Thursday, April 12, 2012

Remove Windows Command Processor as the program is piece of adware wearing skins of antivirus

Windows Command Processor has gained a bad fame as a program that does not seek user’s approval for entering computer system. Otherwise, it obtains user’s consent by scaring user into believing the computer is about to collapse. This is done by means of free scanners, which are, in their turn, sponsored by redirect traps distributed throughout the worldwide web on the sites you least expect to be engaged into malware propagation.
That is not to blame the website owners and administrators, but it is because their abandoning checking the content of ads published on their media and the issues of their websites security the fake scanners dedicated advertising the adware has become that frequently visited.
Remove Windows Command Processor adware as it is annoying and fake in terms of conforming to its declared features no matter how it has managed to root into your PC. Free scanner available here is a validated Windows Command Processor removal tool that exterminates the adware together with other infections.

Windows Command Processor screenshot:


Windows Command Processor manual removal guide:

Delete infected files:
%AppData%\Inspector-[rnd].exe
%AppData%\Protector-[rnd].exe
Inspector-[rnd].exe
Protector-[rnd].exe
Delete Windows Command Processor registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ERROR_PAGE_BYPASS_ZONE_CHECK_FOR_HTTPS_KB954312
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "ID" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "net" = "2012-2-17_2"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "rudbxijemb"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpcc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashDisp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\divx.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mostat.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\platin.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tapinstall.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapsetup3001.exe

No comments: