1 of 5
Danger level 9
Type: Rogue Anti-Spyware
Common infection symptoms:
  • Blocks internet connection
  • Block exe files from running
  • Installs itself without permissions
  • Connects to the internet without permission
  • Slow internet connection
  • System crashes
  • Annoying Pop-up's
  • Slow Computer
Infection Video Windows Antivirus Machine

Windows Antivirus Machine

If you have a legitimate but outdated antivirus program, do not think that Windows Antivirus Machine can replace it and protect your PC, because this program is a fake security application created to lure you into buying its imaginary full version. The product you are expected to acquire is non-functional, because all the operations of the program are simulated, which means that the threats, scans of the system and pop-up messages are a bluff. Whenever you find that Windows Antivirus Machine has invaded your PC, remove this infection as soon as you can.

Windows Antivirus Machine cannot protect your data, because it replaces Windows Active Guard, Windows Security Renewal, Windows Home Patron and other fraudulent applications that are attributed to the Rogue.VirusDoctor family. All the members of the family use the same scare tactics to make the user buy the full version of the infection. Besides displaying such bogus threats as Trojan-PSW, Trojan.Win32.Qhost, Virus.Win32.Sality and others, the malware displays bogus pop-up warnings pushing the user to activate Windows Antivirus Machine. Below, you will find some of the most popular pop-up messages which should be ignored if the system is infected with this cunning program:

Error
Keylogger activity detected. System information security is at risk. It is recommended to activate protection and run a full system scan.

Error
Attempt to run a potentially dangerous script detected. Full system scan is highly recommended.

Error
Potential malware detected.
It is recommended to activate protection and perform a thorough system scan to remove the malware.

Bogus notifications pushing the user to buy the full version are displayed wherever possible, and they should be ignored however convincing they may seem to be:

Recommended:
Activate Windows Antivirus Machine to get ultimate protection against Identity Theft, Viruses, Malware and other threats!

Recommended:
Please click “Remove All” button to erase all infected files and protect your PC.

You will protect your computer if you remove Windows Antivirus Machine with a reliable spyware removal tool, which will also protect the system against further infections. If you do not get rid of this mischievous application, you will not be able to access the Internet, launch some executable files and access Task Manager and Registry Editor. For example, for the manual removal of Windows Antivirus Machine, Task Manager and Registry Editor have to be accessible, because it is necessary to stop the rogue-related processes and delete malicious registry entries injected by the infection. However, it is highly advisable to remove Windows Antivirus Machine automatically, which means that an antispyware or antimalware program should be used.

To download a spyware removal application, restore the access to Internet by registering the infection with an activation key. Do not make any purchases to get it, because it is provided for you at no charge. Once you have “activated” the infection, open your internet browser and download a reputable and powerful application to delete Windows Antivirus Machine and protect the system.

Activation key: 0W000-000B0-00T00-E0020

Download Spyware Removal Tool to Remove* Windows Antivirus Machine
  • Quick & tested solution for Windows Antivirus Machine removal.
  • 100% Free Scan for Windows

How to renew your internet connection:

This rogue antispyware blocks your Internet connection to prevent you from removing the rogue application. To enable the Internet connection, please follow these instructions:
  1. Open Internet Explorer and go to >Tools< select >Internet Options<

  2. Select >Connections<

  3. Select >LAN Settings<

  4. Now you need to uncheck the checkbox labeled >Use a proxy server for your LAN< in Proxy Server section. Then press the >OK< button to close this screen and press the >OK< button to close the Internet Options screen.

  5. Now you can download the SpyHunter scanner and remove the infection.

Download Spyware Removal Tool to Remove* Windows Antivirus Machine
  • Quick & tested solution for Windows Antivirus Machine removal.
  • 100% Free Scan for Windows
disclaimer

How to manually remove Windows Antivirus Machine

Files associated with infection (Windows Antivirus Machine):

%AppData%\NPSWF32.dll
%AppData%\Protector-[Random].exe
%AppData%\result.db
%AppData%\1st$0l3th1s.cnf
%CommonStartMenu%\Programs\Windows Antivirus Machine.lnk
%Desktop%\Windows Antivirus Machine.lnk

Dynamic Link Libraries to remove (Windows Antivirus Machine):

%AppData%\NPSWF32.dll

Processes to kill (Windows Antivirus Machine):

%AppData%\Protector-[Random].exe

Remove registry entries (Windows Antivirus Machine):

HKEY_CURRENT_USER\Software\ASProtect
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "otbpxlqhjd"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alevir.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[1].exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfmessenger.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protector.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srng.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tsadbot.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xp_antispyware.exe
Disclaimer

Post comment — WE NEED YOUR OPINION!

Comment:
Name:
Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.