How to remove Windows Protection Suite
Wednesday, August 12th, 2009 at 2:42 amWindows Protection Suite description
Windows Protection Suite malware uses the name of MS Windows operating system to attract customers. The tool is neither related to Microsoft Corp. nor is it a security application.
Windows ProtectionSuite is promoted on several websites that pretend to be dedicated to cyber security. Do not trust sources that present WindowsProtectionSuite as a legitimate program. The malware is also installed secretly by trojans.
WindowsProtection Suite displays loads of fabricated security alerts trying to scare people into paying for using the tool. The program is not worth a dime since it’s a rogue anti-spyware and a scam in a one piece of software. Once on board a computer, Windows Protection Suite may redirect web browser to windowsprotectionsuite.com and other fraudulent websites urging to buy a full version. The imaginary full version costs either $49.95 or $69.95 or $89.95. Don’t support scammers and remove Windows Protection Suite without a doubt.
Get rid of Windows Protection Suite
Windows Protection Suite is a Rogue Antispyware software
How to manually remove Windows Protection Suite
To remove Windows Protection Suite spyware you must block Windows Protection Suite sites, stop and remove processes, unregister DLL files, search and delete all other Windows Protection Suite files and registry utility. Follow the Windows Protection Suite detection and removal instructions below.
The most typical software removal method is to remove Windows Protection Suite by using "Add or Remove Programs" service. However there may be hidden Windows Protection Suite files, running processes and registries in your computer, so Windows Protection Suite may recreate all other files after reboot.
Windows Protection Suite manual removal instructions
Block Windows Protection Suite sites:
windowsprotectionsuite.com
4-open-davinci.com
securitysoftwarepayments.com
privatesecuredpayments.com
secure.privatesecuredpayments.com
getantivirusplusnow.com
secure-plus-payments.com
getantivirusplusnow.com
secure-plus-payments.com
getavplusnow.com
securesoftwarebill.com
secure.paysecuresystem.com
4-open-davinci.com
securitysoftwarepayments.com
privatesecuredpayments.com
secure.privatesecuredpayments.com
getantivirusplusnow.com
secure-plus-payments.com
getantivirusplusnow.com
secure-plus-payments.com
getavplusnow.com
securesoftwarebill.com
secure.paysecuresystem.com
guardincorp.cn
Read more how to block Windows Protection Suite sites
Stop and remove Windows Protection Suite processes:
Windows Protection Suite.exe
uninstall.exe
WI345d.exe
CLSV.exe
wic0e.exe
ppal.exe
Read more how to kill Windows Protection Suite processes
Locate and delete Windows Protection Suite registry entries:
HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_CLASSES_ROOT\WI345d.DocHostUIHandler
HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://search-gala.com/?&uid=7&q={searchTerms}"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "9877034603"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Windows Protection Suite"
Read more how to delete Windows Protection Suite registry entries
Download RegistryBooster 2010 to scan errors caused by Windows Protection Suite
Search and unregister Windows Protection Suite DLL libraries:
energy.dll
grid.dll
kernel32.dll
tempdoc.dll
PE.dll
runddl.dll
SM.dll
ddv.dll
CLSV.dll
cid.dll
sqlite3.dll
mozcrt19.dll
Read more how to unregister Windows Protection Suite DLL files
Detect and delete other Windows Protection Suite files:
%startmenu%\windows protection suite.lnk
%common_appdata%\winspsys\winps.cfg
Windows Protection Suite.exe
uninstall.exe
WI345d.exe
CLSV.exe
ANTIGEN.drv
DBOLE.drv
dudl.sys
energy.dll
grid.dll
grid.sys
kernel32.dll
PE.dll
runddl.dll
SM.dll
wic0e.exe
285.mof
mozcrt19.dll
sqlite3.dll
WINPS.ico
working.log
vd952342.bd
cookies.sqlite
instructions.ini
cb.sys
cid.dll
cid.tmp
CLSV.dll
CLSV.tmp
DBOLE.sys
ddv.dll
eb.sys
eb.tmp
energy.drv
energy.sys
exec.tmp
kernel32.drv
PE.drv
PE.tmp
ppal.exe
runddlkey.drv
snl2w.sys
tempdoc.dll
searchplugins\search.xml
We strongly recommend you to use spyware remover to track Windows Protection Suite and automaticaly remove Windows Protection Suite processes, registries and files as well as other spyware threats.
Tags: Windows Protection Suite, Windows ProtectionSuite, WindowsProtection Suite, WindowsProtectionSuite how to get rid of Windows Protection Suite how to remove Windows Protection Suite how to uninstall Windows Protection Suite
Posted in Rogue Antispyware
August 12th, 2009 at 11:02 am
TWIMC: 12 Aug 09
The current version of the Fake Windows Scurity Center virus is capturing and killing key strokes to taskmgr
and kills cmd and taskmgr calls from the run prompt. It appears to have disabled the ability to enter
safe mode as well. It also appears to kill any virus/adware/malware scubber programs. So put on your thinking caps
and see if you can come up with work arounds to rid with these contraints.
BTW, this version seems quite recently introduced (like the last week of July 09).
Reply
Clark Reply:
August 17th, 2009 at 9:06 pm
My wife just attracted this trojan (sigh) and I have been able to remove it with good success. However, I know get a couple crash warnings on boot for WId6e9.exe and task manager refuses to open using any method. I’m stuck now.
Reply
Luciana Reply:
August 17th, 2009 at 10:34 pm
Restart your computer and boot into a safe mode. You should be able to access Task Manager and to run anti-spyware tools.
Reply
RYB Reply:
October 1st, 2009 at 3:41 am
I have tried to restart in safe mode but I get message that contains multi disk (0)
rdisk (0). I am clueless and very frustrated. Please help
Kev Reply:
October 25th, 2009 at 4:51 am
Download “Process explorer” as a substitute for Task Manager!
Reply
August 24th, 2009 at 2:58 pm
it worked!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! i think
Reply
August 29th, 2009 at 10:09 am
this program is super annoying i thought it was acctaully a good thing due to its name and when i got it it is constantly popping up and scaring me with that annoying noise . should i use this removal tool to get rid of it?
Reply
Luciana Reply:
August 30th, 2009 at 10:35 pm
The removal tool is effective but you can also delete the infection manually. Use the tutorial given above the comments section.
Reply
September 6th, 2009 at 7:18 pm
should i use spyware doctor i’m thinking about it…………………..
Reply
Luciana Reply:
September 6th, 2009 at 11:19 pm
It’s legitimate and reputable spyware remover and it’s capable of dealing with Windows Protection Suite scam.
Reply
September 9th, 2009 at 9:47 pm
Found the issue with taskmgr and any spybot/adaware/AV software not running…..
Regedit for key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options. Browse for any stuff that is not working. (The key path may not be 100% correct, but the last bit is ‘Image File Execution Options’. This allows to attach a debugger to a program to trouble shoot by redirecting the execution to a ‘debugger’ before the process starts.). I found my Taskmgr.ext being redirected to svchost.exe. This would cause it not to launch at all. EXPORT YOUR KEYS BEFORE DOING THE FOLLOWING!!!! Remove the key then test to see if it works. If it does not work, import (or merge) the key back to the registry!
I removed the taskmgr key from the Image File Execution Options (which pointed taskmgr to svchost.exe) and task manager came up with no issues!
Reply
eyetee Reply:
September 12th, 2009 at 3:30 pm
thanx
Reply
JessieP Reply:
September 15th, 2009 at 1:46 pm
um, this is my problem i cant get taskmgr to open due to windows protection suite but i do not know how to understand what u said to do to fix it can you explain it better
Reply
Luciana Reply:
September 15th, 2009 at 10:52 pm
Run antispyware scan, this way is easier when you can’t use the manual removal.
Reply
September 12th, 2009 at 3:29 pm
to 5. Derrek:> Followed what you said and now can also open the task manager.Lovely
a friends i am trying to fix.
Reply
September 19th, 2009 at 7:46 pm
Thanks to Derrek, No. 5 above – deleting the taskmgr key from HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options as indicated got the task manager back to me.
Reply
October 31st, 2009 at 7:50 am
hi sir /madam i would to get my refunds bcoz i’m not satisfy with the product some times it work it forget how to work plz i did make a payment with a visa of $93. i would the money back n by the way i already remove the windows protection suite out my computer thank you
Reply
Luciana Reply:
November 1st, 2009 at 11:29 pm
Hello Dave,
Spywarevoid.com doesn’t distribute Windows Protection Suite and it is not related with the malware in any way. I’m afraid you won’t get the refund from creators of this scam, because there’s no real company behind this. Call the local authorities of your bank and explain them what happened, they might be still able to cancel the payment. If you still got Windows Protection Suite on your PC, use the manual removal guidelines posted above the comments section.
Reply