Severity scale  
  (80/100)

Windows Performance Catalyst. How to Remove? (Uninstall Guide)

removal by - -  
12

Windows Performance Catalyst is a rogue antispyware program that imitates a security tool in order to rip computer users off. It is one more clone of infamous Think Point. The program spreads through Trojan viruses and infects computers completely secretly. When Windows Performance Catalyst is installed, it also is configured to start automatically when computer is booted.

Once computer is started, Windows Performance Catalyst runs its scanner and pretends to look for malicious threats. The program later generates a list of supposedly infected files. In reality these files don't exist at all or they are legitimate files of some of your programs. The reason why they are being displayed is because the program expects you believe you system is being infected. Then it offers purchasing a full version of Windows Performance Catalyst which promises providing the best security for your system.

What is more, Windows Performance Catalyst also displays tons of fake security alerts and reports that your system badly needs protection. You can have a look at them here:

Warning! Identity theft attempt detected
Hidden connection ip: XXXX
Target: Your bank account details.
Your IP: XXXX

Error
Keylogger activity detected. System information security is at risk.
It is recommended to activate protection and run a full system scan.

Warning! Spambot detected!
Attention! A spambot is sending viruses from your e-mail has been detected on your PC.
Yes, protect my PC and remove spambot now (Recommended)

Torrent Alert
Recommended: Please use secure encrypted protocol for torrent links.
Torrent link detected!
Receiving this notification means that you have violated the copyright laws. Using Torrent for downloading movies and licensed software shall be prosecuted and you may be sued for cybercrime and breach of law under the SOPA legislation.
Please register your copy of the AV to activate anonymous data transfer and protocol through the torrent link.

Warning! Virus Detected
Threat detected: FTP Server
Infected file: C:\Windows\System32\dllcache\wmploc.dll

These message will lead to asking you to purchase a full version of Windows Performance Catalyst. Do not fall for this trick as you will not receive any program at all. Paying for Windows Performance Catalyst is equal to throwing your money to the wind. Instead you should make sure to get rid of Windows Performance Catalyst as soon as possible.

If it happened to you to fall for this trick and you have paid for Windows Performance Catalyst, immediately contact your credit card company and dispute the charges. You must also remove Windows Performance Catalyst as soon as possible in order to finish this nightmare. Use Reimage, PlumbytesWebroot SecureAnywhere AntiVirus or any other reliable antispyware program for the best results.

The latest parasite names used by FakeVimes:
Windows Internet Guard, Windows Web Watchdog, Windows AntiBreach Patrol, Windows Antivirus Patrol, Windows Pro Defence Kit

It might be that we are affiliated with any of our recommended products. Full disclosure can be found in our Agreement of Use. By downloading any of provided Anti-spyware software you agree with our Privacy Policy and Agreement of Use.
Do it now!
Download
Reimage - remover Happiness
Guarantee
Compatible with Microsoft Windows
What to do if failed?
If you failed to remove infection using Reimage Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall Windows Performance Catalyst. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

More information about this program can be found in Reimage review.
Reimage is recommended to uninstall Windows Performance Catalyst. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

More information about this program can be found in Reimage review.
Not using OS X? Download a remover for Windows.
Press Mentions on Reimage
Alternate Software
Alternate Software
Plumbytes
We are testing Plumbytes's efficiency (2012-02-20 04:52)
Malwarebytes Anti Malware
We are testing Malwarebytes Anti Malware's efficiency (2012-02-20 04:52)
Hitman Pro
Webroot SecureAnywhere AntiVirus
Windows Performance Catalyst screenshot
Windows Performance Catalyst snapshot

Windows Performance Catalyst manual removal

Kill processes:
Inspector[random].exe
Delete registry values:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adaware.exe "Debugger"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\belt.exe "Debugger"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deputy.exe "Debugger"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icload95.exe "Debugger"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lnetinfo.exe "Debugger"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpftray.exe "Debugger"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netscanpro.exe "Debugger"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nssys32.exe "Debugger"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ozn695m5.exe "Debugger"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perswf.exe "Debugger"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PskSvc.exe "Debugger"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SafetyKeeper.exe "Debugger"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoler.exe "Debugger"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe "Debugger"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcons.exe "Debugger"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winservn.exe "Debugger"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonealarm.exe "Debugger"
Unregister DLLs:
NPSWF32.dll

Delete files:
%AppData%\Inspector-[random].exe
%AppData%\NPSWF32.dll
%AppData%\result.db
%UserProfile%\Desktop\Windows Protection Master.lnk
%StartMenu%\Programs\Windows Protection Master.lnk

Information updated:

Comments on Windows Performance Catalyst

Post a comment

Attention: Use this form only if you have additional information about a parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Home page Name



«

(All fields are required)