Windows Antispyware Solution

Updated: March 20, 2013 Rogue 0 Comment

Windows Antispyware Solution is a fake security software that was identified to be a part and being distributed by Fake Microsoft Security Essentials. This infection can be acquired by visiting contracted web site that was intended to distribute rogue antivirus applications. When visitors enter the said web site, they will be greeted with a fake alert:

Microsoft Security Essentials Alert
Potential Threat Details
Microsoft Security Essentials detected potential threats that might compromise your private or damage your computer. Your access to these items may be suspended until you take an action. Click ‘show details’ to learn more.

If prompts on this alert is executed, it will automatically scan the computer and produce fake results stating that computer is harmed with various Trojan, virus and malware.  A prompt to install a copy of Windows Antispyware Solution follows and promoted this application as the only solution for computers problem. If Windows Antispyware Solution is installed, no protection neither virus removal will be performed. Instead, Windows Antispyware Solution has brought more damages on the system by altering registry and system files. Remove Windows Antispyware Solution as soon as possible with your installed antivirus application. A solution provided on this page can also be used to get rid of Windows Antispyware Solution from an infected computer.

Screen Shot Image:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Windows Antispyware Solution Removal Procedures

Manual Removal:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “Windows Antispyware Solution”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
(random characters).exe

2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the computer and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to Windows Antispyware Solution Virus.
4. Registry entries created by Windows Antispyware Solution must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of Windows Antispyware Solution start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
(random characters).exe

7. Click Apply and restart Windows.

Windows Antispyware Solution Removal Tool:
In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.

Using Portable SuperAntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be remove as well. Click here to download and run SAS Portable Scanner.

Technical Details and Additional Information:

If Windows Antispyware Solution is installed, it will begin to display fake alerts as an scare tactics to mislead victims:

System component corrupted!
System reboot error has occurred due to lsass.exe system process failure.
This may be caused by severe malware infections.
Automatic restore of lsass.exe backup copy completed.
The correct system performance can not be resumed without eliminating the cause of lsass.exe corruption.

Malicious Files Added by Windows Antispyware Solution:
%UserProfile%\ApplicationData\<random>.exe

Windows Antispyware Solution Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\Current Version\Winlogon “Shell” = ‘%UserProfile%\Application Data\.exe’