How to remove Windows Protection Suite

Wednesday, August 12th, 2009 at 2:42 am
Home » Rogue Antispyware » Windows Protection Suite

Windows Protection Suite description

Windows Protection Suite malware uses the name of MS Windows operating system to attract customers. The tool is neither related to Microsoft Corp. nor is it a security application.

WindowsProtectionSuite

Windows ProtectionSuite is promoted on several websites that pretend to be dedicated to cyber security. Do not trust sources that present WindowsProtectionSuite as a legitimate program. The malware is also installed secretly by trojans.

WindowsProtection Suite displays loads of fabricated security alerts trying to scare people into paying for using the tool. The program is not worth a dime since it’s a rogue anti-spyware and a scam in a one piece of software. Once on board a computer, Windows Protection Suite may redirect web browser to windowsprotectionsuite.com and other fraudulent websites urging to buy a full version. The imaginary full version costs either $49.95 or $69.95 or $89.95. Don’t support scammers and remove Windows Protection Suite without a doubt.

Windows Protection Suite is a Rogue Antispyware software

How to manually remove Windows Protection Suite

To remove Windows Protection Suite spyware you must block Windows Protection Suite sites, stop and remove processes, unregister DLL files, search and delete all other Windows Protection Suite files and registry utility. Follow the Windows Protection Suite detection and removal instructions below.

The most typical software removal method is to remove Windows Protection Suite by using "Add or Remove Programs" service. However there may be hidden Windows Protection Suite files, running processes and registries in your computer, so Windows Protection Suite may recreate all other files after reboot.

Windows Protection Suite manual removal instructions

Block Windows Protection Suite sites:
windowsprotectionsuite.com
4-open-davinci.com
securitysoftwarepayments.com
privatesecuredpayments.com
secure.privatesecuredpayments.com
getantivirusplusnow.com
secure-plus-payments.com
getantivirusplusnow.com
secure-plus-payments.com
getavplusnow.com
securesoftwarebill.com
secure.paysecuresystem.com
4-open-davinci.com
securitysoftwarepayments.com
privatesecuredpayments.com
secure.privatesecuredpayments.com
getantivirusplusnow.com
secure-plus-payments.com
getantivirusplusnow.com
secure-plus-payments.com
getavplusnow.com
securesoftwarebill.com
secure.paysecuresystem.com
guardincorp.cn
Read more how to block Windows Protection Suite sites

Stop and remove Windows Protection Suite processes:
Windows Protection Suite.exe
uninstall.exe
WI345d.exe
CLSV.exe
wic0e.exe
ppal.exe
Read more how to kill Windows Protection Suite processes

Locate and delete Windows Protection Suite registry entries:
HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_CLASSES_ROOT\WI345d.DocHostUIHandler
HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://search-gala.com/?&uid=7&q={searchTerms}"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "9877034603"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Windows Protection Suite"
Read more how to delete Windows Protection Suite registry entries
Download RegistryBooster 2010 to scan errors caused by Windows Protection Suite

Search and unregister Windows Protection Suite DLL libraries:
energy.dll
grid.dll
kernel32.dll
tempdoc.dll
PE.dll
runddl.dll
SM.dll
ddv.dll
CLSV.dll
cid.dll
sqlite3.dll
mozcrt19.dll
Read more how to unregister Windows Protection Suite DLL files

Detect and delete other Windows Protection Suite files:
%startmenu%\windows protection suite.lnk
%common_appdata%\winspsys\winps.cfg
Windows Protection Suite.exe
uninstall.exe
WI345d.exe
CLSV.exe
ANTIGEN.drv
DBOLE.drv
dudl.sys
energy.dll
grid.dll
grid.sys
kernel32.dll
PE.dll
runddl.dll
SM.dll
wic0e.exe
285.mof
mozcrt19.dll
sqlite3.dll
WINPS.ico
working.log
vd952342.bd
cookies.sqlite
instructions.ini
cb.sys
cid.dll
cid.tmp
CLSV.dll
CLSV.tmp
DBOLE.sys
ddv.dll
eb.sys
eb.tmp
energy.drv
energy.sys
exec.tmp
kernel32.drv
PE.drv
PE.tmp
ppal.exe
runddlkey.drv
snl2w.sys
tempdoc.dll
searchplugins\search.xml

We strongly recommend you to use spyware remover to track Windows Protection Suite and automaticaly remove Windows Protection Suite processes, registries and files as well as other spyware threats.

Download does not start? Try a mirror download here

Tags: , , ,

21 Responses to

Windows Protection Suite

  1. david megarry

    TWIMC: 12 Aug 09
    The current version of the Fake Windows Scurity Center virus is capturing and killing key strokes to taskmgr
    and kills cmd and taskmgr calls from the run prompt. It appears to have disabled the ability to enter
    safe mode as well. It also appears to kill any virus/adware/malware scubber programs. So put on your thinking caps
    and see if you can come up with work arounds to rid with these contraints.

    BTW, this version seems quite recently introduced (like the last week of July 09).

    Reply

    Clark Reply:

    My wife just attracted this trojan (sigh) and I have been able to remove it with good success. However, I know get a couple crash warnings on boot for WId6e9.exe and task manager refuses to open using any method. I’m stuck now.

    Reply

    Luciana Reply:

    Restart your computer and boot into a safe mode. You should be able to access Task Manager and to run anti-spyware tools.

    Reply

    RYB Reply:

    I have tried to restart in safe mode but I get message that contains multi disk (0)
    rdisk (0). I am clueless and very frustrated. Please help

    Kev Reply:

    Download “Process explorer” as a substitute for Task Manager!

    Reply

  2. hopechan

    it worked!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! i think

    Reply

  3. adam fortier

    this program is super annoying i thought it was acctaully a good thing due to its name and when i got it it is constantly popping up and scaring me with that annoying noise . should i use this removal tool to get rid of it?

    Reply

    Luciana Reply:

    The removal tool is effective but you can also delete the infection manually. Use the tutorial given above the comments section.

    Reply

  4. medaboy

    should i use spyware doctor i’m thinking about it…………………..

    Reply

    Luciana Reply:

    It’s legitimate and reputable spyware remover and it’s capable of dealing with Windows Protection Suite scam.

    Reply

  5. Derrek

    Found the issue with taskmgr and any spybot/adaware/AV software not running…..

    Regedit for key:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options. Browse for any stuff that is not working. (The key path may not be 100% correct, but the last bit is ‘Image File Execution Options’. This allows to attach a debugger to a program to trouble shoot by redirecting the execution to a ‘debugger’ before the process starts.). I found my Taskmgr.ext being redirected to svchost.exe. This would cause it not to launch at all. EXPORT YOUR KEYS BEFORE DOING THE FOLLOWING!!!! Remove the key then test to see if it works. If it does not work, import (or merge) the key back to the registry!

    I removed the taskmgr key from the Image File Execution Options (which pointed taskmgr to svchost.exe) and task manager came up with no issues!

    Reply

    eyetee Reply:

    thanx

    Reply

    JessieP Reply:

    um, this is my problem i cant get taskmgr to open due to windows protection suite but i do not know how to understand what u said to do to fix it can you explain it better

    Reply

    Luciana Reply:

    Run antispyware scan, this way is easier when you can’t use the manual removal.

    Reply

  6. eyetee

    to 5. Derrek:> Followed what you said and now can also open the task manager.Lovely
    a friends i am trying to fix.

    Reply

  7. jori

    Thanks to Derrek, No. 5 above – deleting the taskmgr key from HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options as indicated got the task manager back to me.

    Reply

  8. dave jugessur

    hi sir /madam i would to get my refunds bcoz i’m not satisfy with the product some times it work it forget how to work plz i did make a payment with a visa of $93. i would the money back n by the way i already remove the windows protection suite out my computer thank you

    Reply

    Luciana Reply:

    Hello Dave,
    Spywarevoid.com doesn’t distribute Windows Protection Suite and it is not related with the malware in any way. I’m afraid you won’t get the refund from creators of this scam, because there’s no real company behind this. Call the local authorities of your bank and explain them what happened, they might be still able to cancel the payment. If you still got Windows Protection Suite on your PC, use the manual removal guidelines posted above the comments section.

    Reply

  9. nency

    I can not access to the Regedit in order to change tha paramether. Are there any other way to access to it. Thank you.

    Reply

  10. phil r

    my kid downloaded this after messing with Minefraft mods.

    Just did a system restore before the software was loaded.

    Everything seems to be back to normal – ie task manager starts, mcafee starts etc.

    Just doing a virus scan to make sure.

    Reply

Trackbacks

Leave a Reply

Download does not start? Try a mirror download here