Windows Safety Guarantee
Windows Safety Guarantee is a rogue security application that may pretend as a legitimate anti-virus application and will be introduce as part of a Microsoft Security Essentials Alert. This rogue program was developed by the same group who created and spread other rogue programs like Windows Optimal Tool and Windows Optimal Settings. They all share the same graphical user interface and displays the same threat as a way to persuade computer users into obtaining the Windows Optimal Tool registration key. It is not free, victims must pay a corresponding fee using credit card account to be processed on a fraudulent payment web site.
Ignore Windows Optimal Tool. In fact, this fake AV must be immediately remove from the computer. With the help of the solutions provided on this page, Windows Optimal Tool virus can be taken out without spending a money for this fake security software. It is important to have a full version of anti-malware application to prevent future attack and invasion of rogue applications like Windows Optimal Tool.
Screen Shot Image:
Damage Level: Medium
Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7
Windows Safety Guarantee Removal Procedures
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “Windows Safety Guarantee”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the computer and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to Windows Safety Guarantee Virus.
4. Registry entries created by Windows Safety Guarantee must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of Windows Safety Guarantee start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
7. Click Apply and restart Windows.
Windows Safety Guarantee Removal Tool:
In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.
Using Portable SuperAntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be remove as well. Click here to download and run SAS Portable Scanner.
Technical Details and Additional Information:
If Windows Safety Guarantee is installed, it will never stop to pop-up fake alert messages to deceive computer users:
Name: c:\program files\firefox\firefox.exe
Application that seems to be a key-logger is detected. System information security is at risk. It is recommended to enable the security mode and run total System scanning.
Malicious Files Added by Windows Safety Guarantee:
Windows Safety Guarantee Registry Entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore “DisableSR ” = ’1′
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe “Debugger” = ‘svchost.exe’
Alternative Removal Method for Windows Safety Guarantee
Option 1 : Use Windows System Restore to return Windows to previous state
If Windows Safety Guarantee enters the computer, there is a big chance that Windows files, registry entries and other essential components are also infected. System Restore can reinstate clean system files by restoring the configuration to an earlier date. The method also replaces compromised files with a clean version. If you have a saved restore point before Windows Safety Guarantee infiltrates the PC, we highly encourage you to execute this procedure if none of the above works. You may proceed with Windows System Restore, click here to see the full procedure.