How to tackle fake security softwares

With the number of fake security software rising each day, scammers are getting more aggressive in their attempts to scam people out of their money.  While fake security software looks like the genuine article, the fake software generates messengers every 30 seconds telling the user their system is compromised by an infection which the fake software will gladly “remove” if the user purchases the full version.  While computer savvy users will see through this right away, many are frightened by what this these programs “find” on their computer and purchase it, which is the it is often called “scareware”.  If the victims are lucky, they may be sent a completely worthless activation code after the payment have gone through but all of them are left out of pocket, with a fake program that continues to tell them to purchase the full version to remove their infections.

Originally these scams would simply pop up messages every thirty seconds, making it difficult to continue with whatever you were doing, however an increasing number are taking over the computer as soon as you log on.    You get the past the Windows splash screen and all you see is the fake program which will only let you click the “buy now” button.  There is no Windows task bar and you can’t do anything in Windows.

If this is happening to you, then the following directions will help you fix the problem:

1.      Hold down Ctrl +Alt+ Delete.  If Windows Task Manager doesn’t immediately appear, click the Task Manager button.

2.       Click File > New Task (Run..) type explorer.exe and click OK.

3.      You should have the Windows tool bar back now.  Press “Windows Key” + R.  Type msconfig and click OK.  Uncheck load startup items and click Ok.  Restart the computer when prompted.

4.      After you have restarted, you are either going to see your Windows Desktop or the same infection which is continuing to hijack your computer.  If you are seeing your Windows Desktop, close the msconfig message that pops up and move onto step 10.  Everyone else move onto 5.

5.      Once again, hold down Ctrl +Alt+ Delete.  If Windows Task Manager doesn’t immediately appear, click the Task Manager button. Click File > New Task (Run..) type explorer.exe and click OK.

6.      Press “Windows Key” + R.  Type regedit and click OK.

7. Navigate your way by clicking the + symbol to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion. Click the WinLogon folder.

8.      In the right hand pane of “registry editor“, you will see an entry called “Shell“.  Shell will most likely be pointing to wherever your infection is stored on the hard drive. Double click shell, type in explorer.exe and click OK.

9. Close registry editor and restart your computer. After the restart you will see your Windows Desktop again.

10.  Now that you have control of your computer again, it’s time to remove the infection.  You can visit various anti-spyware sites to get step-by-step instructions to remove scareware, such as 411-Spyware’s guide to System Protect 2009 removal, the Conficker-related rogue.