Windows Restore virus – how to get rid of WindowsRestore manually

April 4, 2011 By

This malwares named Windows Restore or WinRestore belongs to the commonly known fake programs of rogue virus family. it is also known as WindowsRestore and has a clone named System Restore virus. It is 100 percent sure and confirmed that it is not a legitimate and useful computer software but a bogus and piece of fraud tools and a part of scam which offers the restoring services of your windows and system to normal and healthier state if you pay some fee for it. You might be thinking how can it be a part of scam. The Answer is that Windows-Restore virus is a fake software developed by hackers. They just want to sell this product to innocent computer users and swindle their money. To get this program purchased, They drop it into computers over internet using malicious websites ,worm and trojans. After Windows restored virus is placed in your computer, it will try to scare you with fake warnings and alerts and it will force you to buy its full version to get rid of viruses. And if unfortunately, you use your credit and buy this useless crap, It wont remove viruses and spyware from your computer but it will mess your system more and more. And there will be no way to get back they money you paid for its non-existing services.

This program is named Windows Restore, which means it offers windows restoration services. But as it is fake, you can never get your windows restored using this malicious software. Which is a sign of its being corrupt tool.

Pleaser Remember! All these warnings, alerts and virus removal offers made by Windows Restore virus are fake. This program is totally a fake software and it is specially designed to extort your money by selling its fake security products. You should ignore these warnings, avoid purchase of this program, avoid clicking any link within its popups and do not install any component of it promoted. All you have to do is to immediately remove it from your computer upon detection.


How to remove Windows Restore virus manually:

To remove this virus manually, complete the following set of tasks. Do not forget to create a backup before getting started to the manual removal guide.

Stop Windows Restore processes:
[random].exe

Remove Windows Restore Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random]”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policie \Associations “LowRiskFileTypes” = ‘{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1′
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘yes’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0′
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1′

Remove Windows Restore files:
%AppData%\Microsoft\[random].exe
%UserProfile%\Desktop\Windows Restore.lnk
%UserProfile%\Start Menu\Programs\Windows Restore\
%UserProfile%\Start Menu\Programs\Windows Restore\Windows Restore.lnk
%UserProfile%\Start Menu\Programs\Windows Restore\Uninstall Windows restore.lnk

Auto Removal

To remove this virus Automatically, We suggest following tools:

Malware Bytes Anti-Malware (Download)


StopZilla Anti-Spyware (Download)


Filed Under: 1: Spyware Removal Tagged With: , , , ,

Windows Passport Utility virus – how to get rid manually

April 2, 2011 By

Windows Passport Utility is a virus for sure which is a clone of rogue programs known as fake Windows Process Regulator and Windows Stability Center. There is nothing new in Windows Passport Utility other than its name. This bogus software tries to convince users that it is a legitimate computer security tool and it it has detected some problems with your system that can be fixed using the full version of Windows Passport Utility software. Once user is agree to install the full version of this crap tool, it will ask the user to pay the license fee. That is the goal of Windows Passport Utility to swindle your money by promoting its fake products that do not help your system get rid of problems and viruses.
fake windows passport utility Windows Passport Utility virus how to get rid manually

Windows Passport Utility is a scamware. This rogue malware displays fake warning messages and alerts on infected computer to scare users. Once your system is infected by Windows Passport Utility virus, you,ll keep getting unwanted popup alerts telling you that Windows Passport Utility has detected viruses on your computer that should be removed very soon. Please ignore all these warning and alerts. Like these ones:

Threat prevention solution found
Security system analysis has revealed critical file system vulnerability caused by severe malware attacks.
Risk of system files infection:
The detected vulnerability may result in unauthorized access to private information and hard drive data with a seriuos possibility of irreversible data loss and unstable PC performance. To remove the malware please run a full system scan. Press ‘OK’ to install the software necessary to initiate system files check. To complete the installation process please reboot your computer.

System Security Warning
Attempt to modify register key entries is detected. Register entries analysis is recommended.

Remember! All these warning messages and alerts displayed by Windows Passport Utility virus are fake. This program is specially designed to extort your money by offering you to buy its fake system security and optimization products. You should ignore these warnings, avoid buying this program, avoid its installation and immediately remove it from your computer upon detection.

How to remove Windows Passport Utility virus manually:

To remove this virus manually, complete the following set of tasks. Do not forget to create a backup before getting started to the manual removal guide.

Stop Windows Passport Utility processes:
%UserProfile%\Application Data\[random].exe

Delete Windows Passport Utility Registry Entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore “DisableSR ” = ’1′

Remove Windows Passport Utility files:
%UserProfile%\Application Data\[random].exe

Auto Removal

To remove this virus Automatically, We suggest following tools:

Malware Bytes Anti-Malware (Download)


Super Anti Spyware (Download)


StopZilla Anti-Spyware (Download)

Filed Under: 1: Spyware Removal Tagged With: , ,