Uploaded November 2013 | Updated September 2026, 2 weeks ago

---

malwareup.org
Video/Site Donations: http://is.gd/2yLYTb

These instructions also apply to the following fake antiviruses:
Windows Active Hotspot
Windows Warding Module
Windows Activity Booster
Windows Efficiency Console
Windows Premium Shield
Windows Accelerator Pro

Apologies for the audio quality, automatic gain mode on new mic decided to enable itself. Thanks to SpiderLover for the sample.

Today's experiment involves a new fake antivirus called Windows Cleaning Toolkit, or Windows Expert Console. This rogue uses some of the GUI from the Fakevimes family, and the shell hooking tendencies of the ThinkPoint family of rogues. Removal is a bit more difficult than most rogues, however the process is still fairly simple.

1. Reboot your computer
2. Start in Safe Mode with Command Prompt
3. Run regedit
4. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\
5. Highlight Winlogon
6. Double-click Shell
7. Clear the entry and replace it with "explorer.exe" (without quotes)
8. Run explorer.exe
9. Navigate to %appdata%
10. Delete guard-xxxx.exe
11. Reboot into regular mode
12. Download Malwarebytes' Anti-Malware from malwarebytes.org/mwb-download
13. Install
14. Run a quick scan
15. Reboot