Friday, March 30, 2012

Removal of Windows Trouble Taker which alerts tend to annoy you while you are at extremes of your computer use

Windows Trouble Taker does not spare effort in showing its popups during the most unsuitable periods. Its notifications are shown to users even without the program being fully installed, as online sources are connected by short version of the above program to annoy people with alerts from the web. The alerts get loaded onto computer systems by hijacker component of the fraudware.
Once the rogue is installed in complete, it starts showing basically the same sort of misleading information, but this time the source is already inside a compromised machine. The fraud popped up by the peony antivirus is timed with its attacks on processes of useful apps in order that such comments of the program as that that so and so application has failed due to so and so virus would sound trustworthy. That is, the rogue restricts other apps and comments on the evens claiming it has found the cause, namely specifying arbitrary virus name etc.
Get rid of Windows Trouble Taker as it mentions in vain valid names of infections. Free scanner available here will remove Windows Trouble Taker and, in case of coincidence, may find some instances of viruses detected by the ever-lying parasite.

Windows Trouble Taker screenshot:



Windows Trouble Taker Manual removal guide:
Delete Windows Trouble Taker files:
%AppData%\NPSWF32.dll
%AppData%\Protector-.exe
%AppData%\result.db
%CommonStartMenu%\Programs\Windows Trouble Taker.lnk
%Desktop%\Windows Trouble Taker.lnk
Delete infected registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorAdmin" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorUser" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "EnableLUA" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "net" = "2012-3-28_1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "wmvbpkcnoi"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brw.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\driverctrl.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hotactio.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luspt.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ncinst4.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcscan.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartprotector.exe


No comments: