1 of 7
Danger level 9
Type: Rogue Anti-Spyware
Common infection symptoms:
  • Blocks internet connection
  • Block exe files from running
  • Installs itself without permissions
  • Connects to the internet without permission
  • Normal system programs crash immediatelly
  • Slow internet connection
  • System crashes
  • Cant change my homepage
  • Annoying Pop-up's
  • Slow Computer
Infection Video Windows Ultimate Safeguard

Windows Ultimate Safeguard

Windows Ultimate Safeguard is a mean computer application which bluffs users into purchasing its so-called full version that, in reality, does not remove any threats even if it claims so. Although it looks like antivirus software, you should not hesitate to delete it from your computer, because this rogue is a copy of Windows Antivirus Machine, Windows Active Guard and other fraudulent applications that are attributed to the Rogue.VirusDoctor family.

You will recognize Windows Ultimate Safeguard as an antivirus application, because it supposedly scans the system, which is said to be full of dangerous infections such as P2P-Worm.Win32, Trojan-Downloader.Win32.Agent, Trojan-DDos.Win32 and others. Moreover, it displays fake pop-up messages, some of which are presented below:

Error
Keylogger activity detected. System information security is at risk. It is recommended to activate protection and run a full system scan.

Error
Software without a digital signature detected. Your system files are at risk. We strongly advise you to activate your protection.

Error
Attempt to run a potentially dangerous script detected. Full system scan is highly recommended.

On top of these simulated messages, the rogue also “freezes” some system’s applications, disables access to the Internet, Task Manager and Registry Editor. The two last tools have to be active so as to remove Windows Ultimate Safeguard manually. For example, once in the system, the cunning infection injects its own registry entries in the registry and starts many malicious processes. If Task Manager and Registry are not accessible, the manual removal of the infection is impossible.

Luckily, if you register the malware, you can delete it either manually or automatically, which means that you have to restore the access to the Internet and download a malware removal tool. Once “activated”, Windows Ultimate Safeguard is disabled; therefore, it does not display scans and annoying messages and restores all lost functions. We suggest that you should remove Windows Ultimate Safeguard with an automatic spyware removal tool, which will detect and delete all the elements of the infection. However, you can always try to remove Windows Ultimate Safeguard on your own, but, please, keep in mind that if you do not know exactly how to eliminate the threats leave this procedure either to an experienced specialist or to an antispyware tool.

Activation key: 0W000-000B0-00T00-E0020

Download Spyware Removal Tool to Remove* Windows Ultimate Safeguard
  • Quick & tested solution for Windows Ultimate Safeguard removal.
  • 100% Free Scan for Windows

How to renew your internet connection:

This rogue antispyware blocks your Internet connection to prevent you from removing the rogue application. To enable the Internet connection, please follow these instructions:
  1. Open Internet Explorer and go to >Tools< select >Internet Options<

  2. Select >Connections<

  3. Select >LAN Settings<

  4. Now you need to uncheck the checkbox labeled >Use a proxy server for your LAN< in Proxy Server section. Then press the >OK< button to close this screen and press the >OK< button to close the Internet Options screen.

  5. Now you can download the SpyHunter scanner and remove the infection.

Download Spyware Removal Tool to Remove* Windows Ultimate Safeguard
  • Quick & tested solution for Windows Ultimate Safeguard removal.
  • 100% Free Scan for Windows
disclaimer

How to manually remove Windows Ultimate Safeguard

Files associated with infection (Windows Ultimate Safeguard):

%Desktop%\Windows Ultimate Safeguard.lnk
%CommonStartMenu%\Programs\Windows Ultimate Safeguard.lnk
%AppData%\1st$0l3th1s.cnf
%AppData%\result.db
%AppData%\Protector-[Random].exe
%AppData%\NPSWF32.dll

Dynamic Link Libraries to remove (Windows Ultimate Safeguard):

%AppData%\NPSWF32.dll

Processes to kill (Windows Ultimate Safeguard):

%AppData%\Protector-[Random].exe

Remove registry entries (Windows Ultimate Safeguard):

HKEY_CURRENT_USER\Software\ASProtect
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "otbpxlqhjd"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alevir.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[1].exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfmessenger.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protector.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srng.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tsadbot.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xp_antispyware.exe
Disclaimer

Post comment — WE NEED YOUR OPINION!

Comment:
Name:
Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.