Windows Privacy Module virus deletion

1.Description

Windows Privacy Module attacks the Windows platform and poses as something it is not. It claims to legit anti-virus. In fact it is nothing more like a virus.

2. Behavior inside the compromised system

Windows Privacy Module upon successful penetration launches system scanner and deliberately produces false reports with numerous viruses, worms and Trojans residing on the system. If one tries to remove these threats, he/she will be rerouted to the site where the commercial version of Windows Privacy Module is offered to eliminate the insecure stuff

3. Files

In the process of the installation, Windows Privacy Module copies the following files to the hard disk.

• %AppData%\NPSWF32.dll
• %AppData%\Protector-[rnd].exe
• %AppData%\result.db

4. System registry

Windows Privacy Module creates the following registry entries:

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Inspector %AppData%\Protector-[rnd].exe
• HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnHTTPSToHTTPRedirect 0
• HKCU\Software\Microsoft\Windows\CurrentVersion\Settings\ID 4
• HKCU\Software\Microsoft\Windows\CurrentVersion\Settings\UID [rnd]
• HKCU\Software\Microsoft\Windows\CurrentVersion\Settings\net [date of installation]
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ConsentPromptBehaviorAdmin 0
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ConsentPromptBehaviorUser 0
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\EnableLUA 0
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe\Debugger svchost.exe
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe\Debugger svchost.exe
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE\Debugger svchost.exe

5. Screenshots of the malware>

6.Windows Privacy Module automatic Removal