Severity scale:  
  (87/100)

Windows Protection Master. How to remove? (Uninstall guide)

removal by Ugnius Kiguolis - -   Also known as WindowsProtectionMaster | Type: Rogue Antispyware
12

Windows Protection Master is a program that should be avoided because it's a malware which relies on Trojan viruses and its creators are trying to get some money illegally by using this malicious threat. This rogue anti-spyware is promoted with a help of fake online anti-malware scanners, misleading sites and other fraudulent software. To make it easier to understand, you have to know that Windows Protection Master is basically a clone of Think Point application which also belongs to the same Rogue.VirusDoctor family.

Just after getting on board Windows Protection Master won't sit peacefully and will start appearing on your computer with scary notifications from Windows task bar. 
It also uses a fake scanner after each system reboot. After Windows Protection Master finishes its fake scan, it will claim that your computer is infected with numerous viruses but won't let remove them until you purchase its certain modules that are not included in a trial version. However, Windows Protection Master only pretends scanning actions and it won't remove any real virus even after being purchased. In order to trick its victims, this scamware claims:

Warning! Identity theft attempt detected
Hidden connection ip: XXXX
Target: Your bank account details.
Your IP: XXXX

Error
Keylogger activity detected. System information security is at risk.
It is recommended to activate protection and run a full system scan.

Warning! Spambot detected!
Attention! A spambot is sending viruses from your e-mail has been detected on your PC.
Yes, protect my PC and remove spambot now (Recommended)

Torrent Alert
Recommended: Please use secure encrypted protocol for torrent links.
Torrent link detected!
Receiving this notification means that you have violated the copyright laws. Using Torrent for downloading movies and licensed software shall be prosecuted and you may be sued for cybercrime and breach of law under the SOPA legislation.
Please register your copy of the AV to activate anonymous data transfer and protocol through the torrent link.

Warning! Virus Detected
Threat detected: FTP Server
Infected file: C:\Windows\System32\dllcache\wmploc.dll

This rogue anti-spyware won't stop its annoying activity until it is not eliminated. It may start continuous redirections to other fraudulent websites, hijack your browser and make your computer very hard to use. While running, Windows Protection Master was noticed to be blocking legitimate programs running. Even your browsers become very hard to launch when Windows Protection Master is secretly on your computer, so never leave this scamware on your PC. If you have already bought Windows Security Master, contact your credit card company to dispute the charges. And finally, remove Windows Protection Master from your computer using a reputable antispyware program.

Remember that only an upgraded version of a legitimate program, such as Reimage, Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus or Malwarebytes Anti Malware can do the job properly.

The latest parasite names used by FakeVimes:
[newest]

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove Windows Protection Master you agree to our privacy policy and agreement of use.
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall Windows Protection Master. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manual removal instructions below.

More information about this program can be found in Reimage review.

More information about this program can be found in Reimage review.
Windows Protection Master snapshot
Windows Protection Master

Windows Protection Master manual removal:

Kill processes:
Inspector[random].exe

Delete registry values:
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings "WarnOnHTTPSToHTTPRedirect" = 0

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem "DisableRegedit" = 0

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem "DisableRegistryTools" = 0

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem "DisableTaskMgr" = 0

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun "Inspector"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsadaware.exe "Debugger"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsbelt.exe "Debugger"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsdeputy.exe "Debugger"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsicload95.exe "Debugger"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionslnetinfo.exe "Debugger"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmpftray.exe "Debugger"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsnetscanpro.exe "Debugger"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsnssys32.exe "Debugger"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsozn695m5.exe "Debugger"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsperswf.exe "Debugger"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsPskSvc.exe "Debugger"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsSafetyKeeper.exe "Debugger"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsspoler.exe "Debugger"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionstaskmgr.exe "Debugger"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsvbcons.exe "Debugger"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionswinservn.exe "Debugger"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionszonealarm.exe "Debugger"

Unregister DLLs:
NPSWF32.dll

Delete files:
%AppData%Inspector-[random].exe

%AppData%NPSWF32.dll

%AppData%result.db

%UserProfile%DesktopWindows Protection Master.lnk

%StartMenu%ProgramsWindows Protection Master.lnk

About the author

Ugnius Kiguolis
Ugnius Kiguolis - The mastermind

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Ugnius Kiguolis
About the company Esolutions