How to remove Windows Cleaning Tools

Windows Cleaning Tools is a dangerous fake anti-spyware program like any other from the Rogue Fake Vimes family. It displays a lot of false warnings and security alerts in attempt to trick you into purchasing the fake full version of this program. This malware is spread by the hacked web sites that find visitor’s vulnerable programs and exploit them to install the malware without the user permission or through the web sites that display fake online anti-malware scanners that state that your PC is infected and needs the install of Windows Cleaning Tools in order to clean it. After the malware is installed, it is configured to start automatically, and after that it starts to perform fake scans and states that your PC is infected with numerous malware. To use this program to remove all the noted infections, the program offers to purchase a full version while no real threat to your PC exists beside this one, and you need to remove Windows Cleaning Tools.

Windows Cleaning Tools malvare GUI

The problem is that the malware hijacks many of the infected PC’s functions like Windows Task Manager and Registry editor, so it will instead open the rogue’s Advanced Process Control screen, which acts like a task manager. In order to be able to remove it try to unlock normal functions by the fake registration with the key

0W000-000B0-00T00-E0020

For now it should work, but keep in your mind that the registration will not remove this malware from your PC and it will still present the threat to your security and privacy. Under any circumstances, DO NOT BY the license to Windows Task Manager. Hijacking the information from your credit card account is the main goal of this scam, and then your money might be stolen.

There are a number of special utilities designed to remove Windows Cleaning Tools and the bunch of its relatives professionally in an automated process of scan and removal all of the known signatures and traces present on your system.

DownloadDownload Removal Tool

If you remove Windows Cleaning Tools malware manually, then you need to unblock your internet access and have to block Windows Cleaning Tools sites, then stop and remove all the malware processes, search and delete all Windows Cleaning Tools files on your PC and remove all the records made by the malware in your system registry.

How to remove Windows Cleaning Tools manually list:

End these Windows Cleaning Tools processes:

random.exe
Protector.exe (Protector.exe file may have 3 or more random characters at the end of it’s file name like ProtectionGQY.exe)

HELP: How to Stop Malicious Process

 

Remove these Windows Cleaning Tools registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashLogV.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beagle.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jedi.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msa.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntvdm.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav7.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoler.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vir-help.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wupdt.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegedit” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “net

HELP: How to edit Windows Registry

 

Delete these Windows Cleaning Tools files:

%StartMenu%\Programs\Windows Cleaning Tools.lnk
%AppData%\result.db
%Desktop%\Windows Cleaning Tools.lnk
%AppData%\Protector.exe (“Protector” is followed by some random 3 letters before the extension)

HELP: How to remove hidden files
There is no guarantee that Windows Cleaning Tools wouldn’t not change in the nearest future, and this listing might change as well. It is better to use special software for eliminating this kind of threats and other malware programs that will scan your PC against updated malware databases. If you opt not to pay professionals, then you can scan your computer with a free HijackThis tool and look at the log that it makes. If after hand-cleaning procedures you see this line in the log file

O4 – HKCU\..\Run: [Inspector] %AppData%\Protector-.exe

It is a sign of presence some malware like Windows Cleaning Tools on your PC. Maybe, it is time to go to professional solution.

Leave a Reply

Your email address will not be published. Required fields are marked *

 VIRUS REMOVAL TOOL

SpuHunter Anti-malware
STEP 1. Download SpyHunter and scan your computer for malware, spyware, adware, browser hijackers, redirect viruses, unwanted programs, keyloggers, and tracking cookies.
SpyHunter free scanner
STEP 2. Use free help desk support that guarantees your success in removing even most complicated malware infection.
SpyHunter Anti-malware
STEP 3. Protect your computer against viruses, cyber criminals, unwanted software and advertising, DNS changes, and malicious surveillance.