Do you have pop-ups or your computer infected with trojan or spyware ? Learn how to ask us for help, click here!

How to remove Windows Security Suite (Uninstall instructions)

Windows Security Suite is a rogue antispyware program from Virus Doctor rogue family (Malware Destructor 2009, Fast Antivirus 2009 … ). Like other fake antispyware software, it`s distributed through the use of malware and does not offer any protection to computer. Windows Security Suite uses fake alerts and false positives to trick you into buying the program.

Windows_Security_Suite_scan_results
Windows Security Suite (more screen shoots 1, 2, 3)

Once Windows Security Suite is installed, it configures itself to run automatically every time, when you start your computer. In addition the program drops a few files. These files are actually harmless, but during the scan will determine as threats (spyware, malware and trojans). Once running, Windows Security Suite starts scanning the computer and list previously created files as threats to trick you to buy the software, in order to remove these reported infections. You can safely ignore them.

While Windows Security Suite is running, it blocks legitimate antivirus and antispyware programs (Kaspersky Antivirus, DrWeb, AdAware, McAfee, Norton AV, …). Your computer will display fake warning and fake security alerts from your windows taskbar. A few examples of the security alerts:

System alert
malicious applications, which contain trojans, were found
on your PC and need to be immediately removed. Click here to
remove these potentially harmful items using Windows Security Suite.

System alert
Windows Security Suite has detected potentially harmful
software in your system. It is strongly recommended that you
register Windows Security Suite to remove these threats
immediately.

Windows Security Suite can be safely removed from your computer along with any other malware if the proper steps are taken. If you are a non-techie computer user then this method of removing the rogue is for you.

Symptoms in a HijackThis Log

O1 – Hosts: 74.125.45.100 test1111.com
O1 – Hosts: 74.125.45.100 test1112.com
O1 – Hosts: 74.125.45.100 4-open-davinci.com
O1 – Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 – Hosts: 74.125.45.100 privatesecuredpayments.com
O1 – Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 – Hosts: 74.125.45.100 getantivirusplusnow.com
O1 – Hosts: 74.125.45.100 secure-plus-payments.com
O1 – Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 – Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 – Hosts: 74.125.45.100 www.getavplusnow.com
O1 – Hosts: 74.125.45.100 www.securesoftwarebill.com
O4 – HKCU\..\Run: [Windows Security Suite] “C:\Documents and Settings\All Users\Application Data\f5bc4e8\WIf5bc.exe” /s /d

Use the following instructions to remove Windows Security Suite (Uninstall instructions)

Download OTM by OldTimer from here.
Run OTM, copy,then paste the following text in “Paste Instructions for Items to be Moved” window (under the yellow bar):

:reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Security Suite"=-

:files
%appdata%\Windows Security Suite
%appdata%\WINSSSys

:Commands
[Reboot]

Click the red Moveit! button. When the tool is finished, you may be prompted to Restart.

Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.

Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

Once the program has loaded you will see window similar to the one below.

malwarebytes-antimalware1
Malwarebytes Anti-Malware Window

Select Perform Quick Scan, then click Scan, it will start scanning your computer for Windows Security Suite infection. This procedure can take some time, so please be patient.

When the scan is complete, click OK, then Show Results to view the results. You will see a list of infected items similar as shown below. Note: list of infected items may be different than what is shown in the image below.

Windows_Security_Suite_mbam
Malwarebytes Anti-malware, list of infected items

Make sure that everything is checked, and click Remove Selected for start Windows Security Suite removal process. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.

Note: if you need help with the instructions, then post your questions in our Spyware Removal forum.

Windows Security Suite creates the following files and folders

%appdata%\Windows Security Suite
%appdata%\WINSSSys
%appdata%\f5bc4e8
c:\documents and settings\all users\application data\WINSSSys\winss.cfg
%userprofile%\Desktop\Windows Security Suite.lnk
%userprofile%\Start Menu\Windows Security Suite.lnk
%userprofile%\Start Menu\Programs\Windows Security Suite.lnk
%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Security Suite.lnk

Windows Security Suite creates the following registry keys and values

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Windows Security Suite”

Share and Enjoy:

  • Print
  • Digg
  • Sphinn
  • del.icio.us
  • Facebook
  • Mixx
  • Google Bookmarks
  • Slashdot
  • Twitter
July 6, 2009 on 11:52 pm | In Rogue Anti Spyware, Tutorials - HowTo | 44 Comments |


44 Comments »

RSS feed for comments on this post. TrackBack URI

  1. Thanks

    i was so up set with that lol

    thanks 4 your help

    Comment by ChamP — July 11, 2009 #

  2. Great site. I am a computer technician and I bookmarked this page!! Thanks guys.

    Comment by Matt W. — July 13, 2009 #

  3. You guys saved my life! That security suite blew right through my AVG. It then wouldn’t allow any access. Thanks

    Comment by Dave — July 15, 2009 #

  4. holy cow i cannot thank u enoughf,i was playin an old game called unreal and it kept on jammin me up.i got the scam/virus off of fresno county sherrifs site,go figure them pigs are tryin to get even……thanks again,ill recomend this angle to most anyone…………tips hat n say heres lookin at you folks

    Comment by jason in florida — July 16, 2009 #

  5. Hi all!! My pc had Security Suite on it. All I did was a system restore to a date before it was infected and it worked! I’m not saying it will work for everybody else, but definately worth a try :)

    Comment by MOTHMAN — July 18, 2009 #

  6. How do you know when your system was infected by this Windows Security Suite?

    Comment by Ana — July 21, 2009 #

  7. Ana, read above symptoms.

    Comment by Patrik — July 21, 2009 #

  8. great help!!! tnx a lot

    Comment by Rea — July 21, 2009 #

  9. oh my god!!! super thank you with this!! i was really disappointed with that FAKE ANTIVIRUS~

    again …THANK YOU SOOO MUCH!!!

    Comment by jennish — July 22, 2009 #

  10. Thanks a lots!
    I’ve had this sick sittutions!
    And this helps was very great for me!

    Comment by Chau — July 22, 2009 #

  11. How do I get rid of Windows Security Suite Firewall ?

    Comment by Claudiu — July 24, 2009 #

  12. Claudiu, ask for help at our Spyware removal forum.

    Comment by Patrik — July 24, 2009 #

  13. How do I know I can trust your software and it isn’t another scam?

    Comment by Ali — July 25, 2009 #

  14. Read comments in the Internet. Both apps: OTM and MBAM are free and good.

    Comment by Patrik — July 25, 2009 #

  15. thanks super life saver!!!

    credit

    Comment by darren — July 25, 2009 #

  16. Yea..Its really works…

    Comment by Vijay — July 25, 2009 #

  17. THANK YOU SOOO MUCHHHHHHHHH

    Comment by Leslie — July 26, 2009 #

  18. Got this virus on my grandson\’s laptop – tried a number of tools, Spyware Doctor, AVG etc and none of them removed it. Numerous web pages on how to remove it manually – but very complex and potentially system crashing if you get registry keys wrong.

    After several hours – I ran an XP restore luckily there had been an automated retore point created 10 days ago on the laptop, this cleared the problem – so first look to see if you have a recent XP restore point and save yourself time and possibly money.

    Some of the alleged solutions (which you have to purchase) look suspiciously like they are provided by the creator of Windows Security Suite (A double scam?)

    Mike

    Comment by Mike Lowthian — July 27, 2009 #

  19. THANKS SO MUCH.

    THIS WORKS LIKE MAGIC

    HIGHLY RECOMMENDED

    Comment by norma — July 27, 2009 #

  20. Mike, system restore only repaired windows registry. For removing infected files your need to run Malwarebytes` anti-malware.

    Comment by Patrik — July 27, 2009 #

  21. I got Windows Security Suite from a website and it messed up my Firefox IE,Chrome until i downloaded spyware doctor and it actually worked please thrust me on this one download spyware doctor then scan your computer and it is removed.

    Thank You,You Welcome
    In Advence

    Comment by I Removed this — July 27, 2009 #

  22. Thankyou soo much 4 this!! i was getting really upset im just worried now because i really was fooled & signed up for it only to realise it did nothing :( im scared now! x

    Comment by Louise — July 27, 2009 #

  23. Thanks so much. This did the trick. Damn that malware.

    Comment by Jay — July 27, 2009 #

  24. Yessssssssssss…its works! Thank you so much.

    Comment by Myza — July 28, 2009 #

  25. THANK YOU SO MUCH!!!! Two days ago I made the mistake of actually clicking on these pop-ups that install this nuisance automatically. I was worried because my antivirus/anti-spy would not work and random pop-ups saying my computer was infected were bugging me. I will absolutely recommend this site to anyone who is having a problem. The steps were very easy to understand and execute. You have my sincerest thanks because I was afraid this would crash my computer thank you very much!!!!

    Comment by Jose — July 29, 2009 #

  26. There’s a new version out there. Mine installed itself to a diff number and Malware Bytes, Spybot and a couple of HijackThis reports haven’t beaten it yet.
    I want to beat it so I can post details but not even sure how I caught it.

    Lucky I made a system restore point a few hours before rebooting and it’s invasion.

    Comment by alatari — August 3, 2009 #

  27. alatari, please read these instructions and post both RSIT logs to new topic at Spyware removal forum.

    Comment by Patrik — August 3, 2009 #

  28. I could reinfect to get the scans you need but I’ve done too much work to get good scans. I might reinfect a bench machine if I find the source.

    Restore point for now.

    Comment by alatari — August 3, 2009 #

  29. This is complete BS. Not even close to removing Windows Security Suite.

    Comment by Buz Jones — August 6, 2009 #

  30. thx a lot!! who ever is responsible for this site..

    Comment by jayson — August 11, 2009 #

  31. I don’t know how I got it but knew it was a rogue virus and never accepted any of the bogus prompts that came on. I want to thank you, Patrik. I finally got rid of all that nonsense.

    Comment by nicksclick — November 16, 2009 #

  32. My anti virus cannot remove spyware. I’m lucky I read this information. I hope this would help a lot.

    Comment by Charlotte roofing cleaning — May 29, 2010 #

  33. Hey guys, I’ve tried Malware and the OTM and when I run HiJack This, it still says that I still have Hijacked hosts. When I run all the scans from SuperAntiSpyware to MalwareBytes, it doesn’t find anything. I’ve been trying to figure this out for a month now and nothing seems to work.

    Any help and info would be truly appreciated. Let me know what info you need me to provide. Thank you.

    Comment by Stephen — July 6, 2010 #

  34. Stephen, follow the steps below to reset HOSTS file:
    Run OTM, copy,then paste the following text in “Paste Instructions for Items to be Moved” window (under the yellow bar):

    :Commands
    [resethosts]

    Click the red Moveit! button.

    Comment by Patrik — July 6, 2010 #

  35. OHMYDAYS! I have been trying all day to get this to work! Saved my lifee! I thought my dad would find out i had practacly broken my laptop and would kill me! Thanks soooooo much!

    Comment by Jess — August 25, 2010 #

  36. Was I supposed to download the OTM on the account that has the virus because on that account I can’t go on the internet.

    Comment by Jessica — August 27, 2010 #

  37. Jessica, try download the suggested programs above in Safe mode with networking.

    Comment by Patrik — August 27, 2010 #

  38. Thanks the virus is official deleted from my computer, but my internet is not working.

    Comment by Jessica — August 27, 2010 #

  39. Thank you so much. The virus is official gone from my computer. I am so happy!!!

    Comment by Jessica — August 27, 2010 #

  40. I have the same issue as Jessica, although I cant get on the internet at all, even in safe mode. I dont know how to get on there and it is getting frustrating. Basically I cant run anything. Once I try, it brings up those system alerts. How can I get Malawarebytes if I cant get to the internet to download it. Please please, if anyone can help, in the easiest way possible, explain to me how to do it. Thank you so much if you can help.

    Comment by Derek — August 30, 2010 #

  41. Derek, what shows your browser when you trying to download Malwarebytes ?

    Comment by Patrik — August 31, 2010 #

  42. Well, when I try to open anything, from Int Explorer to My Computer Folder, it pops up with an alert saying it cant open and asks if i want to run the fake Virus protection program. I downloaded Malwarebytes on another PC and put it on a geek stick and put it on the messed up PC, but it wont let me open it

    Comment by Derek — September 4, 2010 #

  43. Derek,
    1. try run Malwarebytes in Safe mode
    2. try rename Malwarebytes installer to 123.com or 123.scr or iexplore.exe, then run it.

    Comment by Patrik — September 5, 2010 #

  44. yeah, seems to have worked – thx!

    Comment by slashdog — September 6, 2010 #

Leave a comment

XHTML: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>


My Anti Spyware - Free antispyware programs and Spyware Removal Instructions.