Severity scale:  

Remove “Windows Troubleshooting” scam (Virus Removal Guide) - Tutorial

removal by Julie Splinters - - | Type: Malware

“Windows Troubleshooter” scam raises technical support scams to a brand new level

Image "Windows Troubleshooting" scam

“Windows Troubleshooting” is a nasty example of technical support scam that spreads as cracked software installer. On the affected device it shows a fake Blue Screen of Death (BSOD)[1] and displays Troubleshooting Windows pop up that looks like legit Windows Troubleshooter. The purpose of the scam – to convince users into buying a fake Windows Defender Essentials program.

Typically tech support scam viruses ask to call fake support line in order to solve various problems, fix computer errors or clean cyber threats.[2] Users are often redirected to scam sites when browsing through insecure websites or after adware infiltration. However, “Windows Troubleshooting” support scam is different.

“Windows Troubleshooting” malware gets inside the system when user downloads and runs a particular cracked software installer. Once executed, malware alters Windows registry and downloads several files:

  • csrvc.exe to kill Task Manager, Registry Editor, and Explorer.
  • BSOD.exe to display a BSOD on the affected device.
  • Troubleshoot.exe to deliver fake “Troubleshooting Windows” alert.
  • Scshtrv.exe to upload a particular screenshot to the remote FTP server.
  • adwizz.exe to display ads.

Therefore, it’s an advanced technical support scam that is capable of making changes to Windows operating system. Additionally, the malware takes screenshots of the active computer’s screen. The reason why does it is unknown. However, it uploads them to its remote FTP server located at

This activity is highly suspicious and might lead to privacy-related issues. For this reason, victims should remove “Windows Troubleshooting” virus immediately with security software, such as Reimage Reimage Cleaner Intego.

Operation of the “Windows Troubleshooting” technical support scam

After the “Windows Troubleshooting” hijack, malware downloads previously mentioned files. The first to run is BSOD.exe which displays a fake Blue Screen of Death which says:

A problem has been detected and Windows has been shut down to prevent damage
to your computer.

The problem seems to be caused by the following file: SYSTEM32.DLL


The BSOD also gives instructions what users should do, such as restarting the computer, checking software and hardware. Additionally, you will hear an annoying beeping sound. However, this alert is followed by the appearance of fake “Windows Troubleshooting” window that delivers Error Code 0xc0000e9 and informs about missing .dll registry files:

Windows has encountered an unexpected error 0xc0000e9.

Your computer is missing .dll registry files resulting in computer failure.
The operating system is not able to load windows kernel files.
Repair windows kernel and .dll files with the help of technicians online to prevent hard drive crash or complete data loss. Rebooting the computer multiple times will result in permanent operating system failure.

Click Next to diagnose and troubleshoot the problem.

Criminals promote Windows Defender Essentials program that is supposed to fix the problem. People have to pay $25 via PayPal, Debit or Credit card. However, it seems that they not only want to receive money from a fake program but obtain sensitive information, such as contact information or credit card details.

Clicking the “Next” button triggers a system scan. Once it’s over, victims will see a bunch of detected problems. In order to fix them, victims can either buy Windows Defender Essentials or contact Live Chat Support.

However, none of these options are good for “Windows Troubleshooting” removal. Chatting with fake support technicians won’t give any results. If you manage to reach them, they will find numerous reasons to make you obtain a phony software.

Example of "Windows Troubleshooting" tech support scam"Windows Troubleshooting" scam triggers the Blue Screen of Death and asks to purchase a fake Windows Defender Essentials program via PayPal.

Windows Defender Essentials can fix fake errors

Clicking “Buy Windows Defender Essentials (Recommended)” option redirects to a PayPal page where users are asked to obtain the program for $25. As soon as the payment is made (not recommended), users are redirected to the website.

The one and the most important component of this site is “thankuhitechnovation” string which informs malware that the payment is made.

Meanwhile, the virus opens a new window that shows the process of fixing previously detected problems. Once it’s done, users can close the program and access their computers.

However, bypassing the lock screen in this way is not recommended. There’s a way to workaround this trickery, but before giving you instructions, we want to introduce tips to avoid such cyber threats in the future.

Malware spreads as a fake program

“Windows Troubleshooter” scam spreads as a cracked program. Security experts from Les Virus[3] note that installation of illegal programs usually leads to malware attack. Therefore, you should always use legit download sources and pay for the license. Also, you should never:

  • download and install cracked software;
  • install updates from pop-ups;
  • install programs or updates from unknown third-party websites, torrents or other P2P networks.

Additionally, if you install freeware or shareware, you have to use Advanced/Custom installation settings instead of Quick/Recommended. This setup allows adjusting installation process and rejecting infiltration of potentially unwanted programs.

Remove “Windows Troubleshooting” scam

The first step of “Troubleshooting Windows” removal is to bypass the lock screen. Malware uses an easily breakable mechanism to check if a victim made a payment or not. However, you can easily workaround this problem by following these steps:

  1. Enter fake PayPal purchase screen.
  2. Click Ctrl + O keys to launch Open dialog box.
  3. Enter into Open box.

That’s all. You should be able to close the window and access your computer. However, “Windows Troubleshooting” removal is not over. You have to find and uninstall a malicious program from the computer that brought technical support scam to your device.

Even though you can uninstall the program manually, this cyber threat installed several executables and modified the system. Thus, fixing the computer is hard and difficult. In order to succeed and avoid possible damage, you should remove “Windows Troubleshooting” automatically using Reimage Reimage Cleaner Intego, Malwarebytes or other malware removal tools.

do it now!
Reimage Happiness
Intego Happiness
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage Intego, submit a question to our support team and provide as much details as possible.
Reimage Intego has a free limited scanner. Reimage Intego offers more through scan when you purchase its full version. When free scanner detects issues, you can fix them using free manual repairs or you can decide to purchase the full version in order to fix them automatically.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Reimage, try running SpyHunter 5.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Intego, try running Combo Cleaner.

To remove “Windows Troubleshooting” scam, follow these steps:

Remove “Windows Troubleshooting” scam using Safe Mode with Networking

If you cannot install or run malware removal software once you bypassed the lock screen, you should follow these steps. Rebooting to Safe Mode with Networking might solve the problem.

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove “Windows Troubleshooting” scam

    Log in to your infected account and start the browser. Download Reimage Reimage Cleaner Intego or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete “Windows Troubleshooting” scam removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove “Windows Troubleshooting” scam using System Restore

If the previous method did not work, try System Restore. Then you should be able to activate automatic “Windows Troubleshooting” scam removal.

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of “Windows Troubleshooting” scam. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage Reimage Cleaner Intego and make sure that “Windows Troubleshooting” scam removal is performed successfully.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from “Windows Troubleshooting” scam and other ransomwares, use a reputable anti-spyware, such as Reimage Reimage Cleaner Intego, SpyHunter 5Combo Cleaner or Malwarebytes

Access your website securely from any location

When you work on the domain, site, blog, or different project that requires constant management, content creation, or coding, you may need to connect to the server and content management service more often. It is a hassle when your website is protected from suspicious connections and unauthorized IP addresses.

The best solution for creating a tighter network could be a dedicated/fixed IP address. If you make your IP address static and set to your device, you can connect to the CMS from any location and do not create any additional issues for server or network manager that need to monitor connections and activities. This is how you bypass some of the authentications factors and can remotely use your banking accounts without triggering suspicious with each login. 

VPN software providers like Private Internet Access can help you with such settings and offer the option to control the online reputation and manage projects easily from any part of the world. It is better to clock the access to your website from different IP addresses. So you can keep the project safe and secure when you have the dedicated IP address VPN and protected access to the content management system.

Backup files for the later use, in case of the malware attack

Computer users can suffer from data losses due to cyber infections or their own faulty doings. Ransomware can encrypt and hold files hostage, while unforeseen power cuts might cause a loss of important documents. If you have proper up-to-date backups, you can easily recover after such an incident and get back to work. It is also equally important to update backups on a regular basis so that the newest information remains intact – you can set this process to be performed automatically.

When you have the previous version of every important document or project you can avoid frustration and breakdowns. It comes in handy when malware strikes out of nowhere. Use Data Recovery Pro for the data restoration process.

About the author
Julie Splinters
Julie Splinters - Malware removal specialist

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Julie Splinters
About the company Esolutions


Your opinion regarding “Windows Troubleshooting” scam