Severity scale  

Windows Efficiency Reservoir. How to Remove? (Uninstall Guide)

removal by - -   Also known as WindowsEfficiencyReservoir | Type: Rogue Antispyware

Windows Efficiency Reservoir is a fake anti-spyware program that blocks legitimate antivirus products and displays fake security alerts to scare you into thinking that you are infected. It enters a computer with the help of Trojans and other malware that come from fake online virus scanners. It has to be manually installed but sometines just visiting a website is enough to get infected. Scammers create many fake and malicious websites, usually fake online scanners and video websites to distribute malicious software. Once a Trojan is installed, it will download and install Windows Efficiency Reservoir scareware on the computer. Once installed, the rogue anti-spyware program displays fake security alerts and false scan results usually about various malware infections that actually do not even exist. Then it asks to pay for a full version of the program to remove the found 'infections'. Don't purchase it! Instead, please use the removal guide below to remove Windows Efficiency Reservoir from your computer as soon as possible.

While Windows Efficiency Reservoir is running, it will displays fake security warnings and fake notifications from Windows task bar. They are all basically the same. What is more, the rogue program will impersonate Windows Security Center and state that your computer is not protected. The fake security center looks just like the legitimate one except that it promotes rogue program. Some of the fake security alerts:

System Security Warning
Attempt to modify register key entries is detected. Register entries analysis is recommended.
Location: c:\windows\system32\taskmgr.exe
Viruses: Backdoor.Win32.Rbot

As you can see, Windows Efficiency Reservoir is a virus and must be removed upon detection. Please read the removal guide below and remove this virus using recommended remove tool. In some cases, this fake anti-spyware program comes with TDSS Trojan. Usually, it blocks legitimate anti-virus software, so at first you will have to remove this infection and then proceed with the rest of this removal guide. Also note that it may block security related websites, if you can't download malware removal tool then reboot your computer in safe mode with networking.

The latest parasite names used by FakeVimes:
Windows Internet Guard, Windows Web Watchdog, Windows AntiBreach Patrol, Windows Antivirus Patrol, Windows Pro Defence Kit

It might be that we are affiliated with any of our recommended products. Full disclosure can be found in our Agreement of Use. By downloading any of provided Anti-spyware software you agree with our Privacy Policy and Agreement of Use.
Do it now!
Reimage - remover Happiness
Compatible with Microsoft Windows
What to do if failed?
If you failed to remove infection using Reimage Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall Windows Efficiency Reservoir. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

More information about this program can be found in Reimage review.
Reimage is recommended to uninstall Windows Efficiency Reservoir. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

More information about this program can be found in Reimage review.
Not using OS X? Download a remover for Windows.
Press Mentions on Reimage
Alternate Software
Alternate Software
We are testing Plumbytes's efficiency (2012-08-02 02:02)
Malwarebytes Anti Malware
We are testing Malwarebytes Anti Malware's efficiency (2012-08-02 02:02)
Hitman Pro
Webroot SecureAnywhere AntiVirus
Windows Efficiency Reservoir screenshot
Windows Efficiency Reservoir snapshot

Windows Efficiency Reservoir manual removal

Kill processes:
Delete registry values:
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Policies\\System "DisableRegedit" = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Policies\\System "DisableRegistryTools" = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Policies\\System "DisableTaskMgr" = 0
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Run "Inspector"
HKEY_CURRENT_USER\\Software\Microsoft\\Windows\\CurrentVersion\\Settings "net" = "2012-3-11_2?
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Settings "UID" = "origkboryd"
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\atcon.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\bipcp.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\ecengine.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\infwin.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\msconfig
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\PavFnSvr.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\sahagent.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\titaninxp.exe
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\wsbgate.exe
Delete files:
%AppData%\Windows Efficiency Reservoir.exe
%CommonStartMenu%\Windows Efficiency Reservoir.lnk
%Desktop%\Windows Efficiency Reservoir.lnk

Information updated:

Comments on Windows Efficiency Reservoir

Post a comment

Attention: Use this form only if you have additional information about a parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Home page Name


(All fields are required)