovery is a real-looking but fake application that features alleged services in PC maintenance and optimizing the performance of your computer. It’s just another name of the formerly emerged Master Utilities malware. What do these programs have in common? Basically everything, except for the name perhaps. They share the exact same UI and do the same bad things to the machines they infect. System Recovery usually employs trojan viruses to complete the infiltration phase of its lifetime. It is therefore installed by a little pest whose small size enables it to wriggle through the defense of an average PC connected to the Internet. Actually, trojans always participate in rogue software propagation because they are often hard to detect and they can perform a universal function in terms of contamination. You don’t see the trojans though. What you see is the consequences of their activity. In case with System Recovery, the outcomes include triggering a myriad of alerts and scanners whose falsity is beyond question. The fraudware runs its neat-looking scanners to show you in the end that you got problems. It would sure be troubling news to learn about critical computer errors with the system drive, RAM memory, Registry etc. If reported by System Recovery though, these issues do not deserve your trust, just because they are fictitious. This rip-off tool lists the scary bugs with one intent in mind – to give you a completely wrong idea of how your workstation is doing. Moreover, it highly recommends you get the problems fixed, but you will have to do something before the ‘repair’ starts. System Recovery must be purchased first. Guess what will happen after the payment is made by you. Nothing. The program will simply let go and stop reporting the absurd errors that were never there in the first place. What a scheme, isn’t it? Unless you already paid for this scam, you have pretty good chances to prevent the worst. It’s simple – just uninstall System Recovery rogueware. Although the standard ‘Add/Remove Programs’ does not work with this utility, the tips below should definitely do the trick.

Malware Type: Fake Security Programs

Threat Level: Critical

Advice: Immediately remove and scan for additional malware

System Recovery Free Scanner and Remover: Download Now

System Recovery GUI Screenshot:

System Recovery GUI

How to remove System Recovery manually:
Manual removal of System Recovery is a feasible objective if you have sufficient expertise in dealing with program files, processes, .dll files and registry entries.

The files to be deleted are listed below:

  • %Documents and Settings%\[User Name]\Local Settings\Application Data\[random]
  • %Documents and Settings%\[User Name]\Local Settings\Application Data\[random].exe
  • %Documents and Settings%\[User Name]\Local Settings\Application Data\~
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\System Recovery\
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\System Recovery\System Recovery.lnk
  • %Documents and Settings%\[User Name]\Start Menu\\Programs\System Recovery\Uninstall System Recovery.lnk
  • %Documents and Settings%\[User Name]\Desktop\System Recovery.lnk
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\1
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\2
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\3
  • %Documents and Settings%\[User Name]\Local Settings\Temp\smtmp\4

The registry entries that need to be removed are as follows:

  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘Yes’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop “NoChangingWallPaper” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = ‘/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer “NoDesktop” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random]“
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “Hidden” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “ShowSuperHidden” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU “MRUList”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “DisableTaskMgr” = ’1′

Please be aware that manual removal of System Recovery is a cumbersome process and does not always ensure complete deletion of the malware, due to the fact that some files might be hidden or may get reanimated automatically afterwards. Moreover, manual interference of this kind may cause damage to the system. That’s why we strongly recommend automatic removal System Recovery, which will save your time and enable avoiding any system malfunctions and guarantee the needed result.

Download System Recovery Automatic Remover

]]> http://remove-malware.net/remove-system-recovery-pseudo-optimizer-to-make-your-pc-happy/feed/ 0 Remove Master Utilities fake optimization kit http://remove-malware.net/remove-master-utilities-fake-optimization-kit/ http://remove-malware.net/remove-master-utilities-fake-optimization-kit/#comments Fri, 02 Sep 2011 04:55:31 +0000 admin http://remove-malware.net/?p=8997 Malware Description:
With Master Utilities software running on your computer, you will get pounded by immense amount of pseudo information on your system’s performance level and silly recommendations on fixing these problems. Remember we gave you an overview of the PC Repair virus a few days ago? Master Utilities is an updated copy of the above scareware. It has a few features though distinguishing it from the precursor. First off, it’s the graphics – the design of the main GUI is a little modified and made somewhat plainer, probably conforming to the latest trends in the software world towards simplicity. The scam application imitates a System Control Panel with the statuses of different segments of the PC’s work. Those are computer status, system drive status, RAM memory status and system registry status. As you can tell from the screenshot, all of these directories have the ‘Repair Required’ note next to them. And that is told to you even before Master Utilities actually started scanning your machine. As a result of the scan procedure, the rogue gets more ‘specific’ and lists certain errors such as the decrease of hard drive rotational speed, drive C initializing problem, unreadable sectors of the disks, damaged files, data corruption and loss, HDD inaccessibility etc. These issues sound pretty spooky, don’t they? They sure do, and that’s exactly how Master Utilities is going to make you do what it is after. On each graphical element, you will be seeing buttons like ‘Fix errors’, ‘Fix problem’ and similar options. Now, the actual purpose of this badware becomes perfectly clear once you click one of those. You will be directed to a page designed for processing user payments. Therefore, by intimidating you Master Utilities attempts to have you pay for its fully-functional version which in fact does not work at all. Do not become an easy target for the hackers. So get down to Master Utilities removal right away, we are here to help you out with that.

Malware Type: Fake Security Programs

Threat Level: Critical

Advice: Immediately remove and scan for additional malware

Master Utilities Free Scanner and Remover: Download Now

Master Utilities GUI Screenshot:

Master Utilities GUI

How to remove Master Utilities manually:
Manual removal of Master Utilities is a feasible objective if you have sufficient expertise in dealing with program files, processes, .dll files and registry entries.

The files to be deleted are listed below:

  • %LocalAppData%\[random].exe
  • %LocalAppData%\~[random]
  • %LocalAppData%\~[random]
  • %StartMenu%\Programs\Master Utilities\
  • %StartMenu%\Programs\Master Utilities\Master Utilities.lnk
  • %StartMenu%\Programs\Master Utilities\Uninstall Master Utilities.lnk
  • %Temp%\smtmp\
  • %Temp%\smtmp\1
  • %Temp%\smtmp\1
  • %Temp%\smtmp\2
  • %Temp%\smtmp\3
  • %Temp%\smtmp\4
  • %UserProfile%\Desktop\Master Utilities.lnk

The registry entries that need to be removed are as follows:

  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘Yes’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop “NoChangingWallPaper” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = ‘/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer “NoDesktop” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random]“
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “DisableTaskMgr” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “Hidden” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “ShowSuperHidden” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU “MRUList”

Please be aware that manual removal of Master Utilities is a cumbersome process and does not always ensure complete deletion of the malware, due to the fact that some files might be hidden or may get reanimated automatically afterwards. Moreover, manual interference of this kind may cause damage to the system. That’s why we strongly recommend automatic removal Master Utilities, which will save your time and enable avoiding any system malfunctions and guarantee the needed result.

Download Master Utilities Automatic Remover

]]> http://remove-malware.net/remove-master-utilities-fake-optimization-kit/feed/ 0 Remove PC Repair malware sparing no effort http://remove-malware.net/remove-pc-repair-malware-sparing-no-effort/ http://remove-malware.net/remove-pc-repair-malware-sparing-no-effort/#comments Sat, 27 Aug 2011 07:44:57 +0000 admin http://remove-malware.net/?p=8984 Malware Description:
We believe we found malware of the day. It’s called PC Repair and it certainly has nothing to do with actually fixing any computer performance issues. This rogue optimization software has had same-looking predecessors like this one (please navigate through this link to review some facts about the clone). Whether you like it or not, PC Repair knows alternative paths into your system other than the standard user authentication. It is really counting on trojan horses to attack one’s computer, doing it without making any ‘noise’. As a consequence, you get infected with the virus without being aware of how and when it dared intrude on your privacy. Once launched, PC Repair will display a scan (snapshot is below) to show you some sort of imitation of a system check for potential dangers and errors. It’s not surprising at all that the program does detect some of such issues usually amounting to 11 errors. It says it spotted Drive C initializing problem, bad sectors on hard drive, critical read time of HDD clusters and even the awful-sounding fact that your hard drive does not respond to system commands, which would actually mean your system is pretty much ruined if this were in the real world. PC Repair has a world of its own though, and everything it detects is just a curtain with a lot of unpleasant stuff behind it. This badware will go on telling you about problems that you do not actually have, until it reaches some end point and starts insisting that you need to register its licensed copy now. However, even if you are careless enough to purchase PC Repair full version, there will be no relief at all. The malfunctions it had ‘found’ are fictitious, remember? So is the program itself. We got but one piece of advice for you: get rid of this scam app without delay as that is the only possible remedy in this case.

Malware Type: Fake Security Programs

Threat Level: Critical

Advice: Immediately remove and scan for additional malware

PC Repair Free Scanner and Remover: Download Now

PC Repair GUI Screenshot:

PC Repair GUI

How to remove PC Repair manually:
Manual removal of PC Repair is a feasible objective if you have sufficient expertise in dealing with program files, processes, .dll files and registry entries.

The files to be deleted are listed below:

  • %LocalAppData%\[random].exe
  • %LocalAppData%\~[random]
  • %LocalAppData%\~[random]
  • %StartMenu%\Programs\PC Repair\
  • %StartMenu%\Programs\PC Repair\PC Repair.lnk
  • %StartMenu%\Programs\PC Repair\Uninstall PC Repair.lnk
  • %Temp%\smtmp\
  • %Temp%\smtmp\1
  • %Temp%\smtmp\1
  • %Temp%\smtmp\2
  • %Temp%\smtmp\3
  • %Temp%\smtmp\4
  • %UserProfile%\Desktop\PC Repair.lnk

The registry entries that need to be removed are as follows:

  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘Yes’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop “NoChangingWallPaper” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = ‘/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer “NoDesktop” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random]“
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “DisableTaskMgr” = ’1′
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “Hidden” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “ShowSuperHidden” = ’0′
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU “MRUList”

Please be aware that manual removal of PC Repair is a cumbersome process and does not always ensure complete deletion of the malware, due to the fact that some files might be hidden or may get reanimated automatically afterwards. Moreover, manual interference of this kind may cause damage to the system. That’s why we strongly recommend automatic removal PC Repair, which will save your time and enable avoiding any system malfunctions and guarantee the needed result.

Download PC Repair Automatic Remover

]]> http://remove-malware.net/remove-pc-repair-malware-sparing-no-effort/feed/ 0