Windows Remedy is fake Windows Utility that performs fake scans and displays fake errors in an attempt to scare users into buying this fake product. Windows Remedy is configured to start up when you turn on your computer, often starting up before the desktop appears. If users attempt to exit the program it will continue to run in the background causing computer slow downs, browser redirects, pop up error messages.

Manual Removal of Windows Remedy: To begin removal of Windows Remedy shut down the PC and restart in safe mode. To get to safe mode Press F8 during start up if timed correctly your given the choice to boot into safe mode, highlight it using the arrow keys and press enter. During start up if you see the windows logo it means you did not press F8 in enough time and you’ll need to restart and try again if you wish to get into safe mode. Once in safe mode begin removal of the following files in their locations listed.

• %UserProfile%\Application Data\<random>.exe

Windows Remedy Registry Entries that should be removed:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe “Debugger” = ‘svchost.exe’
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe “Debugger” = ‘svchost.exe’
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe “Debugger” = ‘svchost.exe’
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe “Debugger” = ‘svchost.exe’
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe “Debugger” = ‘svchost.exe’
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe “Debugger” = ‘svchost.exe’
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe “Debugger” = ‘svchost.exe’
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe “Debugger” = ‘svchost.exe’
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore “DisableSR ” = ‘1’

Please Contact Us Here for more information on Windows Remedy Malware/ Scareware
Need help removing Windows Remedy Malware/ Scareware or other PC problems? E-Mail Us Here

Be Sociable, Share!

•