Windows Express Help

18 February 2011 Rogue 0 Comment

Windows Express Help is a rogue security software that was found to be included in the family of programs that uses a fake MS Security Essentials alert to be able to deceive computer users. This can be acquired when visiting malicious web sites that will suddenly pop-up the said alert. When executed, it will automatically scan the computer and detects numerous threats that does not really exists on the computer. Solving this problems with its own solution will require user to download an unregistered copy of Windows Express Help as recommended. When Windows Express Help is installed on the system, annoyances will never stop, in fact it will be much worst when an excessive pop-up alerts begins to display on the computer screens forcing users to obtain the registered version of Windows Express Help.

The real and only solution to this computer problem is to remove Windows Express Help itself. As mentioned, this is not a legitimate anti-virus program and is not capable of removing virus neither protect a computer from malicious attacks. Obtaining the Windows Express Help registration key is a waste of money and credit card used will be charged double. Remove Windows Express Help virus with only the trusted security application. Included in this page is a step-by-step procedure to get rid of Windows Express Help and all of its associated components.

Screen Shot Image:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Windows Express Help Removal Procedures

Manual Removal:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “Windows Express Help”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
(random characters).exe

2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the computer and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to Windows Express Help Virus.
4. Registry entries created by Windows Express Help must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of Windows Express Help start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
(random characters).exe

7. Click Apply and restart Windows.

Windows Express Help Removal Tool:
In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.

Using Portable SuperAntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be remove as well. Click here to download and run SAS Portable Scanner.

Technical Details and Additional Information:

Malicious Files Added by Windows Express Help:
%UserProfile%\Application Data\[random].exe

Windows Express Help Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon “Shell” = ‘%UserProfile%\Application Data\[random].exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe “Debugger” = ‘svchost.exe’