How to remove Windows Universal Tool

Windows Universal Tool is a rogue security product that pretends to find system and registry errors on a victim’s machine in order to frighten him or her into purchasing this useless application.

Windows Universal Tool graphic interface



(Click on graphic to enlarge)

How to remove Windows Universal Tool:

If Windows Universal Tool has infected your PC, you should remove it immediately. Click here to use VIPRE to remove Windows Universal Tool from your computer now.

How to remove Palladium

Palladium is a rogue security product that pretends to find malicious code on a victim’s machine in order to frighten him or her into purchasing this useless application. It replaces the ThinkPoint/HDDoctor rogues.

VIPRE detection name: Palladium.FakeRean.

Palladium online-scanner scam

(Click on graphic to enlarge)

Palladium splash screen


(Click on graphic to enlarge)

Palladium graphic interface



(Click on graphic to enlarge)

Palladium warning screen



(Click on graphic to enlarge)

How to remove Palladium:

If  Palladium has infected your PC, you should remove it immediately. Click here to use VIPRE to remove Palladium from your computer now.

How to remove Spyware Protection

Spyware Protection is a rogue security product that pretends to find malicious code on a victim’s machine in order to frighten him or her into purchasing this useless application.

VIPRE detects it as SpywareProtection.FakeRean

SpywareProtection uses a PDF exploit which VIPRE detects as Exploit.PDF-JS.Gen (v)

SpywareProtection graphic interface


(Click on graphic to enlarge)

How to remove Spyware Protection:

Spyware Protection installs itself in a module: %APPDATA%\defender.exe.

If  Spyware Protection has infected your pc, you should remove it immediately. Click here to use VIPRE to remove Spyware Protection from your computer now.

How to remove HDDoctor

HDDoctor is a rogue security product in the FakeRean family that pretends to find system errors on a victim’s machine in order to frighten him or her into purchasing this useless application.

It will automatically reboot the computer with its fake windows reboot.

Unlike the ThinkPoint with its fake Security Essentials fake alert this one uses other fake alerts.

HDDoctor warning screens:

 
(Click on graphic to enlarge)

 
(Click on graphic to enlarge)

 
(Click on graphic to enlarge)

HDDoctor graphic user interface


(Click on graphic to enlarge)

How to remove HDDoctor:

If HDDoctor has infected your pc, you should remove it immediately. Click here to use VIPRE to remove HDDoctor from your computer now.

ThinkPoint

ThinkPoint is a rogue security product that pretends to find malicious code on a victim’s machine in order to frighten him or her into purchasing this useless application.

ThinkPoint is downloaded by the (existing) fake Microsoft Security Essentials alert online scam. However, the malware writers have changed the code so the downloader is copied to the users profile folder and is run after a reboot. Previously, the fake Security Essentials alert displayed fake scan results in order to get the user to chose a security product from a list of different names (which actually resulted in the same install.)

Initial fake Microsoft Security Essentials Alert screen:




(Click on graphic to enlarge)

“Click OK” screen “to allow operation system (sic) to install the trial version of ThinkPoint(c)."



(Click on graphic to enlarge)

ThinkPoint GUI:



(Click on graphic to enlarge)

Payment screen:


 
(Click on graphic to enlarge)

Splash screen:




(Click on graphic to enlarge)

Threat Name: ThinkPoint.FakeRean

How to remove ThinkPoint:

When you fall victim to the ThinkPoint rogue security application, the downloader reboots your machine then presents the victim with its own scanning screen on a Windows blue screen.

 
(Click on graphic to enlarge)

Once the machine is rebooted, the rogue takes over the machine by preventing Explorer.exe to load (which means, the desktop will not load, either). If you click on the X in the upper right corner to close out of ThinkPoint, you are then presented with the “unprotected startup” screen.

A victim can’t get around the ThinkPoint screen because “current settings don’t allow unprotected startup.”

 
(Click on graphic to enlarge)

However, ThinkPoint actually has an operating “settings” selection with a drop-down box that includes a checkbox “Allow unprotected startup.” You can close the ThinkPoint window and load your desktop once that has been checked. From there, you can use Windows Task Manager to stop hotfix.exe -- the rogue’s main file.


(Click on graphic to enlarge)

If  ThinkPoint has infected your pc, you should remove it immediately. Click here to use VIPRE to remove ThinkPoint from your computer now.

AntiSpy Safeguard

AntiSpy Safeguard is in the FakeRean family of rogue security products. VIPRE detects it as Trojan.Win32.Generic.pak!cobra. Like all rogues, it does a fake scan of your computer then tells you it has found malicious code.

(click to enlarge graphic)

It requires you to pay for the fake software before it “cleans” your machine of the fictitious infections.

(click to enlarge graphic)

One way (there may be others) that AntiSpy Safeguard is delivered is through a phony “Microsoft Security Essentials Alert” which is displayed by a Trojan.

Basically, it mimics the idea of VirusTotal, (http://www.virustotal.com/ ) a site which enables you to see how 40 legitimate security companies identify a sample of malicious code that you submit.

The downloader copies itself into multiple folders under different names. After five to 15 minutes it generates a fake alert pop-up window:

(click to enlarge graphic)

If you click ANY of the four buttons on the scary “Potential threat details” screen, it takes you to a web site that shows you how different anti-malware products allegedly identify the malware that is (not really) on your computer. It includes a long list of legitimate ones, which, oddly enough find no infection on your machine.

However, the display shows that some of them -- all of which are rogues -- have identified malicious files. They have a “free install” button listed next to their names. Clicking on the buttons installs the rogues. (AntiSpy Safeguard is lower on list and not shown).

(click to enlarge graphic)

To Remove AntiSpy Safeguard:

If AntiSpy Safeguard has infected your PC, you should remove it immediately. Click here to use VIPRE to remove AntiSpy Safeguard from your computer now.

Major Defense Kit

Major Defense Kit is in the FakeRean family of rogue security products. VIPRE detects it as Trojan.Win32.Generic.pak!cobra. Like all rogues, it does a fake scan of your computer then tells you it has found malicious code.

(click to enlarge graphic)

It requires you to pay for the fake software before it “cleans” your machine of the fictitious infections.

(click to enlarge graphic)

One way (there may be others) that Major Defense Kit is delivered is through a phony “Microsoft Security Essentials Alert” which is displayed by a Trojan.

Basically, it mimics the idea of VirusTotal, (http://www.virustotal.com/ ) a site which enables you to see how 40 legitimate security companies identify a sample of malicious code that you submit.

The downloader copies itself into multiple folders under different names. After five to 15 minutes it generates a fake alert pop-up window:

(click to enlarge graphic)

If you click ANY of the four buttons on the scary “Potential threat details” screen, it takes you to a web site that shows you how different anti-malware products allegedly identify the malware that is (not really) on your computer. It includes a long list of legitimate ones, which, oddly enough find no infection on your machine.

However, the display shows that some of them -- all of which are rogues -- have identified malicious files. They have a “free install” button listed next to their names. Clicking on the buttons installs the rogues.


(click to enlarge graphic)

To Remove Major Defense Kit:

If Major Defense Kit has infected your PC, you should remove it immediately. Click here to use VIPRE to remove Major Defense Kit from your computer now.

Pest Detector 4.1

Pest Detector 4.1 is in the FakeRean family of rogue security products. VIPRE detects it as Trojan.Win32.Generic.pak!cobra. Like all rogues, it does a fake scan of your computer then tells you it has found malicious code.

(click to enlarge graphic)

It requires you to pay for the fake software before it “cleans” your machine of the fictitious infections.

(click to enlarge graphic)

One way (there may be others) that Pest Detector 4.1 is delivered is through a phony “Microsoft Security Essentials Alert” which is displayed by a Trojan.

Basically, it mimics the idea of VirusTotal, (http://www.virustotal.com/ ) a site which enables you to see how 40 legitimate security companies identify a sample of malicious code that you submit.

The downloader copies itself into multiple folders under different names. After five to 15 minutes it generates a fake alert pop-up window:

(click to enlarge graphic)

If you click ANY of the four buttons on the scary “Potential threat details” screen, it takes you to a web site that shows you how different anti-malware products allegedly identify the malware that is (not really) on your computer. It includes a long list of legitimate ones, which, oddly enough find no infection on your machine.

However, the display shows that some of them -- all of which are rogues -- have identified malicious files. They have a “free install” button listed next to their names. Clicking on the buttons installs the rogues. (Pest Detector is lower on the screen and not shown.)

(click to enlarge graphic)

To Remove Pest Detector 4.1:

If Pest Detector 4.1 has infected your PC, you should remove it immediately. Click here to use VIPRE to remove Pest Detector 4.1 from your computer now.

Peak Protection 2010

Peak Protection 2010 is in the FakeRean family of rogue security products. VIPRE detects it as Trojan.Win32.Generic.pak!cobra. Like all rogues, it does a fake scan of your computer then tells you it has found malicious code. It requires you to pay for the fake software before it “cleans” your machine of the fictitious infections.

(click to enlarge graphic)

One way (there may be others) that Peak Protection 2010 is delivered is through a phony “Microsoft Security Essentials Alert” which is displayed by a Trojan.

Basically, it mimics the idea of VirusTotal, (http://www.virustotal.com/ ) a site which enables you to see how 40 legitimate security companies identify a sample of malicious code that you submit.

The downloader copies itself into multiple folders under different names. After five to 15 minutes it generates a fake alert pop-up window:

(click to enlarge graphic)

If you click ANY of the four buttons on the scary “Potential threat details” screen, it takes you to a web site that shows you how different anti-malware products allegedly identify the malware that is (not really) on your computer. It includes a long list of legitimate ones, which, oddly enough find no infection on your machine.

However, the display shows that some of them -- all of which are rogues -- have identified malicious files. They have a “free install” button listed next to their names. Clicking on the buttons installs the rogues.

(click to enlarge graphic)

To Remove Peak Protection:

If Peak Protection 2010 has infected your PC, you should remove it immediately. Click here to use VIPRE to remove Peak Protection 2010 from your computer now.

Red Cross Antivirus

Red Cross Antivirus is in the FakeRean family of rogue security products. VIPRE detects it as Trojan.Win32.Generic.pak!cobra. Like all rogues, it does a fake scan of your computer then tells you it has found malicious code. It requires you to pay for the fake software before it “cleans” your machine of the fictitious infections.

(click to enlarge graphic)

One way (there may be others) that Red Cross Antivirus is delivered is through a phony “Microsoft Security Essentials Alert” which is displayed by a Trojan.

Basically, it mimics the idea of VirusTotal, (http://www.virustotal.com/ ) a site which enables you to see how 40 legitimate security companies identify a sample of malicious code that you submit.

The downloader copies itself into multiple folders under different names. After five to 15 minutes it generates a fake alert pop-up window:

(click to enlarge graphic)

If you click ANY of the four buttons on the scary “Potential threat details” screen, it takes you to a web site that shows you how different anti-malware products allegedly identify the malware that is (not really) on your computer. It includes a long list of legitimate ones, which, oddly enough find no infection on your machine.

However, the display shows that some of them -- all of which are rogues -- have identified malicious files. They have a “free install” button listed next to their names. Clicking on the buttons installs the rogues.

(click to enlarge graphic)

To Remove Red Cross Antivirus:

If Red Cross Antivirus has infected your PC, you should remove it immediately. Click here to use VIPRE to remove it from your computer now.