Windows Ultimate Security Patch Virus Removal

    Windows Ultimate Security Patch is a new rogue antivirus that appeared several days ago. We recently encountered this Trojan one of our customer computers. From what we see Windows Ultimate security Patch pretends to be a comprehensive all-in-one anti-malware for your PC.  This rouge security program is from Win32/FakeVimes family. This family is known for its endless manipulating tactics to lure user into investing funds on a preset that it will remove the supposed infection. These popup tend to happen when websites are hacked with drive by download fake anti-malware.  When you are overwhelm with such of an popup. Here is what you can do:

Symptoms that can tell you that your computer is infected with Windows Ultimate Security Patch
If you are not comfortable following these steps please contact out Live Agents click here

Things to look for:

·         Security Messages and popup

·         Redirects Webpages:

·         Failure to run certain utilities and programs

·         Sluggish reaction to programs

·         Web Browser will not open without error
        
Pop-ups

  1: Error
Keylogger activity detected. System information security is at risk.
It is recommended to activate protection and run a full system scan.

2: Error
Software without a digital signature detected.
Your system files are at risk. We strongly advise you to activate your protection

Here are some of the file and registry entries
If you are not comfortable following these steps please contact out Live Agents click here

File Systems Entries

• %LOCALAPPDATA%\Protector-[rnd].exe
•  %APPDATA%\ Protector-tobe.exe
• %APPDATA%\ Protector-hgfp.exe  
• Protector-[rnd].exe

Registry Entries

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector" = '%AppData%\Protector-[RANDOM CHARACTERS].exe'
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a.exe "Debugger" = 'svchost.exe'
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aAvgApi.exe "Debugger" = 'svchost.exe'
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe "Debugger" = 'svchost.exe'
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\About.exe "Debugger" = 'svchost.exe'
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe "Debugger" = 'svchost.exe'
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe "Debugger" = 'svchost.exe'
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adaware.exe "Debugger" = 'svchost.exe'
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\advxdwin.exe "Debugger" = 'svchost.exe'
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe "Debugger" = 'svchost.exe'
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agent.exe "Debugger" = 'svchost.exe'
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentsvr.exe "Debugger" = 'svchost.exe'
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentw.exe "Debugger" = 'svchost.exe'
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alertsvc.exe "Debugger" = 'svchost.exe'
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alevir.exe "Debugger" = 'svchost.exe'
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alogserv.exe "Debugger" = 'svchost.exe'
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV.exe "Debugger" = 'svchost.exe'
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore "DisableSR " = '1'

If you are not comfortable following these steps please contact out Live Agents click here

• Start in Safe Mode with networking by using the F8 Key.
• Start Pre Removal by disabling start-up items
• Search, Kill and delete all programs and files
• Remove Threats and Run any Anti-Virus Software
  

Tips & Software Removal Tools:

• Remember to change the file association
• Try to download Safari
• Change settings in internet options
• Reset Network settings
• Adware-
• Malwarebytes:
• CCleaner:
• Kill Box:

Similarly to Virgin Mobile, Boost has announced at CTIA this morning that it will begin offering 4G plans and handsets on May 31st. Both are no-contract MVNOs on Sprint's network, so the synchronicity is hardly surprising, and it also means that the 4G in use here will be WiMAX since Sprint's LTE rollout is not yet open to the public. Boost's plans start at $55 per month, though you'll be rewarded for making your payments on time with a bill that shrinks to $40 after 18 months. As we'd heard rumored, Boost is offering the HTC Evo Design 4G, which will set you back $299.99 upfront, and there's no word on any other options or mobile hotspots available just yet. Boost promises average upload speeds of 3Mbps-6Mbps, but while the data plan is being marketed as unlimited you'll be throttled beyond 2.5GB.