Windows Protection Suite is a dangerous fake anti-malware application that appears as a legitimate malware removal tool in an attempt to swindle users of their money. The method used to steal the user’s money is that of scaring them using security warnings and threat reports that are completely false. Windows Protection Suite reaches users systems via Trojans that get downloaded from malicious websites. Once installed, Windows Protection Suite loads up as a startup application and launches into a series of fake malware scans, generating endless reports of a large amount of malicious activity being detected on the user’s system. Fake pop-ups are also generated from the Windows Taskbar, warning of malware that does not exist. The aim of all these fake warnings is to scare the user into purchasing a license for the ‘full’ version of Windows Protection Suite by claiming that the currently installed ‘trial’ version cannot fully clean the detected ‘threats’. However, the so-called ‘full’ version is just as incapable of scanning or cleaning the user’s system as the ‘trial’ version is.
Once you detect the malicious activity described above, it suggests an infection of Windows Protection Suite. You should take immediate measures to remove this rogue program. In order to initiate Windows Protection Suite removal, you need to stop its processes, unregister its DLL files, delete its files and folders and remove its registry entries.
File Removal Procedures
The first step you need to take in Windows Protection Suite removal is to stop the following processes:
- WI345d.exe
- CLSV.exe
- snl2w.exe
- std.exe
- WindowsProtectionSuite.exe
- WI345d.exe
- ppal.exe
Next, it is necessary to unregister the following DLL files:
- tempdoc.dll
- energy.dll
- mozcrt19.dll
- sqlite3.dll
- cid.dll
- CLSV.dll
- ddv.dll
The next step in Windows Protection Suite removal is to delete the following files and folders:
- WI345d.exe
- CLSV.exe
- snl2w.exe
- std.exe
- WindowsProtectionSuite.exe
- WI345d.exe
- ppal.exe
- tempdoc.dll
- energy.dll
- mozcrt19.dll
- sqlite3.dll
- cid.dll
- CLSV.dll
- ddv.dll
- tempdoc.dll
- WINPS.ico
- working.log
- vd952342.bd
- winps.cfg
- cookies.sqlite
- Instructions.ini
- cb.sys
- cid.tmp
- CLSV.tmp
- DBOLE.sys
After these steps have been completed, your computer’s hard disk no longer contains Windows Protection Suite. In order to make sure that all the above malicious components have been properly removed it is recommended to scan the entire system using genuine antivirus software such as Spyware Doctor with Antivirus.
Registry Removal Procedures
Removal of files and folders alone is not sufficient to completely delete Windows Protection Suite. The following registry keys and settings should also be deleted for complete Windows Protection Suite removal:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “WindowsProtectionSuite”
- HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
- HKEY_CLASSES_ROOT\WI345d.DocHostUIHandler
- HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes “URL” = “http://search-gala.com/?&uid=7&q={searchTerms}”
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform “9877034603″
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Windows Protection Suite”
Now it is safe to say that your computer is completely devoid of anything to do with Windows Protection Suite.
Conclusion
Manual Windows Protection Suite removal is not recommended for inexperienced users as one wrong move during the process could cause irreversible damage to your operating system. Therefore the best course of action to take would be to use a web-based repair service such as www.onlinecomputerrepair.org or a legitimate antivirus program such as Spyware Doctor with Antivirus to ensure that Windows Protection Suite removal is done in a safe and efficient manner.