Severity scale:  
  (61/100)

“Windows Troubleshooting” scam. How to remove? (Uninstall guide)

removal by Julie Splinters - - | Type: Malware
12

“Windows Troubleshooter” scam raises technical support scams to a brand new level

Image "Windows Troubleshooting" scam

“Windows Troubleshooting” is a nasty example of technical support scam that spreads as cracked software installer. On the affected device it shows a fake Blue Screen of Death (BSOD)[1] and displays Troubleshooting Windows pop up that looks like legit Windows Troubleshooter. The purpose of the scam – to convince users into buying a fake Windows Defender Essentials program.

Typically tech support scam viruses ask to call fake support line in order to solve various problems, fix computer errors or clean cyber threats.[2] Users are often redirected to scam sites when browsing through insecure websites or after adware infiltration. However, “Windows Troubleshooting” support scam is different.

“Windows Troubleshooting” malware gets inside the system when user downloads and runs a particular cracked software installer. Once executed, malware alters Windows registry and downloads several files:

  • csrvc.exe to kill Task Manager, Registry Editor, and Explorer.
  • BSOD.exe to display a BSOD on the affected device.
  • Troubleshoot.exe to deliver fake “Troubleshooting Windows” alert.
  • Scshtrv.exe to upload a particular screenshot to the remote FTP server.
  • adwizz.exe to display Banggood.com ads.

Therefore, it’s an advanced technical support scam that is capable of making changes to Windows operating system. Additionally, the malware takes screenshots of the active computer’s screen. The reason why does it is unknown. However, it uploads them to its remote FTP server located at 182.50.132.48.

This activity is highly suspicious and might lead to privacy-related issues. For this reason, victims should remove “Windows Troubleshooting” virus immediately with security software, such as Reimage.

Operation of the “Windows Troubleshooting” technical support scam

After the “Windows Troubleshooting” hijack, malware downloads previously mentioned files. The first to run is BSOD.exe which displays a fake Blue Screen of Death which says:

A problem has been detected and Windows has been shut down to prevent damage
to your computer.

The problem seems to be caused by the following file: SYSTEM32.DLL

PAGE_FAULT_IN_NONPAGED_AREA.

The BSOD also gives instructions what users should do, such as restarting the computer, checking software and hardware. Additionally, you will hear an annoying beeping sound. However, this alert is followed by the appearance of fake “Windows Troubleshooting” window that delivers Error Code 0xc0000e9 and informs about missing .dll registry files:

Windows has encountered an unexpected error 0xc0000e9.

Your computer is missing .dll registry files resulting in computer failure.
The operating system is not able to load windows kernel files.
Repair windows kernel and .dll files with the help of technicians online to prevent hard drive crash or complete data loss. Rebooting the computer multiple times will result in permanent operating system failure.

Click Next to diagnose and troubleshoot the problem.

Criminals promote Windows Defender Essentials program that is supposed to fix the problem. People have to pay $25 via PayPal, Debit or Credit card. However, it seems that they not only want to receive money from a fake program but obtain sensitive information, such as contact information or credit card details.

Clicking the “Next” button triggers a system scan. Once it’s over, victims will see a bunch of detected problems. In order to fix them, victims can either buy Windows Defender Essentials or contact Live Chat Support.

However, none of these options are good for “Windows Troubleshooting” removal. Chatting with fake support technicians won’t give any results. If you manage to reach them, they will find numerous reasons to make you obtain a phony software.

Windows Defender Essentials can fix fake errors

Clicking “Buy Windows Defender Essentials (Recommended)” option redirects to a PayPal page where users are asked to obtain the program for $25. As soon as the payment is made (not recommended), users are redirected to the http://hitechnovation.com/thankyou.txt website.

The one and the most important component of this site is “thankuhitechnovation” string which informs malware that the payment is made.

Meanwhile, the virus opens a new window that shows the process of fixing previously detected problems. Once it’s done, users can close the program and access their computers.

However, bypassing the lock screen in this way is not recommended. There’s a way to workaround this trickery, but before giving you instructions, we want to introduce tips to avoid such cyber threats in the future.

Malware spreads as a fake program

“Windows Troubleshooter” scam spreads as a cracked program. Security experts from Les Virus[3] note that installation of illegal programs usually leads to malware attack. Therefore, you should always use legit download sources and pay for the license. Also, you should never:

  • download and install cracked software;
  • install updates from pop-ups;
  • install programs or updates from unknown third-party websites, torrents or other P2P networks.

Additionally, if you install freeware or shareware, you have to use Advanced/Custom installation settings instead of Quick/Recommended. This setup allows adjusting installation process and rejecting infiltration of potentially unwanted programs.

Remove “Windows Troubleshooting” scam

The first step of “Troubleshooting Windows” removal is to bypass the lock screen. Malware uses an easily breakable mechanism to check if a victim made a payment or not. However, you can easily workaround this problem by following these steps:

  1. Enter fake PayPal purchase screen.
  2. Click Ctrl + O keys to launch Open dialog box.
  3. Enter http://hitechnovation.com/thankyou.txt into Open box.

That’s all. You should be able to close the window and access your computer. However, “Windows Troubleshooting” removal is not over. You have to find and uninstall a malicious program from the computer that brought technical support scam to your device.

Even though you can uninstall the program manually, this cyber threat installed several executables and modified the system. Thus, fixing the computer is hard and difficult. In order to succeed and avoid possible damage, you should remove “Windows Troubleshooting” automatically using Reimage, Malwarebytes Anti Malware or other malware removal tools.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove “Windows Troubleshooting” scam you agree to our privacy policy and agreement of use.
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall “Windows Troubleshooting” scam. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.
More information about this program can be found in Reimage review.
Press mentions on Reimage

Manual “Windows Troubleshooting” scam Removal Guide:

Remove “Windows Troubleshooting” scam using Safe Mode with Networking

If you cannot install or run malware removal software once you bypassed the lock screen, you should follow these steps. Rebooting to Safe Mode with Networking might solve the problem.

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove “Windows Troubleshooting” scam

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete “Windows Troubleshooting” scam removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove “Windows Troubleshooting” scam using System Restore

If the previous method did not work, try System Restore. Then you should be able to activate automatic “Windows Troubleshooting” scam removal.

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of “Windows Troubleshooting” scam. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that “Windows Troubleshooting” scam removal is performed successfully.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from “Windows Troubleshooting” scam and other ransomwares, use a reputable anti-spyware, such as Reimage, Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus or Malwarebytes Anti Malware

About the author

Julie Splinters - Malware removal specialist

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Julie Splinters
About the company Esolutions

References