Windows Problems Solution

Updated: March 20, 2013 Rogue 0 Comment

Windows Problems Solution is a rogue anti-virus application that was presented in the fake Microsoft Security Essentials Alert. This will come on a fake online virus scanner that will detect presence of Trojan and advise visitors to remove it by Windows Problems Solution. When a copy of this program is installed, instead of removing threats it will further harm the system. Its purpose was to upset user and convince them that the only solution is to have the paid version of Windows Problems Solution. This tactic are being employed on all rogue programs particularly to earlier variants from this family like Windows Wise Protection and Windows Care Tool.

It is important to remove Windows Problems Solution virus instantly to avoid any additional threats from being downloaded into the already compromised system. The more threats it created, the harder it is to get rid of. An easy to follow step-by-step solution below can be used to remove Windows Problems Solution virus. No need to buy the registered version of the rogue program Windows Problems Solution. It won’t help in removing virus as much as it can never protect the computer from attacks.

Windows Problems Solution Screen Shot:

Critical Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Windows Problems Solution Removal Procedures

Manual Removal:
1. Stop Windows Problems Solution process by pressing Ctrl+Alt+Del. Windows Task Manager will open. Look for the following process:
(random characters).exe

2. Update your installed anti-virus program.
3. Run a full system scan and clean/delete all detected infected file(s). A manual removal of virus-related files should also be performed.
4. Edit Windows registry and delete Windows Problems Solution entries. [how to edit registry]
5. Exit registry editor.
6. Remove Windows Problems Solution start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. System Configuration Utility will open. Go to Startup tab and uncheck the following Startup item(s):
(random characters).exe

7. Click Apply and restart Windows.

Windows Problems Solution Removal Tool:
In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.

Online Virus Scanner:
Another way to remove a virus without the need to install additional anti-virus application is to perform a thorough scan with free Online Virus Scanner that can be found here or on websites of legitimate anti-virus and security provider.

Technical Details and Additional Information:

This rogue application will complicate things by displaying a bunch of fake security alerts and attempts to persuade victims into purchasing the licensed version:

System Security Warning
Attempt to modify register key entries is detected. Register entries analysis is recommended.

System component corrupted!
System reboot error has occurred due to lsass.exe system process failure.
This may be caused by severe malware infections.
Automatic restore of lsass.exe backup copy completed.
The correct system performance can not be resumed without eliminating the cause of lsass.exe corruption.

Malicious Files Added by Windows Problems Solution:
%UserProfile%\Application Data\(random characters).exe

Windows Problems Solution Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon “Shell” = ‘%UserProfile%\Application Data\(random).exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe “Debugger” = ‘svchost.exe’