Remove Windows Warding Module

Windows Warding Module is a fake antivirus program which intend to urge the user whose computer is infected by Windows Warding Module to purchase the full version of Windows Warding Module. Windows Warding Module produces fake alert in order to cheat the user. Windows Warding Module installs into the computer without the confirmation of the user and configure itself to start automatically when windows boot. Windows Warding Module will then scan the computer and state that there are many malware in the computer and ask the user to purchase full version of Windows Warding Module to remove all the malwares.

Windows Warding Module provide fake features such as Firewall, Automatic Update, Antivirus Protection, Anti-Phising, Advanced Process Control, Autorun Manager, Service Manager, All-in-one Suite, Quick Scan, Deep Scan, Custom Scan etc. All of them cannot protect the computer from any kind of malware.

Windows Warding Module is a scareware program from the Rogue.FakeVimes family of computer infections. This program is considered a rogue anti-spyware program because it does not allow you to access your Windows desktop, automatically terminates legitimate applications, and displays false scan results and security alerts that are designed to scare you into purchasing the program. This program will also be configured to start automatically before your Windows desktop is shown, which makes your computer unusable until the infection is removed. Windows Warding Module is distributed through web sites that display a fake online virus scanner that states your computer is infected and then prompts you to download the installation file. This infection is also promoted by hacked web sites that contain exploit code that tries to install the infection on your computer without your permission or knowledge.


Windows Warding Module can be removed by stopping its processes

Windows Warding Module should be removed immediately!

Windows Warding Module Removal Guide
Kill Process
(How to kill a process effectively?)
guard-fvtb.exe

Delete Registry
HHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "GuardSoftware" = "%AppData%\guard-toiy.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell"="C:\\Users\\User\\AppData\\Roaming\\guard-fvtb.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes"=".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation"=1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe "Debugger"="svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger"="svchost.exe"

Remove Folders ad Files
%AppData%\guard-fvtb.exe
%AppData%\result1.db

File Location Notes:
%AppData% refers to the current users Application Data folder. By default, this is C:\Documents and Settings\[Current User]\Application Data for Windows 2000/XP. For Windows Vista and Windows 7 it is C:\Users\[Current User]\AppData\Roaming.