1 of 7
Danger level 9
Type: Rogue Anti-Spyware
Common infection symptoms:
  • Blocks internet connection
  • Block exe files from running
  • Installs itself without permissions
  • Connects to the internet without permission
  • Slow internet connection
  • System crashes
  • Annoying Pop-up's
  • Slow Computer
Infection Video Windows Safety Series

Windows Safety Series

You should use an appropriate computer security application to protect your data properly. Windows Safety Series is one of fraudulent applications which should not be regarded as suitable for the protection, because it is a computer infection with an interface of Windows applications. Because of its appealing characteristics, the malware is often mistaken for a legitimate application; however, it belongs to the Rogue.VirusDoctor family that consists of the rogue’s predecessors such as Windows Secure Workstation, Windows Anti-Malware Patch, Windows Virtual Security and many others.

As a clone of the malicious applications, Windows Safety Series applies the same scare tactics to deceive Windows users into considering the possibility of buying its non-functional full version, which is, of course, presented as the best product to remove such “threats” as Trojan.Win.32.Qhost, Virus.Win32, Sality, Adware.Win32.BHO and many others. If you think that you can save money and delete the threats on your own, you are wrong, because they do not exist in the system. Hence, you should also ignore such bogus notifications as given below:

Error
Keylogger activity detected. System information security is at risk. It is recommended to activate protection and run a full system scan.

Error
Attempt to run a potentially dangerous script detected. Full system scan is highly recommended.

Error
Potential malware detected.
It is recommended to activate protection and perform a thorough system scan to remove the malware.

Besides receiving simulated notifications, you will also find some malfunctions of the system’s performance. Access to the Internet and some Windows applications will be disabled, not to mention the fact that the registry, where many changes regarding the performance of the machine are done, and Task Manager are inaccessible, as well. Non-responsiveness of some parts of the system and lack of access to the Internet are the most noticeable features which are supposed to be regarded as the consequences of having “dangerous” infections. The sooner you remove Windows Safety Series, the sooner the system starts returns to its former condition.

To make the removal of Windows Safety Series easier, copy and paste the activation key provided below to an activation box and register the rogue so that no annoying scans and misleading warnings are displayed. Moreover, if you want to delete the rogue manually, you will manage to access the registry and delete irrelevant registry entries. Do not forget to delete the rogue-related files and processes to fully remove Windows Safety Series. If you see that the manual removal of this mean application is too confusing, after having activated the malware, download a reliable antispyware application to delete the infection automatically. The application will detect and terminate the infection, and the only thing that you will have to do afterwards is to repeat the scanning regularly to make sure that the system is secure.

Activation key: 0W000-000B0-00T00-E0020

Download Spyware Removal Tool to Remove* Windows Safety Series
  • Quick & tested solution for Windows Safety Series removal.
  • 100% Free Scan for Windows

How to renew your internet connection:

This rogue antispyware blocks your Internet connection to prevent you from removing the rogue application. To enable the Internet connection, please follow these instructions:
  1. Open Internet Explorer and go to >Tools< select >Internet Options<

  2. Select >Connections<

  3. Select >LAN Settings<

  4. Now you need to uncheck the checkbox labeled >Use a proxy server for your LAN< in Proxy Server section. Then press the >OK< button to close this screen and press the >OK< button to close the Internet Options screen.

  5. Now you can download the SpyHunter scanner and remove the infection.

Download Spyware Removal Tool to Remove* Windows Safety Series
  • Quick & tested solution for Windows Safety Series removal.
  • 100% Free Scan for Windows
disclaimer

How to manually remove Windows Safety Series

Files associated with Windows Safety Series infection:

%APPDATA%
Protector-ches.exe
%WINDIR%\SysWOW64\config\systemprofile\AppData\Roaming
%UserProfile%\Local Settings\Application Data
%AppData%\NPSWF32.dll
%AppData%\Protector-[Random].exe
%AppData%\result.db
%AppData%\1st$0l3th1s.cnf
%CommonStartMenu%\Programs\Windows Safety Series.lnk
%Desktop%\Windows Safety Series.lnk
%LOCALAPPDATA%
%WINDIR%\system32\config\systemprofile\AppData\Roaming
%SystemDrive%\Documents and Settings\LocalService\Application Data

Windows Safety Series DLL's to remove:

%AppData%\NPSWF32.dll

Windows Safety Series processes to kill:

Protector-ches.exe
%AppData%\Protector-[Random].exe

Remove Windows Safety Series registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tsadbot.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srng.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protector.exe
HKEY_CURRENT_USER\Software\ASProtect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfmessenger.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[1].exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "otbpxlqhjd"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alevir.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xp_antispyware.exe
Disclaimer

Post comment — WE NEED YOUR OPINION!

Comment:
Name:
Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.