We have become aware of another malicious program that is using fake Microsoft Security Essentials Alert. This time it is called Windows Error Correction. We are sorry to inform you that this virus may appear in front of your desktop just out of the blue – without your invitation. Even though it makes you participate in its installation process.
So, how is Windows Error Correction normally brought to PC? Suddenly the user faces fake Microsoft Security Essentials Alert in front of the desktop. The users starts thinking that what this alert tells is true. The information contained in it specifies that the PC is infected with some serious virus – unknown Win32 Trojan. Then this fake alerts pretends to be looking for the solution on how to remove such supposedly available virus, and so, after user clicking the buttons offered by this alert the supposed solution is detected – this is when the name Windows Error Correction is first mentioned on the attacked PC. The user think that this is the remedy for elimination of the detected program and thus installs it. Then the system is forcedly rebooted, and the users is in front of the common interface of Windows Error Correction. This virus immediately launches fake system scan reporting plenty of infections. It is peculiar that it claims to have fixed some problems, but still it says there are many other threats that are still present. Of course, it would not do it without you first paying for this program. Be not deceived. All such supposedly identified problems are fake and must not be treated seriously. Most probably the only infection available on your system is Windows Error Correction.
At this time probably you should be confident in the fact that Windows Error Correction is the malware that must be removed. There are several ways on how to do it. Generally speaking, you may either delete it automatically, by referring to some decent anti-virus program, or you may get rid of it by removing its files and registry entries. The choice is yours. Below please find our detailed removal recommendations. However, make sure to read all of them for successful virus removal.
Windows Error Correction automatic remover:
Before downloading and running GridinSoft Trojan Killer for removal of Windows Error Correction several additional preparatory steps need to be done. This is necesary, because Windows Error Correction blocks your Internet connection, and you will not be able to run GridinSoft Trojan Killer. In order to prevent this blockage please take the following sequence of steps:
1. Make sure that your Operating System is tuned up in such a mode that hidden files and folders of your PC are viewable. The instruction on how to do it can be found here for Windows XP and here for Windows Vista/7.
2. Choose “View” tab in the window that appeared, and in the advanced settings choose the option “Show hidden files and folders”. Press OK.
3. Go to the folder %User Profile%\Application Data.
Important! Depending on the Operating System of your computer, %UserProfile% stands for C:\Documents and Settings\[Current User] for Windows XP and C:\Users\[Current User] for Windows Vista/7.
In other words, the folder that should be opened is as follows, depending on the operating system:
%SysDrive%Documents and Settings[Current User]Application Data for Windows XP
%SysDrive%Users[Current User]Application Data for Windows Vista/7.
In this folder there will be the main executable file of Windows Error Correction, having some random name.
4. Rename the above-mentioned executable file into some other name of your choice and restart your computer. Upon the system restart Windows Error Correction will no longer block your Internet browser.
5. Download the latest version of GridinSoft Trojan Killer to your infected computer, install it and run it.
The procedure for removal of Windows Error Correction is silimar to the procedure for removal of Windows Privacy Agent.See the video below:
Windows Error Correction manual removal guide:
Delete Windows Error Correction files:
Delete Windows Error Correction registry entries:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell “%AppData%\[random].exe”