Do You Know Windows Defence Counsel?
Windows Defence Counsel has been determined as a fake security program which acts like many rogue program appeared before. Just like Windows Safety Maintenance .This Windows Defence Counsel pretends to be a legit one but it can do nothing to your computer. All it wants is to scam users' money and then mess up the whole system. It is really annoying with this thing, because Windows Defence Counsel will block many tasks on the computer and there is no tool can remove this Windows Defence Counsel. Users should be careful if they meet this thing, the most effective way is to manually remove Windows Defence Counsel with expert skills. You can learn useful guide here.
Windows Defence Counsel Screenshot
Manual Guide for Windows Defence Counsel Removal
Associated Windows Defence Counsel Files:%AppData%\NPSWF32.dll
%AppData%\Protector-<random 3 chars>.exe
%AppData%\Protector-<random 4 chars>.exe
%AppData%\result.db
File Location Notes:
%AppData% refers to the current users Application Data folder. By default, this is C:\Documents and Settings\<Current User>\Application Data for Windows 2000/XP. For Windows Vista and Windows 7 it is C:\Users\<Current User>\AppData\Roaming.
Associated Windows Defence Counsel Windows Registry Information:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegedit” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorAdmin” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorUser” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “net” = “2012-5-27_7″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “UID” = “whecqycyiq”
HKEY_CURRENT_USER\Software\ASProtect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adaware.exe
No comments:
Post a Comment