1 of 6
Danger level 9
Type: Rogue Anti-Spyware
Common infection symptoms:
  • Blocks internet connection
  • Block exe files from running
  • Installs itself without permissions
  • Connects to the internet without permission
  • Slow internet connection
  • System crashes
  • Annoying Pop-up's
  • Slow Computer
Infection Video Windows Privacy Extension

Windows Privacy Extension

You are probably aware that your computer, especially data stored on it, should be protected. If you do not use antivirus software, an infection such as Windows Privacy Extension can easily steal into the computer’s system. This malware belongs to the Rogue.VirusDoctor family which includes such fraudulent applications as Windows Custom Management, Windows Pro Defence, Windows Control Series and others. Once the malware has settled in the system, it begins deceiving Windows users into believing that the computer’s system is infected with dangerous infection, which you should not try to delete on your own. Misleading information is used to persuade you to buy a full fake version of the malware so that you can supposedly remove all of those harmful infections. There is no need to panic when Windows Privacy Extension appears on your screen, even if your instinct reaction is thinking that you are at risk. There is the only risk that you place your trust in this application and purchase its fake full version. Please, remove Windows Privacy Extension from the system, if you do not want to spend your time at the computer closing annoying pop-up messages and attempting to access the Internet.

Windows Privacy Extension imitates operations of legitimate antivirus software so that you start thinking that you are in trouble. Scans presenting supposedly serious threats such as Trojan.Win32.Qhost, Rootkit.Win32, Trojan-Downloader.Win32.Agent and others are not real as well as the infections presented. Importantly, you should not try to remove these infections by yourself, because they might be valid files of the system, and after their removal, the system might stop running properly. Another important and really annoying characteristic of Windows Privacy Extension is false messages. Look at some of them to learn how the rogue will try to fool you:

Error
Potential malware detected.
It is recommended to activate protection and perform a thorough system scan to remove the malware.

Error
Attempt to run a potentially dangerous script detected. Full system scan is highly recommended.

Warning! Virus Detected
Threat detected: FTP Server

Additionally, as the rogue’s intention is to deceive you, other scare tactics than fake scans and messages are also employed. In order not to be removed from the system, Windows Privacy Extension limits access to the Internet, disables some executable files and hides Task Manager and Registry Editor. Without the Internet on your computer you cannot download a tool to removal the infection, while without Task Manager and Registry Editor the rogue cannot be deleted manually. Luckily, everything comes back into normal then you register the rogue and most importantly, remove Windows Privacy Extension from the computer.

The registration of the malware means that the rogue stops producing misleading scans and messages; moreover, it restores the tools discussed above, because the registration is read as a purchase of the full version. Even if it Windows Privacy Extension does not disturb you any longer, it is still present in the system, and you have to delete it. To start the removal, first, copy and paste the key presented in to the activation field:

0W000-000B0-00T00-E0020

We recommend that you delete Windows Privacy Extension with a legitimate antispyware tool which can effectively delete the infection. If the removal tool is powerful enough, it will detect and eliminate all the elements of the rogue from the system so that there is no chance for the infection to be regenerated. Before using antispyware software, make sure that it is legitimate, because another malicious application will cause even more damage than Windows Privacy Extension.

Download Spyware Removal Tool to Remove* Windows Privacy Extension
  • Quick & tested solution for Windows Privacy Extension removal.
  • 100% Free Scan for Windows

How to renew your internet connection:

This rogue antispyware blocks your Internet connection to prevent you from removing the rogue application. To enable the Internet connection, please follow these instructions:
  1. Open Internet Explorer and go to >Tools< select >Internet Options<

  2. Select >Connections<

  3. Select >LAN Settings<

  4. Now you need to uncheck the checkbox labeled >Use a proxy server for your LAN< in Proxy Server section. Then press the >OK< button to close this screen and press the >OK< button to close the Internet Options screen.

  5. Now you can download the SpyHunter scanner and remove the infection.

Download Spyware Removal Tool to Remove* Windows Privacy Extension
  • Quick & tested solution for Windows Privacy Extension removal.
  • 100% Free Scan for Windows
disclaimer

How to manually remove Windows Privacy Extension

Files associated with Windows Privacy Extension infection:

%AppData%\NPSWF32.dll
%AppData%\Protector-[Random].exe
%AppData%\result.db
%AppData%\1st$0l3th1s.cnf
%CommonStartMenu%\Programs\Windows Privacy Extension.lnk
%Desktop%\Windows Privacy Extension.lnk

Windows Privacy Extension DLL's to remove:

%AppData%\NPSWF32.dll

Windows Privacy Extension processes to kill:

%AppData%\Protector-[Random].exe

Remove Windows Privacy Extension registry entries:

HKEY_CURRENT_USER\Software\ASProtect
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "otbpxlqhjd"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alevir.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[1].exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfmessenger.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protector.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srng.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tsadbot.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xp_antispyware.exe
Disclaimer

Comments

  1. ronaldo Jan 1, 2013

    i m very happy to get this antivirus becaz it has removed virus in my me information to know how i will be able to know that my system get infected once again by same virus???

Post comment — WE NEED YOUR OPINION!

Comment:
Name:
Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.