Remove Cloud AV 2012

Cloud AV 2012 is a fake antivirus that infected your computer through a malicious website or Trojan. Cloud AV 2012 scan the whole infected computer without any notice. After finish scanning, Cloud AV 2012 shows false result that there are a lot of malware infections found on the computer. Moreover, the users of the infected computer will receive several warning alerts trying to force the users to purchase the fake full version of Cloud AV 2012. Cloud AV 2012 cannot detect and remove any kind of virus, malware or trojan. Cloud AV 2012 is a SCAM. Do not believe any warning or alert given by Cloud AV 2012. Most important, do not purchase the full version of Cloud AV 2012 as it really cannot remove any kind of malware! Cloud AV 2012 is delivered through many ways that involve installing via a bogus scanner page created to look like a Windows application screen. Another way of how Cloud AV 2012 spreads is via a Trojan infection generated to look like a flash update or video codec.

Cloud AV 2012 can be removed first by stopping its processes and then kill its files by using Emsisoft HiJackFree. Then the user has to remove all the related files and folder. Finally, restore the registry entries added and modified by Cloud AV 2012 (Read the removal guide below to remove Cloud AV 2012 successfully).

Cloud AV 2012 should be removed immediately!

Removal Guide
Kill Process
(How to kill a process effectively?)
Cloud AV 2012.exe
dwme.exe
027.exe
Cloud AV 2012v121.exe
[random].exe

Delete Registry
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Cloud AV 2012.exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random]”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “[random]”
HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\C0AB6693AB3202B4B9D95716ED5CE4A6\SourceList

Remove Folders and Files
%Documents and Settings%\[User Name]\Local Settings\Application Data\Cloud AV 2012.exe
%AppData%\ldr.ini
%AppData%\[RANDOM]
%DesktopDir%\Cloud AV 2012.lnk
%Programs%\Cloud AV 2012
%Temp%\8.tmp

Remove AV Protection 2012

AV Protection 2012 is a fake antivirus program AV Protection 2012 cannot detect and remove any malware, trojan or virus. AV Protection 2012 can just provide fake alert (e.g. There are many files are infected by malwares). Once AV Protection 2012 is installed in the computer, it will definitely do a fake scan in the computer and will state that the computer is in danger repeatedly so that to urge the user to purchase the full version of AV Protection 2012 which cannot remove any kind of errors found in the system.

AV Protection 2012 can be removed by stopping all the processes with random name and name which contain "AV Protection 2012". Then the user has to remove the files of the processes. Finally, the registry settings have to be restored by removing the registry keys stated below.

AV Protection 2012 should be removed immediately!

AV Protection 2012 Removal Guide
Kill Process
(How to kill a process effectively?)
[random].exe
svhostu.exe

Delete Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[random]"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[random]"
HKEY_CURRENT_USER\Software\AV Protection 2012

Remove Folders and Files
%UserProfile%\Application Data\Microsoft\[random].exe
%UserProfile%\Application Data\[random].exe
%ALLUserProfile%\Application Data\Microsoft\[random].exe
%ALLUserProfile%\Application Data\[random].exe
%AppData%\ldr.ini
%AppData%\[random]\AV Protection 2012.ico
%AppData%\svhostu.exe

Remove Windows Fix

Windows Fix is a program that is used to cheat the money of people by showing error message in the computer hard drive, memory and system. Windows Fix adds a registry entries to make itself to start automatically when Windows boot. After that, Windows Fix will do fake scan on the computer and then issue fake warning by showing pop ups to tell the the user that the hard drive, memory and system have serious errors which can only be solved by using the full version of Windows Fix. Thus, the user is urged to purchase it. Do not believe any report given by Windows Fix even the warning look so real. In fact, Windows Fix cannot detect and remove any error of computer.

Windows Fix can be uninstalled by by stopping all processes with random name and also kill its files. Then, all registry entries added and modified by Windows Fix must be cleared by using Windows Registry Editor.

Windows Fix provide fake features such as Computer status, RAM Memory Status, System Drive and System Registry Status. None of them can really protect computer from any kind of malware.

Windows Fix should be removed immediately!

Windows Fix Removal Guide
Kill Process
(How to kill a process effectively?)
[random].exe

Unregister DLL files

Delete Registry
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Use FormSuggest" = 'Yes'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "CertificateRevocation" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnonBadCertRecving" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop "NoChangingWallPaper" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = '.zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;.scr;'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoDesktop" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ".exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "DisableTaskMgr" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "Hidden" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "ShowSuperHidden" = '0'

Remove Folders and Files
%LocalAppData%\[random]
%LocalAppData%\[random].exe
%LocalAppData%\~[random]
%LocalAppData%\~[random]
%StartMenu%\Programs\Windows Fix
%Temp%\smtmp
%UserProfile%\Desktop\Windows Fix.lnk
File Location Notes:

%UserProfile% refers to the current user's profile folder. By default, this is C:\Documents and Settings\[Current User] for Windows 2000/XP, C:\Users\[Current User] for Windows Vista/7, and c:\winnt\profiles\[Current User] for Windows NT.

%Temp% refers to the Windows Temp folder. By default, this is C:\Windows\Temp for Windows 95/98/ME, C:\DOCUMENTS AND SETTINGS\[Current User]\LOCAL SETTINGS\Temp for Windows 2000/XP, and C:\Users\[Current User]\AppData\Local\Temp for Windows Vista and Windows 7.

%LocalAppData% refers to the current users Local settings Application Data folder. By default, this is C:\Documents and Settings\[Current User]\Local Settings\Application Data for Windows 2000/XP. For Windows Vista and Windows 7 it is C:\Users\[Current User]\AppData\Local.

%StartMenu% refers to the Windows Start Menu. For Windows 95/98/ME it refers to C:\windows\start menu\, for Windows XP, Vista, NT, 2000 and 2003 it refers to C:\Documents and Settings\[Current User]\Start Menu\, and for Windows Vista/7 it is C:\Users\[Current User]\AppData\Roaming\Microsoft\Windows\Start Menu.

Remove Computer Fix

Computer Fix is a program that is used to cheat the money of people by showing error message in the computer hard drive, memory and system. Computer Fix adds a registry entries to make itself to start automatically when Windows boot. After that, Computer Fix will do fake scan on the computer and then issue fake warning by showing pop ups to tell the the user that the hard drive, memory and system have serious errors which can only be solved by using the full version of Computer Fix. Thus, the user is urged to purchase it. Do not believe any report given by Computer Fix even the warning look so real. In fact, Computer Fix cannot detect and remove any error of computer.

Computer Fix can be uninstalled by by stopping all processes with random name and also kill its files. Then, all registry entries added and modified by Computer Fix must be cleared by using Windows Registry Editor.

Computer Fix provide fake features such as Computer status, RAM Memory Status, System Drive and System Registry Status. None of them can really protect computer from any kind of malware.

Computer Fix should be removed immediately!

Computer Fix Removal Guide
Kill Process
(How to kill a process effectively?)
[random].exe

Delete Registry
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Use FormSuggest" = 'Yes'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "Hidden" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "ShowSuperHidden" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU "MRUList"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "CertificateRevocation" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnonBadCertRecving" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop "NoChangingWallPaper" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = '/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoDesktop" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[random]"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[random].exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "DisableTaskMgr" = '1'


Remove Folders and Files
%Documents and Settings%\[User Name]\Local Settings\Temp\smtmp
%Documents and Settings%\[User Name]\Local Settings\Application Data\[random]
%Documents and Settings%\[User Name]\Local Settings\Application Data\[random].exe
%Documents and Settings%\[User Name]\Start Menu\\Programs\Computer Fix
%Documents and Settings%\[User Name]\Desktop\Computer Fix.lnk
%Documents and Settings%\[User Name]\Start Menu\\Programs\Computer Fix

Remove AV Protection 2011

AV Protection 2011 is a fake antivirus program that try to pretend to be a real antivirus which can remove malware. However, AV Protection 2011 does not kill any malware from any computer. AV Protection 2011 infects the computer by installing useless program into the computer which will try to disguise itself like a legitimate antivirus. After installation complete, AV Protection 2011 will scan the computer and will surely state that the computer is infected by malwares and urge the user to buy the full version of AV Protection 2011.AV Protection 2011 states that its trialware is not able to remove malware threats detected and offers you purchasing its full version which is allegedly capable to fix them. AV Protection 2011 is a serious risk to any computer system and should be removed immediately.

AV Protection 2011 can be removed by using Emsisoft HiJackFree to stop the process and remove the files. Then the user should remove the registries entries added and modified according to the removal guide stated below.

AV Protection 2011 displayed fake alert such as "Please tell Microsoft about this problem. We have created an error report that you can send to us. We will treat this report as confidential and anonymous.", "Security Warning Malicious programs that may steal your private information and prevent your system from working properly are detected on your computer. Click here to clean your PC immediately.", "Security Warning There are critical system files on your computer that were modified by malicious software. It may cause permanent data loss. Click here to remove malicious software." and so on.

AV Protection 2011 should be removed immediately!

AV Protection 2011 Removal Guide
Kill Process
(How to kill a process effectively?)
[random].exe
svhostu.exe

Delete Registry
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:59232"
HKEY_CURRENT_USER\Software\System Security 2011
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[random]"
HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\C0AB6693AB3202B4B9D95716ED5CE4A6\SourceList

Remove Folders and Files
%UserProfile%\Desktop\System Security 2012.lnk
%Temp%\svhostu.exe
C:\Windows\system32\[random].exe
%DesktopDir%\AV Protection 2011.lnk
%AppData%\[random]
%Programs%\AV Protection 2011
%AppData%\ldr.ini
%Temp%\8.tmp
remove the file shown in autorun settings.

Remove System Fix

System Fix is a program that is used to cheat the money of people by showing error message in the computer hard drive, memory and system. System Fix adds a registry entries to make itself to start automatically when Windows boot. After that, System Fix will do fake scan on the computer and then issue fake warning by showing pop ups to tell the the user that the hard drive, memory and system have serious errors which can only be solved by using the full version of System Fix. Thus, the user is urged to purchase it. Do not believe any report given by System Fix even the warning look so real. In fact, System Fix cannot detect and remove any error of computer.

System Fix can be uninstalled by by stopping all processes with random name and also kill its files. Then, all registry entries added and modified by System Fix must be cleared by using Windows Registry Editor.

System Fix provide fake features such as Computer status, RAM Memory Status, System Drive and System Registry Status. None of them can really protect computer from any kind of malware.

System Fix should be removed immediately!

System Fix Removal Guide
Kill Process
(How to kill a process effectively?)
[random].exe

Unregister DLL files

Delete Registry
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Use FormSuggest" = 'Yes'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "CertificateRevocation" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnonBadCertRecving" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop "NoChangingWallPaper" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = '.zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;.scr;'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoDesktop" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ".exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "DisableTaskMgr" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "Hidden" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "ShowSuperHidden" = '0'

Remove Folders and Files
%LocalAppData%\[random]
%LocalAppData%\[random].exe
%LocalAppData%\~[random]
%LocalAppData%\~[random]
%StartMenu%\Programs\System Fix
%Temp%\smtmp
%UserProfile%\Desktop\System Fix.lnk
File Location Notes:

%UserProfile% refers to the current user's profile folder. By default, this is C:\Documents and Settings\[Current User] for Windows 2000/XP, C:\Users\[Current User] for Windows Vista/7, and c:\winnt\profiles\[Current User] for Windows NT.

%Temp% refers to the Windows Temp folder. By default, this is C:\Windows\Temp for Windows 95/98/ME, C:\DOCUMENTS AND SETTINGS\[Current User]\LOCAL SETTINGS\Temp for Windows 2000/XP, and C:\Users\[Current User]\AppData\Local\Temp for Windows Vista and Windows 7.

%LocalAppData% refers to the current users Local settings Application Data folder. By default, this is C:\Documents and Settings\[Current User]\Local Settings\Application Data for Windows 2000/XP. For Windows Vista and Windows 7 it is C:\Users\[Current User]\AppData\Local.

%StartMenu% refers to the Windows Start Menu. For Windows 95/98/ME it refers to C:\windows\start menu\, for Windows XP, Vista, NT, 2000 and 2003 it refers to C:\Documents and Settings\[Current User]\Start Menu\, and for Windows Vista/7 it is C:\Users\[Current User]\AppData\Roaming\Microsoft\Windows\Start Menu.

Remove Sphere Security 2012

Sphere Security 2012 is a fake antivirus program that perform like a real antivirus such as Kaspersky Anti-Virus, AVG Free Antivirus, Avira AntiVir etc. Sphere Security 2012 infects the computer when the user accidentally downloads a trojan from a website which provide online videos. Sphere Security 2012 will start automatically when Windows boot. Then, Sphere Security 2012 will scan the computer and produce fake scan results and display many fake alerts to urge the user to purchase the full version of Sphere Security 2012 in order to remove the detected malwares.

Sphere Security 2012 provides fake features such as System Scan, Protection, Privacy and Update. None of them can really protect computer from malware, virus or trojans.

Sphere Security 2012 should be removed immediately!

Sphere Security 2012 Removal Guide
Kill Process
(How to kill a process effectively?)
[random].exe

Delete Registry
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\featurecontrol\FEATURE_BROWSER_EMULATION "svchost.exe"
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings "enablehttp1_1" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce "[random]"

Remove Folders and Files
%AllUsersProfile%\[random]
%StartMenu%\Programs\Sphere Security 2012.lnk

Notes:
%AllUsersProfile% refers to the All Users Profile folder. By default, this is C:\Documents and Settings\All Users for Windows 2000/XP and C:\ProgramData\ for Windows Vista/7.

%StartMenu% refers to the Windows Start Menu. For Windows 95/98/ME it refers to C:\windows\start menu\, for Windows XP, Vista, NT, 2000 and 2003 it refers to C:\Documents and Settings\[Current User]\Start Menu\, and for Windows Vista/7 it is C:\Users\[Current User]\AppData\Roaming\Microsoft\Windows\Start Menu.

Remove AV Security 2012

AV Security 2012 is a fake antivirus program that try to pretend to be a real antivirus which can remove malware. However, AV Security 2012 does not kill any malware from any computer. AV Security 2012 infects the computer by installing useless program into the computer which will try to disguise itself like a legitimate antivirus. After installation complete, AV Security 2012 will scan the computer and will surely state that the computer is infected by malwares and urge the user to buy the full version of AV Security 2012.AV Security 2012 states that its trialware is not able to remove malware threats detected and offers you purchasing its full version which is allegedly capable to fix them. AV Security 2012 is a serious risk to any computer system and should be removed immediately.

AV Security 2012 can be removed by using Emsisoft HiJackFree to stop the process and remove the files. Then the user should remove the registries entries added and modified according to the removal guide stated below.

AV Security 2012 displayed fake alert such as "Please tell Microsoft about this problem. We have created an error report that you can send to us. We will treat this report as confidential and anonymous.", "Security Warning Malicious programs that may steal your private information and prevent your system from working properly are detected on your computer. Click here to clean your PC immediately.", "Security Warning There are critical system files on your computer that were modified by malicious software. It may cause permanent data loss. Click here to remove malicious software." and so on.

AV Security 2012 should be removed immediately!

AV Security 2012 Removal Guide
Kill Process
(How to kill a process effectively?)
[random].exe
svhostu.exe

Delete Registry
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:59232"
HKEY_CURRENT_USER\Software\System Security 2011
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[random]"

Remove Folders and Files
%UserProfile%\Desktop\System Security 2012.lnk
%Temp%\svhostu.exe
C:\Windows\system32\[random].exe
remove the file shown in autorun settings.

Remove System Protection 2012

System Protection 2012 is a fake antivirus program System Protection 2012 cannot detect and remove any malware, trojan or virus. System Protection 2012 can just provide fake alert (e.g. There are many files are infected by malwares). Once System Protection 2012 is installed in the computer, it will definitely do a fake scan in the computer and will state that the computer is in danger repeatedly so that to urge the user to purchase the full version of System Protection 2012 which cannot remove any kind of errors found in the system.

System Protection 2012 can be removed by stopping all the processes with random name and name which contain "System Protection 2012". Then the user has to remove the files of the processes. Finally, the registry settings have to be restored by removing the registry keys stated below.

System Protection 2012 should be removed immediately!

System Protection 2012 Removal Guide
Kill Process
(How to kill a process effectively?)
[random].exe

Delete Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[random]"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[random]"

Remove Folders and Files
%UserProfile%\Application Data\Microsoft\[random].exe
%UserProfile%\Application Data\[random].exe
%ALLUserProfile%\Application Data\Microsoft\[random].exe
%ALLUserProfile%\Application Data\[random].exe

Remove System Security 2012

System Security 2012 is a fake antivirus program that will start automatically when Windows boot. After that, System Security 2012 will do a fake scan on the computer and WILL SURELY state that the computer is infected by malware and then System Security 2012 will prevent some antivirus from running on the computer. System Security 2012 cannot detect any kind of virus, trojan or malware. System Security 2012 can do nothing. System Security 2012 cannot remove any virus, trojan or malware. System Security 2012 just make the computer to operate slowly and show pop ups to urge the user to purchase the full version of System Security 2012 to remove the threats. System Security 2012 cannot remove any threat at all. System Security 2012 can infect the computers even when the users browse the Internet or check comments on their blogs. Some of these comments might be spam including malicious links, which reroute the users to a harmful websites. If the users click on one of these infected links, they would get redirected to a website which promotes and sells System Security 2012.

System Security 2012 can be removed by using Emsisoft HiJackFree by stopping the process ([random].exe) and delete the files at the same time. Then, remove the autorun setting set by System Security 2012.

System Security 2012 should be removed immediately!

System Security 2012 Removal Guide
Kill Process
(How to kill a process effectively?)
[random].exe
svhostu.exe

Delete Registry
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce "[RANDOM]"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM]"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[RANDOM].exe"
HKEY_CURRENT_USER\Software\[RANDOM]
HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\C0AB6693AB3202B4B9D95716ED5CE4A6\SourceList
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:59232"
HKEY_CURRENT_USER\Software\System Security 2012

Remove Folders and Files
[random].exe in hard drive
%AppData%\svhostu.exe
%SYSTEM%\[random].exe
%AppData%\ldr.ini
%AppData%\[random]
%UserProfile%\Desktop\System Security 2012.lnk
%Temp%\svhostu.exe
%Temp%\8.tmp

Remove Privacy Protection

Privacy Protection is a fake antivirus program that shows the user that the computer is infected by malwares repeatedly so that to urge the user to purchase the full version of Privacy Protection. Privacy Protection is downloaded into computer when the user downloads video files from untrusted website. The video file downloaded cannot be viewed but is the Privacy Protection which cannot detect and remove any malware. Privacy Protection installs into the computer and will scan the computer when Windows boot. Then Privacy Protection will surely states that the computer have been infected by malwares. Then, the computer will start slowing down and behave strangely.

Privacy Protection can be removed by stopping the processes and removing the files by using Emsisoft HiJackFree. Then the user should remove the registry entries added or modified by Privacy Protection shown in the removal guide below. All files related to Privacy Protection must be deleted.

Privacy Protection should be removed immediately!

Removal Guide
Kill Process
(How to kill a process effectively?)
[random].exe
defender.exe

Delete Registry
HKEY_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\Run "Privacy Protection"

Remove Folders and Files
%UserProfile%\Application Data\defender.exe
%UserProfile%\Application Data\[random].exe