Remove Windows Expert Console
Windows Expert Console / Windows Cleaning Toolkit is a nasty scareware program witch infects your computer once clicked on, These can be email attachments or download from the internet its real name is Rogue.FakeVimes. Its classed as scareware because it locks you out of your computer and then trys and scam you out of your hard earned money Windows Expert Console is a tricky bit of malware to remove if you don’t know what your doing. So in this video I will show you a way of removing it from any computer. If you follow this removal video guide, you do so at your own risk and I Britec will not be held resonsible if you damage your computer or lose your data.
Delete Files:
%AppData%\guard-fvtb.exe
%AppData%\results1.db
Delete registry values:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “GuardSoftware” = “%AppData%\guard-toiy.exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon “Shell”=”C:\\Users\\User\\AppData\\Roaming\\guard-fvtb.exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes”=”.zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation”=1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe “Debugger”=”svchost.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe “Debugger”=”svchost.exe”
https://www.malwarebytes.org
