Windows Safety Wizard

From Wiki-Security, the free encyclopedia of computer security

Windows Safety Wizard Information
Type: Spyware
Analysis: Installs & gathers info from a PC without user permission.
Infection: By downloading freeware & shareware.
Symptoms: Changes PC settings, excessive popups & slow PC performance.
Detection Tool: >>> Download SpyHunter's Spyware Scanner <<<

SpyHunter's spyware scanner is intended to quickly scan and identify spyware on your PC. If you wish to eliminate spyware from your PC and prevent future spyware attacks, we recommend you buy SpyHunter's spyware removal tool, which includes full technical support and a Spyware HelpDesk to tackle spyware that is uniquely affecting your PC.
IE Alert:

If you are using Internet Explorer and can not download SpyHunter, please use a different browser like Firefox or Chrome.

One of the rogue anti-spyware programs from FakeVimes malware family, Windows Safety Wizard, is a fake security application that takes on the form and supposed capabilities of genuine anti-malware software. While Windows Safety Wizard is promoted as a quick fix-all solution to virus, Trojan, spyware and rootkit infestations and threats, Windows Safety Wizard is nothing more than a scamware designed to mislead PC users and web surfers. Functioning in the same way as its clones like Windows Ultimate Security Patch, Windows Activity Debugger, Windows Premium Guard and Windows Pro Rescuer, Windows Safety Wizard is created by cybercriminals who are motivated by easy profit, without offering anything valuable in exchange for it.

Malevolent Activities by Windows Safety Wizard

The malicious activities of Windows Safety Wizard usually involve scans that don't last more than 5 seconds and recurring security notifications that warn of an 'existing infection'. These scans and notifications are annoying at best, but Windows Safety Wizard will not stop at ordinary annoyances. It will also disable Windows systems and block user access to a PC's registry and Task Manager. Windows Safety Wizard will also keep you from accessing the Internet and installing legitimate anti-malware applications. Even the simple task of accessing Notepad will be impossible, as most PC users will receive this warning: 'Application cannot be executed. The file notepad.exe is infected. Please activate your antivirus software.'

Cybercriminal Activities

Since Windows Safety Wizard debilitates the normal functions of any PC system, its immediate and complete removal should be a top priority. Paying for a purported full version of Windows Safety Wizard may end the recurring scans and annoying warnings for a certain time, but the malware present in the PC exposes it to further threats. According to PC security researchers, it is also possible for this malware to possess backdoor functionality as well as keystroke loggers. These permit the malware creators to gain access to personal information from any compromised PC, allowing them to manipulate the computer and force it to perform according to their whim.

Preventing a Windows Safety Wizard infestation is easy, as long as you know which websites to trust, which legitimate files to download, and which software vendors to deal with. By constantly updating legitimate anti-spyware and anti-malware tools in your PC, you can also easily detect which infections are real and which ones are simulated. In cases wherein you have already purchased this rogueware, there is no need to fret. You can remove Windows Safety Wizard using licensed security software. Furthermore, you may try to communicate with your credit card company, to dispute the purchase and classify the product as malicious software.

If you want to make your PC safe from Trojans, spyware and rootkits don't give Windows Safety Wizard the benefit of the doubt. There is a reasonable probability that your PC is not weighed down by viruses in the first place, and any possibility of an infection is the actual doing of Windows Safety Wizard. Keep your PC safe by saying no to Windows Safety Wizard, under any circumstance.

To check your computer for Windows Safety Wizard, download SpyHunter Spyware Detection Tool.

SpyHunter spyware detection tool is only a scanner meant to assist you in detecting Windows Safety Wizard and other threats. If you detect the presence of Windows Safety Wizard on your PC, you have the opportunity to purchase the SpyHunter removal tool to remove any traces of Windows Safety Wizard.


Detection of Windows Safety Wizard (Recommended)

Windows Safety Wizard is difficult to detect and remove. Windows Safety Wizard is not likely to be removed through a convenient "uninstall" feature. Windows Safety Wizard, as well as other spyware, can re-install itself even after it appears to have been removed.

You also run the risk of damaging your computer since you're required to find and delete sensitive files in your system such as DLL files and registry keys. It is recommended you use a good spyware remover to remove Windows Safety Wizard and other spyware, adware, trojans and viruses on your computer.

Run a Windows Safety Wizard scan/check to successfully detect all Windows Safety Wizard files with the SpyHunter Spyware Detection Tool. If you wish to remove Windows Safety Wizard, you can either purchase the SpyHunter spyware removal tool to remove Windows Safety Wizard or follow the Windows Safety Wizard manual removal method provided in the "Remedies and Prevention" section.

Method of Infection

There are many ways your computer could get infected with Windows Safety Wizard. Windows Safety Wizard can come bundled with shareware or other downloadable software.

Another method of distributing Windows Safety Wizard involves tricking you by displaying deceptive pop-up ads that may appear as regular Windows notifications with links which look like buttons reading Yes and No. No matter which "button" that you click on, a download starts, installing Windows Safety Wizard on your system. Windows Safety Wizard installs on your computer through a trojan and may infect your system without your knowledge or consent.

If you think you may already be infected with Windows Safety Wizard, use this SpyHunter Spyware dectection tool to detect Windows Safety Wizard and other common Spyware infections. After detection of Windows Safety Wizard, the next advised step is to remove Windows Safety Wizard with the purchase of the SpyHunter Spyware removal tool.


Windows Safety Wizard may attempt to change your computer's desktop, hijack your browser, monitor your Internet browsing activities, change system files, and can do this without your knowledge or permission. Therefore, it is strongly recommended to remove all traces of Windows Safety Wizard from your computer.

Remedies and Prevention

Windows Safety Wizard, as well as other Spyware, are constantly evolving and becoming more advanced to avoid detection. Windows Safety Wizard along with its variants can install in different locations and even when you try to uninstall it you find they reappear when you reboot your computer.

Install a good anti-spyware software

When there's a large number of traces of Spyware, for example Windows Safety Wizard, that have infected a computer, the only remedy may be to automatically run a Spyware scan from a good anti-spyware software designed to detect Windows Safety Wizard and other types of spyware.

Remove Windows Safety Wizard manually

Another method to remove Windows Safety Wizard is to manually delete Windows Safety Wizard files in your system. Detect and remove the following Windows Safety Wizard files:


  • %AppData%\Protector-[RANDOM 3 CHARACTERS].exe
  • %AppData%\Protector-[RANDOM 4 CHARACTERS].exe


  • %AppData%\NPSWF32.dll

Other Files

  • %AppData%\result.db
  • %AppData%\1st$0l3th1s.cnf
  • %CommonStartMenu%\Programs\Windows Safety Wizard.lnk
  • %Desktop%\Windows Safety Wizard.lnk

Registry Keys

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = 0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorAdmin" = 0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorUser" = 0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "EnableLUA" = 0
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "otbpxlqhjd"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "net" = "2012-6-4_7"
  • HKEY_CURRENT_USER\Software\ASProtect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protector.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xp_antispyware.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfmessenger.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tsadbot.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alevir.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[1].exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srng.exe

External links

If you believe your computer is infected with spyware,
Wiki-Security recommends using SpyHunter's spyware detection tool to check for the latest spyware threats.

Disclaimer Information
This website, its content or any portion of this website is NOT affiliated with, connected to, or sponsored by Windows Safety Wizard or its creators in any way. This website does not advocate the actions or behavior of Windows Safety Wizard and its creators. Our objective is to provide Internet users with the know-how to detect and remove Windows Safety Wizard and other Internet threats.

The readers of this article should not mistake, confuse or associate this article to be an advertisement or a promotion of Windows Safety Wizard in any way. The content provided on this website is intended for educational or informational purposes and is provided "AS IS" with no warranties, and confers no rights.