What is Windows Custom Safety?
Windows Custom Safety is another fake security client, it purports to be a legitimate antivirus application. Although this infection acts like a real security client, every file it identifies on your computer is fake. This is not to say that the files it identifies aren’t themselves real, simply that they aren’t a threat.
How Did I get infected with Windows Custom Safety?
This is the age-old question asked of any technician. The primary vector for infection is what is known as a drive-by-download. This type of infection vector describes what happens when a legitimate website has malicious code inserted into it, unbeknownst to its administrators. When your computer connects to the website, a download is forced in the background and the machine becomes infected. If you don’t remember being asked to install any programs at the time of infection, your antivirus didn’t catch the download. If this is the case, you should definitely consider upgrading to a more capable and fully featured antivirus.
What is Windows Custom Safety Doing to My Computer Right Now?
Every file reported as infected by this infection is a false-positive. The scary-sounding warning messages shown are also fake. Here are some of the messages:
Error
Trojan activity detected. System data security is at risk.
It is recommended to activate protection and run a full system scan.
Warning
Firewall has blocked a program from accessing the Internet
C:\program files\internet explorer\iexplore.exe is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server. As you might imagine, Internet Explorer, which is what explore.exe is, didn’t infect your computer.
Windows Custom Safety
» Download Windows Custom Safety Removal Software
Although this infection may not seem to be the end of the world, you need to remove it as soon as possible. Infections of this nature often act as a backdoor to install much more severe infections, such as rootkits and bootkits that can drastically interfere with the operation of your computer. TFor this reason, it is important to run a full virus scan even if you follow the manual removal guide below. Once you’ve removed the infection, this should be the immediate next step.
Automatic Windows Custom Safety Removal
Online Windows Custom Safety Removal Service
Video Showing You How to Remove Windows Custom Safety
Remove Proxy Setting so You Can Connect to the Internet Again.
Windows Custom Safety Manual Removal Procedures
The first step you must take in order to remove Windows Custom Safety is to stop the following process. Watch the video for guidance.
- Protector-<random 3 chars>.exe ( Example is Protector-804.exe ) Your file trace will be named different.
To Stop this process you can
A. Browse to the file location shown below and re-name the file first and then restart your computer. Then browse to that file location again and delete the file.
B. Boot into Safe Mode and delete the file
C: Log-into another users account and see if you can delete the file.
D: Start the Task Manager the very second you login and terminate the process that way.
The next step in Windows Custom Safety removal is to delete the following file:
- %AppData%\Protector-[random].exe
Once you have deleted the above executable, Windows Custom Safety will no longer be running. At this time you need to run a full virus scan. RUN THE SCAN! We recommend Spyware Doctor with Antivirus. You need to ensure no other viruses are on your computer. Unfortunately many people skip this crucial step following the removal of the infection. Although the machine may seem clean, other infections may still be lurking, ready to infect the machine as soon as they’re activated.
If you find this threat too difficult to remove yourself and need an expert, we recommend www.pcninja.com . They charge far less than others and are great at what they do.
Windows Safety Maintenance Registry Removal Procedures
With this infection there is no need to edit the registry. Unless absolutely necessary, it is inadvisable for you to edit the registry to attempt to remove traces of the infection. Oftentimes, these remnants are useless as you’ve already deleted the executable that they require to run. A safer course of action is to simply scan the machine with an antivirus client, it will automatically identify any registry entries that need to be removed.
Windows Custom Safety Directories and Files:
- %AppData%\Protector-[random].exe
- %AppData%\NPSWF32.dll
- %AppData%\Protector-[random].exe
- %AppData%\Protector-[random].exe
- %AppData%\result.db
- %AppData%\1st$0l3th1s.cnf
Conclusion
We don’t recommend that inexperienced users attempt to delete the infection manually, as it resides in a directory with files crucial to the normative operations of the operating system, inadvertent deletion of these files can cause significant damage to your Windows installation. We recommend those users less than comfortable with the manual removal operations outlined above consult a web-based repair service such as www.pcninja.com or legitimate antivirus software such as Spyware Doctor with Antivirus to completely and safely remove Windows Custom Safety. Many of our users report they really like the look and feel of Spyware Doctor with Antivirus so that is the main client we have been starting to recommend.
We have also created a dedicated site at http://www.removemsremovaltool.com to help people out.
Related Article Keywords: Windows Custom Safety, Remove Windows Custom Safety, Windows Custom Safety Removal, How to Remove Windows Custom Safety
How to Thank Us for the Guide? If we are able to help you out all we ask for in return is you bookmarking our site and writing about us on your blog or facebook page. Posting a comment of thanks goes a long ways as well. Helps to build trust with other users.
Speak Your Mind