Windows Smart Partner

22 February 2012 Rogue 0 Comment

Windows Smart Partner is a virus that is included in the roster of rogue anti-virus programs. It is a member of a group of malware sharing the same skin for all versions. It replaces only the name for each new variant. In fact, one of its members is called Windows Protection Master. This harmful software will attempt to trick computer users like you with a fake online virus scanner. Most of the time it is hosted on their web site and in some instances, a compromised web site are used to spread this virus. You may bump into these sites without their consent. Because the Trojan that infects the system will redirect all the searches and home page of victim’s Internet browser. Once you arrived, the site will initiate a fake virus scan throwing a bunch of fake virus detection. Next, it prompts to download Windows Smart Partner to be able to clean threats found on the computer.

Once this malicious software is installed, you may notice similar scenario. Virus scan by Windows Smart Partner will launch without your command. It is very unusual for program to launch without user’s intervention unless it is fraud software. As Windows Smart Partner runs a virus scan, it is noticeable that more threats are found in a blink of time. No other legal security software can match its speed in detecting computer viruses. This is because, Windows Smart Partner do not really process system check. Its scan process is merely a tactic to bring scary results so that it may convince you to purchase the paid version of the software.

Remove Windows Smart Partner from your computer at once. There is no need to acquire its licensed version, as it will bring no good in your part. Remember that rogue program like the one Windows Smart Partner is created to swindle computer users. Follow the removal guide specifically crafted for this type of malware.

Screen Shot Image:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Added Registry Entries:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = 0
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0
HKCU\Software\Microsoft\Windows\CurrentVersion\Settings "ID" = 5
HKCU\Software\Microsoft\Windows\CurrentVersion\Settings "net" = 2012-2-21_1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashLogV.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav32.exe

Associated Files and Folders:

%Desktop%\Windows Smart Partner.lnk 
%StartMenu%\Programs\Windows Smart Partner.lnk
%AppData%\Protector-(random 3 characters).exe
%AppData%\result.db

Restore Windows Components

If this virus enters your system, there is a big chance that Windows files, registry entries and other essential components are also infected. System Restore can reinstate clean system files by restoring the configuration to an earlier date. If you have a saved restore point before this virus infiltrates the computer, please restore Windows to previous settings.

Manual Removal Procedure

1. Press Ctrl+Alt+Del on keyboard to stop the process associated to "Windows Smart Partner". When Windows Task Manager opens, go to Processes tab. Find and end this process.
(random characters).exe

2. You need to update your installed antivirus software. Please connect to the Internet and download the most recent database. This is a one-click process from your AV program’s console.

3. Thoroughly scan the computer and remove any threats found by your antivirus program. If delete option is not available, your best next choice is to quarantine the infected file. There is also a need to manually locate and delete malicious files. Please see the file section for items that are relevant to Windows Smart Partner.

4. Next, you need to remove registry entries created by Windows Smart Partner. Please refer to registry section to view entries related to the rogue program.
- (Windows 2000/XP) Go to Start > Run, type "regedit" on dialog box then press Enter on keyboard.
- (Windows Vista/7) Go to Start > Search Program and Files, type "regedit" and press Enter.

5. Exit registry editor when you are done.

6. Get rid of Windows Smart Partner start-up entry by going to Start > Run, type msconfig on the "Open" dialog box. It will launch a new window containing System Configuration Utility. Click on the Startup tab and uncheck the following item.
(random characters).exe

7. Click Apply. You need to restart the computer.

Windows Smart Partner Removal Tool

In order to remove the threat completely, you need to download and run Malwarebytes Anti-Malware. This is a free malware removal tool. If Trojan infection blocks the downloading of this program, get it using a clean computer. Rename the executable file before executing on the infected PC.