Severity scale:  
  (68/100)

Windows Proprietary Advisor. How to remove? (Uninstall guide)

removal by Alice Woods - -   Also known as WindowsProprietaryAdvisor | Type: Rogue Antispyware
12

Windows Proprietary Advisor is the annoying malware that makes computer slow and disrupts its normal activity. According to our security experts, this program belongs to the category of rogue anti-spywares and clearly hails from FakeVimes family that have been actively spread since the last year. Windows Proprietary Advisor is probably the updated version of its predecessors, so be aware about that and be prepared for surprising interruptions in the form of misleading alerts, scanners and pop-up ads. Typically to rogue anti-spywares, Windows Proprietary Advisor claims to be an efficient instrument for keeping computer safe from viruses. However, that's definitely untrue because this program has an empty virus database. Windows Proprietary Advisor is capable to report only about invented security issues and does that for trying to convince you into purchasing its full licensed version. Instead of doing that, we highly recommend to ignore its alerts and remove Windows Proprietary Advisor from your computer.

HOW CAN I GET INFECTED WITH WINDOWS PROPRIETARY ADVISOR?

Windows Proprietary Advisor is usually distributed with a help of trojans that come inside their target systems through security vulnerabilities found. As soon as they are here, these scams set the rogue to start after every computer's reboot and start interrupting victim's normal PC activity. Though Windows Proprietary Advisor scanners look real and trustworthy, in reality they report about invented problems, like harmless system files or imaginary viruses. Its scans always end with a report telling that you must purchase licensed its version which is presented to be the only one capable to help with virus removal. However, you should note that Windows Proprietary Advisor is useless and should never be used for computer's protection.

In order to trick its victims into purchasing its fake license, Windows Proprietary Advisor displays such or similar alerts:

Error Software without a digital signature detected.
Your system files are at risk.
We strongly advise you to activate your protection.

Warning! Identity Theft attempt detected!
Hidden connection IP: 210.1.58.100
Target: Microsoft corporation keys
Your IP: 127.0.0.1

Fake alerts and scanners are common things between scareware programs and they may work if you happen to fall for them. However, instead of believing those viruses reported by Windows Proprietary Advisor, you should ignore every scanners it displays. Windows Proprietary Advisor is typical rogue which was released by scammers, so you must never pay for its licensed version.

HOW TO REMOVE WINDOWS PROPRIETARY ADVISOR?

We highly recommend you to scan your PC with reputable anti-malware program and remove all Windows Proprietary Advisor files from it. For that, we recommend running SpyHunter anti-malware.

The latest parasite names used by FakeVimes:
[newest]

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove Windows Proprietary Advisor you agree to our privacy policy and agreement of use.
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall Windows Proprietary Advisor. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manual removal instructions below.

More information about this program can be found in Reimage review.

More information about this program can be found in Reimage review.
Windows Proprietary Advisor snapshot
Windows Proprietary Advisor

Windows Proprietary Advisor manual removal:

Kill processes:
Protector-[3 random characters].exe

Protector-[4 random characters].exe

Delete registry values:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerMainFeatureControlFEATURE_ERROR_PAGE_BYPASS_ZONE_CHECK_FOR_HTTPS_KB954312

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings "WarnOnHTTPSToHTTPRedirect" = 0

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem "DisableRegedit" = 0

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem "DisableRegistryTools" = 0

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem "DisableTaskMgr" = 0

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun "Inspector"

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionSettings "ID" = 0

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionSettings "net" = "2012-2-17_2"

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionSettings "UID" = "rudbxijemb"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options_avp32.exe

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options_avpcc.exe

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsashDisp.exe

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsdivx.exe

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmostat.exe

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsplatin.exe

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionstapinstall.exe

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionszapsetup3001.exe

There are more similar entries, you should let spyware Doctor to identify them.

Unregister DLLs:
npswf32.dll

Delete files:
%AppData%Protector-[rnd].exe

%AppData%NPSWF32.dll

%AppData%Protector-[3 random characters].exe

%AppData%Protector-[4 random characters].exe

%AppData%result.db

%AppData%1st$0l3th1s.cnf

About the author

Alice Woods
Alice Woods - Likes to teach users about virus prevention

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Alice Woods
About the company Esolutions