Windows Interactive Safety – removal guide

Windows Interactive Safety is nothing but the scareware that is targeting many computers all over the world now. The malware belongs to the FakeVimes rogue family, there have been plenty of other similar samples. Combating such malwares is a challenge for many security companies, blogs and forums, that’s for sure. Let us review this fake antivirus and search for the proper solution on how to eliminate its malicious roots from the computer that became infected with it.

It is not a surprising news that Windows Interactive Safety tries to imitate the traits of some legitimate security software. For this purpose it will not hesitate to run all kinds of various fake system scans each time you turn the PC on. By the way, the malware amends your system in order to permit itself to be started together with Windows OS (whatever version of it you have). This is, no doubt, very annoying when you see the unwanted application running on your machine that was launched without your consent. In addition, it also slows down your PC considerably.

When Windows Interactive Safety is on your PC you can expect that it will run many imitated scans of your system and will report various infections that aren’t even available on your PC. At this point you must be very careful not to trust any information you get from this malware. It will attempt to persuade you to buy its fake license which is not able to remove threats. This license is called “ultimate protection”, but this is not so, of course. This is, on the contrary, some ultimate deceit, and some users were deceived like that.

Hopefully, this is not the case with you, and you will never put your trust into what this hoax tells you. Instead of doing this you’d better remove this nasty pest from your PC as soon as possible. We recommend that you download GridinSoft Trojan Killer for these purposes. Follow the malware removal guide you see below.

Windows Interactive Safety automatic remover:

Removal video guide:

Windows Interactive Safety manual remover:

Delete Windows Interactive Safety files:
Protector-[rnd].exe in %AppData% folder
Delete Windows Interactive Safety registry entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Inspector %AppData%\Protector-[rnd].exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnHTTPSToHTTPRedirect 0
HKCU\Software\Microsoft\Windows\CurrentVersion\Settings\ID 4
HKCU\Software\Microsoft\Windows\CurrentVersion\Settings\UID [rnd]
HKCU\Software\Microsoft\Windows\CurrentVersion\Settings\net [date of installation]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ConsentPromptBehaviorAdmin 0
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ConsentPromptBehaviorUser 0
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\EnableLUA 0
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe\Debugger svchost.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe\Debugger svchost.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE\Debugger svchost.exe

Leave a Comment