Windows Safety Series rogue. The way it can be eliminated with.

There is a new virus called Windows Safety Series inside the web. As always we wants you to be aware of such viruses like Windows Safety Series. When the rogue gets into your system it tries to convince you that it is a good program. In fact, nowadays hackers have figured out the way how their malicious programs can overcome some of our antiviruses. That is why when rogues like Windows Safety Series penetrate inside your system your antivirus (if you have any) does not determine it as a threat at all. It just does not see it. It can be one of the reasons why users can actually buy fake antiviruses. Be very careful!

Windows Safety Series
Windows Safety Series

Windows Safety Series comes into your system with one main goal – your money. It wants you to pay for its malicious product and it will try to do anything it takes to achieve it. You will be provided with a lot of different annoying pop-ups and system messages about your system being infected. Just ignore everything Windows Safety Series shows you. Because if you do the purchase of this malware you will just get nothing. Remember, Windows Safety Series is a virus not a good program.

We recommend you to eliminate the rogue with the help of our anti-malware program GridinSoft Trojan Killer. This is a program you can really count on. If you have some troubles with the removal process or any questions about the virus, you can always write to our Support Team. You can watch the video removal guide of the simial virus here.

Windows Safety Series automatic remover:

Windows Safety Series manual remover:

Delete Windows Safety Series files:
Protector-[rnd].exe in %AppData% folder
Delete Windows Safety Series registry entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Inspector %AppData%\Protector-[rnd].exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnHTTPSToHTTPRedirect 0
HKCU\Software\Microsoft\Windows\CurrentVersion\Settings\ID 4
HKCU\Software\Microsoft\Windows\CurrentVersion\Settings\UID [rnd]
HKCU\Software\Microsoft\Windows\CurrentVersion\Settings\net [date of installation]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ConsentPromptBehaviorAdmin 0
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ConsentPromptBehaviorUser 0
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\EnableLUA 0
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe\Debugger svchost.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe\Debugger svchost.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE\Debugger svchost.exe

Leave a Comment

*