Windows Safety Manager

From Wiki-Security, the free encyclopedia of computer security

Windows Safety Manager Information
Type: Spyware
Analysis: Installs & gathers info from a PC without user permission.
Infection: By downloading freeware & shareware.
Symptoms: Changes PC settings, excessive popups & slow PC performance.
Detection Tool: >>> Download SpyHunter's Spyware Scanner <<<

SpyHunter's spyware scanner is intended to quickly scan and identify spyware on your PC. If you wish to eliminate spyware from your PC and prevent future spyware attacks, we recommend you buy SpyHunter's spyware removal tool, which includes full technical support and a Spyware HelpDesk to tackle spyware that is uniquely affecting your PC.
IE Alert:

If you are using Internet Explorer and can not download SpyHunter, please use a different browser like Firefox or Chrome.

Windows Safety Manager is a bogus anti-spyware application designed to provide false information to Windows PC users, for the primary purpose of eliciting profit. Windows Safety Manager imitates the scan processes of real anti-spyware scanners although Windows Safety Manager does not have a virus database or a functional virus detection system. Many other variants of Windows Safety Manager have already been released by the malware family FakeVimes, and these clones all share the same GUI and design. Windows Crucial Scanner, Windows Processes Accelerator, Windows Cleaning Tools and Windows Guard Solutions all share the same 'Windows' label, although these applications are not products from Microsoft. They are nothing but shady imitation of legitimate anti-spyware products, created simply to defraud PC users and persuade them to hand over payment for the licensed edition of Windows Safety Manager.

Windows Safety Manager's Installation and Spread

There are two ways by which the malware Windows Safety Manager is installed. Like many other types of rogueware, Windows Safety Manager may be installed by PC users themselves or by a Trojan that lurks in hacked websites. In the first case, the infection usually takes place through questionable sites masquerading as legitimate websites. These sites advertise an anti-malware scanner, which will immediately state that the computer is infected and that Windows Safety Manager will have to be downloaded. The PC users, therefore, are responsible for the installation. However, they are oblivious to the fact that they are actually downloading malicious software.

The second method of installation involves the employment of Trojans, which are known to download the Windows Safety Manager infection without requiring the user intervention. The Trojan seeks out security vulnerabilities in the computer and takes advantage of this to download Windows Safety Manager secretly and successfully. Once fully downloaded, Windows Safety Manager will start to run fake scans and issue bogus security alerts that serve primarily to scare the PC user into buying its full version.

The Conspicuous Behavior of Windows Safety Manager

Detecting a Windows Safety Manager infection is not difficult, since this malware will launch itself every time the PC is rebooted. Windows Safety Manager will run scans automatically, announcing various infections and threats after each scan. As if these are not enough, Windows Safety Manager will also display security alerts, which are all baseless and erroneous. Since Windows Safety Manager does not have the capability in detecting real threats and infections, Windows Safety Manager may label legitimate files as malware, or Windows Safety Manager may introduce real infections, just so Windows Safety Manager will have something to detect. The former will jeopardize legitimate files, which you have saved in your PC while the latter will expose your PC to worse threats.

The fact that Windows Safety Manager extorts money from you is just one of its many ill effects. This malware places your PC at greater risk for spyware and virus attacks. If no intervention is done on time, this may result in a damaging computer crash.
The safety of your PC has nothing to do with Windows Safety Manager. Delete this malware using legitimate PC security software now. Windows Safety Manager is a non legitimate application that must be eliminated from any computer, before Windows Safety Manager invites even more infection and places the PC in even greater risk.

To check your computer for Windows Safety Manager, download SpyHunter Spyware Detection Tool.

SpyHunter spyware detection tool is only a scanner meant to assist you in detecting Windows Safety Manager and other threats. If you detect the presence of Windows Safety Manager on your PC, you have the opportunity to purchase the SpyHunter removal tool to remove any traces of Windows Safety Manager.


Detection of Windows Safety Manager (Recommended)

Windows Safety Manager is difficult to detect and remove. Windows Safety Manager is not likely to be removed through a convenient "uninstall" feature. Windows Safety Manager, as well as other spyware, can re-install itself even after it appears to have been removed.

You also run the risk of damaging your computer since you're required to find and delete sensitive files in your system such as DLL files and registry keys. It is recommended you use a good spyware remover to remove Windows Safety Manager and other spyware, adware, trojans and viruses on your computer.

Run a Windows Safety Manager scan/check to successfully detect all Windows Safety Manager files with the SpyHunter Spyware Detection Tool. If you wish to remove Windows Safety Manager, you can either purchase the SpyHunter spyware removal tool to remove Windows Safety Manager or follow the Windows Safety Manager manual removal method provided in the "Remedies and Prevention" section.

Method of Infection

There are many ways your computer could get infected with Windows Safety Manager. Windows Safety Manager can come bundled with shareware or other downloadable software.

Another method of distributing Windows Safety Manager involves tricking you by displaying deceptive pop-up ads that may appear as regular Windows notifications with links which look like buttons reading Yes and No. No matter which "button" that you click on, a download starts, installing Windows Safety Manager on your system. Windows Safety Manager installs on your computer through a trojan and may infect your system without your knowledge or consent.

If you think you may already be infected with Windows Safety Manager, use this SpyHunter Spyware dectection tool to detect Windows Safety Manager and other common Spyware infections. After detection of Windows Safety Manager, the next advised step is to remove Windows Safety Manager with the purchase of the SpyHunter Spyware removal tool.


Windows Safety Manager may attempt to change your computer's desktop, hijack your browser, monitor your Internet browsing activities, change system files, and can do this without your knowledge or permission. Therefore, it is strongly recommended to remove all traces of Windows Safety Manager from your computer.

Remedies and Prevention

Windows Safety Manager, as well as other Spyware, are constantly evolving and becoming more advanced to avoid detection. Windows Safety Manager along with its variants can install in different locations and even when you try to uninstall it you find they reappear when you reboot your computer.

Install a good anti-spyware software

When there's a large number of traces of Spyware, for example Windows Safety Manager, that have infected a computer, the only remedy may be to automatically run a Spyware scan from a good anti-spyware software designed to detect Windows Safety Manager and other types of spyware.

Remove Windows Safety Manager manually

Another method to remove Windows Safety Manager is to manually delete Windows Safety Manager files in your system. Detect and remove the following Windows Safety Manager files:


  • %AppData%\Protector-[RANDOM CHARACTERS].exe


  • %AppData%\NPSWF32.dll

Other Files

  • %Desktop%\Windows Safety Manager.lnk
  • %CommonStartMenu%\Programs\Windows Safety Manager.lnk
  • %AppData%\result.db

Registry Keys

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = 0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "EnableLUA" = 0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorAdmin" = 0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorUser" = 0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "net" = "2012-4-7_2"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "ahwohainwk"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswUpdSv.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atcon.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\advxdwin.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswRunDll.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\inetlnfo.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bidef.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dvp95.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds-3.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winupdate.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ozn695m5.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rtvscn95.exe

External links

If you believe your computer is infected with spyware,
Wiki-Security strongly recommends to download SpyHunter's spyware detection tool to check for spyware on your PC.

Disclaimer Information
This website, its content or any portion of this website is NOT affiliated with, connected to, or sponsored by Windows Safety Manager or its creators in any way. This website does not advocate the actions or behavior of Windows Safety Manager and its creators. Our objective is to provide Internet users with the know-how to detect and remove Windows Safety Manager and other Internet threats.

The readers of this article should not mistake, confuse or associate this article to be an advertisement or a promotion of Windows Safety Manager in any way. The content provided on this website is intended for educational or informational purposes and is provided "AS IS" with no warranties, and confers no rights.