Windows Proactive Safety

From Wiki-Security, the free encyclopedia of computer security

Windows Proactive Safety Information
Type: Spyware
Analysis: Installs & gathers info from a PC without user permission.
Infection: By downloading freeware & shareware.
Symptoms: Changes PC settings, excessive popups & slow PC performance.
Detection Tool: >>> Download SpyHunter's Spyware Scanner <<<

SpyHunter's spyware scanner is intended to quickly scan and identify spyware on your PC. If you wish to eliminate spyware from your PC and prevent future spyware attacks, we recommend you buy SpyHunter's spyware removal tool, which includes full technical support and a Spyware HelpDesk to tackle spyware that is uniquely affecting your PC.
IE Alert:

If you are using Internet Explorer and can not download SpyHunter, please use a different browser like Firefox or Chrome.

Windows ProActive Safety is a rogue anti-spyware program that prompts you to install its trialware and then purchase its full-version software. As malicious software distributed by the FakeVimes family of rogueware, Windows ProActive Safety, is not a legitimate security application. At first sight, this software may appear like a genuine anti-spyware tool, or Windows ProActive Safety may resemble the interface of Windows Security Center. This is no reason to be fooled, however. As a clone of several other rogue anti-spyware tools like Windows Maintenance Guard, Windows Secure Web Patch and Windows Active Defender, this malware is engineered mainly for profit. Windows ProActive Safety is without any credible functionality, so that any PC is better off without Windows ProActive Safety.

A Carefully-Designed Plot

The creators of Windows ProActive Safety are aware on how PC users value the importance of computer security. They also understand the need for PC users to have access to licensed security software, in order to keep hackers at bay and prevent virus threats from escalating into progressive infections. These rogue PC security programs are created to take advantage of this necessity. Windows ProActive Safety will introduce itself as genuine security software, after Windows ProActive Safety has convinced the user of infections which may be non-existing. Windows ProActive Safety will also purposely introduce malware, spyware, rootkits, and keyloggers into the computer after its initial installation. Then, by launching scans and displaying pop-ups and alerts that point to alleged security issues, Windows ProActive Safety will convince the user to install its full version – only this time, with a price.

It is already bad enough for any PC user to pay for worthless anti-spyware software, but the risks don't stop here. In a study made by malware researchers, it has been discovered that the continued presence of the Windows ProActive Safety malware in any computer is already a risk in itself. Downloading and purchasing the paid version of Windows ProActive Safety may put an end to the recurring scans and annoying pop-ups. However, this will not take care of whatever infections or risks Windows ProActive Safety has exposed the computer to, in the first place. In reality, this fraudulent application will make the computer more prone to virus and spyware threats, by intentionally lowering PC security settings.

Putting an End to the Scam

It is important for PC users to remove Windows ProActive Safety immediately upon detection. This scamware should not be allowed to infiltrate personal computers or desktops. No amount of marketing on the part of the perpetrators and affiliates of Windows ProActive Safety will make this malicious software a worthy purchase. Without real functionalities, Windows ProActive Safety will not help with spyware-related problems, drive-by-download attacks or keylogger activities. As a malicious program, this rogue anti-spyware application will only bring considerable damage to your PC.

Do not pay for any program designed to take over the functions of your PC, cause browser redirects and system slowdowns or steal information. Do not pay for Windows ProActive Safety or any of its earlier variants. Save your money for legitimate security software that delivers on its guarantees!

To check your computer for Windows Proactive Safety, download SpyHunter Spyware Detection Tool.

SpyHunter spyware detection tool is only a scanner meant to assist you in detecting Windows Proactive Safety and other threats. If you detect the presence of Windows Proactive Safety on your PC, you have the opportunity to purchase the SpyHunter removal tool to remove any traces of Windows Proactive Safety.


Detection of Windows Proactive Safety (Recommended)

Windows Proactive Safety is difficult to detect and remove. Windows Proactive Safety is not likely to be removed through a convenient "uninstall" feature. Windows Proactive Safety, as well as other spyware, can re-install itself even after it appears to have been removed.

You also run the risk of damaging your computer since you're required to find and delete sensitive files in your system such as DLL files and registry keys. It is recommended you use a good spyware remover to remove Windows Proactive Safety and other spyware, adware, trojans and viruses on your computer.

Run a Windows Proactive Safety scan/check to successfully detect all Windows Proactive Safety files with the SpyHunter Spyware Detection Tool. If you wish to remove Windows Proactive Safety, you can either purchase the SpyHunter spyware removal tool to remove Windows Proactive Safety or follow the Windows Proactive Safety manual removal method provided in the "Remedies and Prevention" section.

Method of Infection

There are many ways your computer could get infected with Windows Proactive Safety. Windows Proactive Safety can come bundled with shareware or other downloadable software.

Another method of distributing Windows Proactive Safety involves tricking you by displaying deceptive pop-up ads that may appear as regular Windows notifications with links which look like buttons reading Yes and No. No matter which "button" that you click on, a download starts, installing Windows Proactive Safety on your system. Windows Proactive Safety installs on your computer through a trojan and may infect your system without your knowledge or consent.

If you think you may already be infected with Windows Proactive Safety, use this SpyHunter Spyware dectection tool to detect Windows Proactive Safety and other common Spyware infections. After detection of Windows Proactive Safety, the next advised step is to remove Windows Proactive Safety with the purchase of the SpyHunter Spyware removal tool.


Windows Proactive Safety may attempt to change your computer's desktop, hijack your browser, monitor your Internet browsing activities, change system files, and can do this without your knowledge or permission. Therefore, it is strongly recommended to remove all traces of Windows Proactive Safety from your computer.

Remedies and Prevention

Windows Proactive Safety, as well as other Spyware, are constantly evolving and becoming more advanced to avoid detection. Windows Proactive Safety along with its variants can install in different locations and even when you try to uninstall it you find they reappear when you reboot your computer.

Install a good anti-spyware software

When there's a large number of traces of Spyware, for example Windows Proactive Safety, that have infected a computer, the only remedy may be to automatically run a Spyware scan from a good anti-spyware software designed to detect Windows Proactive Safety and other types of spyware.

Remove Windows Proactive Safety manually

Another method to remove Windows Proactive Safety is to manually delete Windows Proactive Safety files in your system. Detect and remove the following Windows Proactive Safety files:


  • %AppData%\Windows Proactive Safety\ScanDisk_.exe
  • %CommonAppData%\58ef5\SP98c.exe

Other Files

  • %AppData%\Windows Proactive Safety\Instructions.ini
  • %AppData%\Microsoft\Internet Explorer\Quick Launch\Windows Proactive Safety.lnk
  • %Desktop%\Windows Proactive Safety.lnk
  • %StartMenu%\Windows Proactive Safety.lnk
  • %Programs%\Windows Proactive Safety.lnk
  • %CommonAppData%\SPUPCZPDET\SPABOIJT.cfg
  • %CommonAppData%\58ef5\SPT.ico

Registry Keys

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Windows Proactive Safety
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Windows Proactive Safety\DisplayIcon [unknown dir]\[unknown file name].exe,0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Windows Proactive Safety"%CommonAppData%\58ef5\SP98c.exe" /s /d
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Windows Proactive Safety\DisplayName Windows Malware Firewall
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Windows Windows Proactive Safety\DisplayVersion
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Windows Maintenance Guard\UninstallString "[unknown dir]\[unknown file name].exe"/del
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Windows Proactive SafetyInstallLocation [unknown dir]
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Windows Maintenance Guard\Publisher UIS Inc.
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ [unknown dir]\[unknown file name].exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ Implements DocHostUIHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ [unknown file name].DocHostUIHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Dumped_.DocHostUIHandler\Clsid
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Dumped_.DocHostUIHandler\Clsid\ {3F2BBC05-40DF-11D2-9455-00104BC936FF}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Dumped_.DocHostUIHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Dumped_.DocHostUIHandler\ Implements DocHostUIHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\EnableConsoleTracing 0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\EnableFileTracing 0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\FileTracingMask -65536
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\MaxFileSize 1048576
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\ConsoleTracingMask -65536
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\FileDirectory %windir%\tracing
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe\Debugger svchost.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe
  • HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe\Debugger svchost.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWEBGRD.EXE\Debugger svchost.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\About.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE\Debugger svchost.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWEBGRD.EXE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\About.exe\Debugger svchost.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV.exe\Debugger svchost.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AluSchedulerSvc.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AluSchedulerSvc.exe\Debugger svchost.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe\Debugger svchost.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe\Debugger svchost.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV\Debugger svchost.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV.exe

External links

If you believe your computer is infected with spyware,
Wiki-Security recommends using SpyHunter's spyware detection tool to check for the latest spyware threats.

Disclaimer Information
This website, its content or any portion of this website is NOT affiliated with, connected to, or sponsored by Windows Proactive Safety or its creators in any way. This website does not advocate the actions or behavior of Windows Proactive Safety and its creators. Our objective is to provide Internet users with the know-how to detect and remove Windows Proactive Safety and other Internet threats.

The readers of this article should not mistake, confuse or associate this article to be an advertisement or a promotion of Windows Proactive Safety in any way. The content provided on this website is intended for educational or informational purposes and is provided "AS IS" with no warranties, and confers no rights.