1 of 5
Danger level 9
Type: Rogue Anti-Spyware
Common infection symptoms:
  • Blocks internet connection
  • Block exe files from running
  • Installs itself without permissions
  • Connects to the internet without permission
  • Slow internet connection
  • System crashes
  • Annoying Pop-up's
  • Slow Computer
  • Shows commercial adverts
Infection Video Windows Custom Safety

Windows Custom Safety

Having Windows Custom Safety on the computer is not the best choice because this is a cunning program designed to mislead you into believing in the vulnerability of the system. The rogue will offer you to activate it to have “ultimate protection” of the system. Do not believe a word of the rogue and remove it from the system.

At the beginning, you might think that Windows Custom Safety is a very useful application, because it scans the system, however the scans are simulated, and you should not trust the results of the scans. The rogue provides you with a table of bogus threats such as viruses, Trojans and malware. Interestingly, Windows Custom Safety cannot remove these “infections” for free. According to Windows Custom Safety, if you want to remove those supposedly real infections, you have to purchase the full version. Please do not trust Windows Custom Safety, because your money is what the cyber criminals behind this rogue are dreaming of and delete this malware and protect the system.

The easiest way to get rid of Windows Custom Safety is to remove it by using a legitimate antispyware tool. All that you need is to install a powerful tool which will kill the infection at once and not cause damage to the system. Windows Custom Safety will be removed completely, because only the files of the infection are eliminated by antispyware. If you try to delete Windows Custom Safety manually, you might delete files which are necessary for the system to function properly. Thus, get rid of Windows Custom Safety automatically and use your PC as usual.

UPDATE

Windows Custom Safety derives from the Rogue.VirusDoctor group of rogue antispywares, and Windows Privacy Module, Windows Maintenance Suite and Windows PC Aid are only a few clones of the newly distributed rogue. All of the viruses in this family were made to resemble legitimate Windows programs, so if you notice familiar controls or layouts, be sure that it is just an illusion, and you should hurry up to delete the rogue! Unfortunately, this task will be aggravated by removed controls over the Internet, Registry Editor, Task Manager and running of most executables, which is why before you delete the rogue, you should get rid of these symptoms.

To restore Internet connection, below you will find connection renewal instructions, and to remove other symptoms, you can use this registration key:

0W000-000B0-00T00-E0020

This will also help you remove such bogus security notifications:

Warning! Spambot detected!
Attention! A spambot is sending viruses from your e-mail has been detected on your PC.
Yes, protect my PC and remove spambot now (Recommended)

Warning
Firewall has blocked a program from accessing the Internet
C:\program files\internet explorer\iexplore.exe
is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server.

Error
Potential malware detected.
It is recommended to activate protection and perform a thorough system scan to remove the malware.

Download Spyware Removal Tool to Remove* Windows Custom Safety
  • Quick & tested solution for Windows Custom Safety removal.
  • 100% Free Scan for Windows

How to renew your internet connection:

This rogue antispyware blocks your Internet connection to prevent you from removing the rogue application. To enable the Internet connection, please follow these instructions:
  1. Open Internet Explorer and go to >Tools< select >Internet Options<

  2. Select >Connections<

  3. Select >LAN Settings<

  4. Now you need to uncheck the checkbox labeled >Use a proxy server for your LAN< in Proxy Server section. Then press the >OK< button to close this screen and press the >OK< button to close the Internet Options screen.

  5. Now you can download the SpyHunter scanner and remove the infection.

Download Spyware Removal Tool to Remove* Windows Custom Safety
  • Quick & tested solution for Windows Custom Safety removal.
  • 100% Free Scan for Windows
disclaimer

How to manually remove Windows Custom Safety

Files associated with Windows Custom Safety infection:

Protector-byrm.exe
Protector-aayq.exe
Windows Custom Safety.lnk
Windows Custom Safety.lnk
Protector-byrm.exe
Protector-oofi.exe
Protector-aayq.exe
%AppData%\NPSWF32.dll
%AppData%\Protector-[Random].exe
%AppData%\result.db
%AppData%\1st$0l3th1s.cnf
%CommonStartMenu%\Programs\Windows Custom Safety.lnk
%Desktop%\Windows Custom Safety.lnk
Protector-oofi.exe

Windows Custom Safety DLL's to remove:

%AppData%\NPSWF32.dll

Windows Custom Safety processes to kill:

Protector-aayq.exe
Protector-byrm.exe
Protector-oofi.exe
Protector-aayq.exe
%AppData%\Protector-[Random].exe
Protector-byrm.exe
Protector-oofi.exe

Remove Windows Custom Safety registry entries:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "otbpxlqhjd"
HKEY_CURRENT_USER\Software\ASProtect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alevir.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[1].exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfmessenger.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protector.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srng.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tsadbot.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xp_antispyware.exe
Disclaimer

Post comment — WE NEED YOUR OPINION!

Comment:
Name:
Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.