Accepted Answer

Windows Protection Suite is a fake security software which uses fraudulent strategies by displaying false or exaggerated security issues on your computer rather than any legitimate ones to coerce you into purchasing their software.

Windows Protection Suite is a new malicious specimen from the same malware author; dreamakerlab. They earlier produced a similar rouge anti-spyware known as

Windows Protection Suite Files, Processes and Registry Entries:

Spoiler:

• %UserProfile%\Recent\energy.dll
  
• %UserProfile%\Recent\kernel32.dll
  
• %UserProfile%\Recent\runddl.dll
  
• %UserProfile%\Recent\std.exe
  
• %Documents and Settings%\All Users\Application Data\345d567\mozcrt19.dll
  
• %UserProfile%\Recent\dudl.sys
  
• %UserProfile%\Recent\grid.sys
  
• %UserProfile%\Recent\PE.dll
  
• %UserProfile%\Recent\snl2w.exe
  
• %UserProfile%\Desktop\WindowsProtectionSuite.exe
  
• %Documents and Settings%\All Users\Application Data\345d567\WI345d.exe
  
• %UserProfile%\Recent\CLSV.exe
  
• %UserProfile%\Recent\grid.dll
  
• %UserProfile%\Recent\tempdoc.dll
  
• %UserProfile%\Recent\SM.dll
  
• %Program Files%\WindowsProtectionSuite\WindowsProtectionSuite.exe
  
• %Documents and Settings%\All Users\Application Data\345d567\sqlite3.dll
  
• %UserProfile%\Recent\kernel32.dll
  
• %UserProfile%\Recent\runddl.dll
  
• %Documents and Settings%\All Users\Application Data\345d567\sqlite3.dll
  
• %UserProfile%\Recent\grid.dll
  
• %UserProfile%\Recent\PE.dll
  
• %Documents and Settings%\All Users\Application Data\345d567\mozcrt19.dll
  
• %UserProfile%\Recent\energy.dll
  
• %UserProfile%\Recent\tempdoc.dll
  
• %UserProfile%\Recent\SM.dll
  
• %UserProfile%\Application Data\Windows Protection Suite\cookies.sqlite
  
• %UserProfile%\Recent\ANTIGEN.drv
  
• %UserProfile%\Recent\dudl.sys
  
• %UserProfile%\Recent\grid.sys
  
• %UserProfile%\Recent\PE.dll
  
• %UserProfile%\Recent\SM.dll
  
• %Program Files%\WindowsProtectionSuite\WindowsProtectionSuite.exe
  
• %UserProfile%\Start Menu\Programs\WindowsProtectionSuite
  
• %UserProfile%\Start Menu\Programs\WindowsProtectionSuite\WindowsProtectionSuite Website.lnk
  
• %UserProfile%\Start Menu\Programs\Windows Protection Suite 2009.lnk
  
• %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Protection Suite 2009.lnk
  
• %Documents and Settings%\All Users\Application Data\345d567\WINSSSys
  
• %Documents and Settings%\All Users\Application Data\345d567\mozcrt19.dll
  
• %Documents and Settings%\All Users\Application Data\345d567\WINSS.ico
  
• %Documents and Settings%\All Users\Application Data\WINSSSys\winss.cfg
  
• %UserProfile%\Application Data\Windows Protection Suite
  
• %UserProfile%\Desktop\Windows Protection Suite.lnk
  
• %UserProfile%\Recent\DBOLE.drv
  
• %UserProfile%\Recent\grid.dll
  
• %UserProfile%\Recent\tempdoc.dll
  
• %UserProfile%\Recent\runddl.dll
  
• %UserProfile%\Recent\std.exe
  
• %Program Files%\Mozilla Firefox\searchplugins\search.xml
  
• %UserProfile%\Start Menu\Programs\WindowsProtectionSuite\WindowsProtectionSuite.lnk
  
• %UserProfile%\Start Menu\Windows Protection Suite 2009.lnk
  
• %UserProfile%\Application Data\Windows Protection Suite 2009\Instructions.ini
  
• %Documents and Settings%\All Users\Application Data\345d567
  
• %Documents and Settings%\All Users\Application Data\345d567\26.mof
  
• %Documents and Settings%\All Users\Application Data\345d567\WI345d.exe
  
• %Documents and Settings%\All Users\Application Data\345d567\WINSSSys\vd952342.bd
  
• %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Protection Suite.lnk
  
• %UserProfile%\Application Data\Windows Protection Suite\Instructions.ini
  
• %UserProfile%\Recent\CLSV.exe
  
• %UserProfile%\Recent\energy.dll
  
• %UserProfile%\Recent\kernel32.dll
  
• %UserProfile%\Recent\PE.tmp
  
• %UserProfile%\Recent\snl2w.exe
  
• %Program Files%\WindowsProtectionSuite\WindowsProtectionSuite.url
  
• %UserProfile%\Start Menu\WindowsProtectionSuite.lnk
  
• %UserProfile%\Desktop\WindowsProtectionSuite.exe
  
• %UserProfile%\Application Data\Windows Protection Suite 2009
  
• %UserProfile%\Desktop\Windows Protection Suite 2009.lnk
  
• %Documents and Settings%\All Users\Application Data\WINSSSys
  
• %Documents and Settings%\All Users\Application Data\345d567\sqlite3.dll
  
• %Documents and Settings%\All Users\Application Data\345d567\working.log
  
• %UserProfile%\Start Menu\Programs\Windows Protection Suite.lnk
  
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “WindowsProtectionSuite”
  
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “WindowsProtectionSuite”

---

Follow these instructions to continue:

1. Please download this removal tool: Malwarebytes' Anti-Malware.

http://tinyurl.com/mnj5t9

3. Follow the prompts. Make sure that Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware are checked. Then click finish.

4. Malwarebytes' Anti-Malware will automatically update itself after the install, you can press the OK button to close that box and you will now be at the main program as shown below.

If you are having problems with the updater, you can use this link to manually update Malwarebytes' Anti-Malware with the latest database

Spoiler:

• Malwarebytes' Anti-Malwares' latest database
  

Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that Malwarebytes' Anti-Malware is closed before installing the update.

	View Full Image

5. Close ALL open Windows, Programs, File or Folders.

6. Make sure you are on the Scanner tab. Select Perform quick scan then click the Scan button as shown above.

7. Malwarebytes' Anti-Malware will now start scanning your computer for infected files as shown below.

	View Full Image

8. When the scan is finished a message box will appear, click Ok to continue.

9. Click Show Results.

	View Full Image

10. You will now be presented with a screen showing you the malware infections like shown below. Yours may look different depending on the infection you have.

11. Click on Remove seletced

	View Full Image

12. When removing the files, Malwarebytes' Anti-Malware may require you to restart the computer in order to do a complete removal. If it displays a message stating that it needs to restart, please allow it to do so.

13. After that you can close the Malwarebytes' Anti-Malware window, your computer is now cleaned.

source: http://www.geekpolice.net/malware-removal-guides-f12/remove-windows-protection-suite-removal-guide-t12830.htm

Expert:	Dimmusacio - PC Specialist
Pos. Feedback:	97.6 %
Accepts:	3498
Answered:	8/29/2009

Computer Support Specialist

8 years experience in the IT field and in customer support.