Windows Antivirus is a computer virus disguised as a legitimate antivirus program.
venetian mask image by Christine Valin from Fotolia.com
Windows Antivirus, also referred to as Windows Antivirus Pro, is a virus disguised as an antivirus program. Windows Antivirus floods your computer with popups warning that your computer is infected. The popups say you can remove the infection by sending your financial information to Windows Antivirus. In addition to trying to take your money, Windows Antivirus may slow your computer, change your Internet and desktop settings, and decrease your available memory.
End Infected Processes
Step 1
Press "Ctrl" + "Alt" + "Delete."
Step 2
Click on the "Task Manager," and then click on the "Processes" tab.
Step 3
End the following processes. To end a process, right-click on it and select "End Process." "ANTI_files.exe," "Windows Antivirus Pro.exe," "dbsinit.exe," "svchast.exe," "desot.exe" and "WindowsAntivirusProUpdate.exe."
Delete Infected Files
Step 1
Click on the "Start" menu.
Step 2
Click on the "Search Programs and Files" box.
Step 3
Search for and delete the following files. To delete a file, right-click on it and select "Delete." Delete "WindowsAntivirusPro.url," "WindowsAntivirusPro.lnk," "WindowsAntivirusPro on the Web.lnk," "Uninstall WindowsAntivirusPro.lnk," "UserProfile\\Desktop\\Windows Antivirus Pro.lnk," "UserProfile\\Start Menu\\Programs\\Windows Antivirus Pro\\Windows Antivirus Pro.lnk," "c:\\Program Files\\Windows Antivirus Pro\\tmp\\images\\jj1.gif," "c:\\Program Files\\Windows Antivirus Pro\\tmp\\images\\jj2.gif," "c:\\Program Files\\Windows Antivirus Pro\\tmp\\images\\jj3.gif," "c:\\Program Files\\Windows Antivirus Pro\\tmp\\images\\wt3.gif," "c:\\Program Files\\Windows Antivirus Pro\\tmp\\images\\t2.gif," "c:\\Program Files\\Windows Antivirus Pro\\tmp\\images\\up1.gif," "c:\\WINDOWS\\ppp3.dat," "c:\\WINDOWS\\ppp4.dat," "c:\\WINDOWS\\system32\\bennuar.old," "c:\\WINDOWS\\system32\\sysnet.dat," "c:\\WINDOWS\\system32\\dddesot.dll," "c:\\Program Files\\Windows Antivirus Pro\\msvcm80.dll," "c:\\Program Files\\Windows Antivirus Pro\\msvcp80.dll," "c:\\Program Files\\Windows Antivirus Pro\\msvcr80.dll," "c:\\Program Files\\Windows Antivirus Pro\\tmp\\wispex.html," "UserProfile%\\Start Menu\\Programs\\Windows Antivirus Pro," "c:\\Program Files\\Windows Antivirus Pro" and "c:\\Program Files\\Windows Antivirus Pro\\tmp\\images."
Delete Infected Registry Keys
Step 1
Hold down the "Windows" key and press "R." The "Run" box opens.
Step 2
Type "regedit" (without the quotation marks) into the Run box and click "OK." The "Registry Editor" opens.
Step 3
Locate the following registry keys in the left pane of the Registry Editor and delete them. To delete a registry key, right-click on it and select "Delete."
"HKEY_CURRENT_USER\\Software\\Softimer"
"HKEY_CURRENT_USER\\Software\\Windows Antivirus Pro"
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run “Windows Antivirus Pro”
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects\\{F54AF7DE-6038-4026-8433-CC30E3F17212}
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Win Antivirus Pro\"
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\AntipPro2009_12"
"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\AntipPro2009_12"
"HKEY_USERS\\Software\\WindowsAntivirusPro"
"HKEY_CLASSES_ROOT\\CLSID\\{425882B0-B0BF-11CE-B59F-00AA006CB37D}"
"HKEY_CLASSES_ROOT\\CLSID\\{F54AF7DE-6038-4026-8433-CC30E3F17212}"
Warning
- Take great care when working in the registry. Unintentional or inadvertent changes can affect the performance of your computer.
Photo Credits
- venetian mask image by Christine Valin from Fotolia.com
