Windows Easy Supervisor

How to remove Windows Easy Supervisor

Windows Easy Supervisor is a fake computer scanner that is spread through Trojans. If your computer is infected with this particular Trojan, eventually you will see a fake MSE alert message which states that your computer is infected with an unknown win32 Trojan. You should understand that this message from Microsoft Security Essentials is fake, Internet criminals are only using the name of legitimate antivirus program to try to scare you into thinking that there are security issues in your computer.

If you click "clean computer" in the MSE alert message you will notice a fake security check-up being performed, this will lead to a situation where you will be asked to download and install Windows Easy Supervisor in order to clean found computer infections. After you agree and reboot your computer you will see a main window of Windows Easy Supervisor. This program will imitate that process of scanning your computer's security, hdd etc. The scan won't take a long time to complete - this is because this program doesn't actually scan your PC, it only pretends to do so. By doing this Internet criminals are trying to scare you into thinking that your computer has multiple errors that needs to fixed immediately. If you click "fix errors" button in the main window of Windows Easy Supervisor, you will be asked to purchase a licence. Needless to say that you shouldn't buy this scanner, it's a scam. Ignore all the fake pop-up messages that this bogus scanner displays. You should remove this rogue program from your computer as soon as you notice it. If by mistake you have already bought this program, contact your credit card company and explain that you have been tricked into buying s fake licence for a rogue computer scanner. Always do some research prior to purchasing a security program for your computer, Internet is flooded with fake computer scanners, don't become a victim of cyber criminals.

Main window of Windows Easy Supervisor:

Screenshot of fake MSE infection message that is used by Windows Easy Supervisor:

"System Security Warning Attempt to modify register key entries is detected. Register entries analysis is recommended"

"Threat prevention solution found Security system analysis has revealed critical file system vulnerability caused by severe malware attacks. Risk of system files infection: The detected vulnerability may result in unauthorized access to private information and hard drive data with a serious possibility of irreversible data loss and unstable PC performance. To remove the malware please run a full system scan. Press 'OK' to install the software necessary to initiate system files check. To complete the installation process please reboot your computer"

"Warning! Location: c:\windows\system32\taskmgr.exe Viruses: Backdoor.Win32.Rbot"

Ignore these fake messages. Remove Windows Easy Supervisor from your computer.

Windows Easy Supervisor removal:

Before downloading Windows Easy Supervisor remover perform these steps On infected computer

remover for Windows Easy Supervisor

If you can't download or run spyware remover try running registry fix (link below). It enables execution of programs. download registryfix.reg file, double click it, click YES and then OK.

Windows Easy Supervisor removal instructions (on infected computer):

1. Start your computer,  wait until your Windows boots. Windows Easy Supervisor should appear on your screen. Click the OK button to start the Windows Easy Supervisor.

2. Let Windows Easy Supervisor run it's fake scan. After the fake scan, close the program by clicking on the X at the top right of the main window. After this procedure you should have access to your desktop.

3. Make your hidden files and folders visible:

How to unhide files in Windows 7:
Click "Start", Select "Control Panel", Click on "Appearance and Personalization", Click on "Folder Options", Go to the tab View, Select "Show hidden files, folders and drives", Click “Apply” and then “OK”

How to unhide files in Windows XP:
Double-click "My Computer" on your desktop, Click "Tools", Choose "Folder Options", Click "View", select "Show hidden files and folders", click "Apply" then OK.

4. In Windows Xp:
click Start->Run->Type %APPDATA% in the opened window search for Microsoft folder, in this folder search for a file with random letters (example: gasdf.exe) rename it to abc.exe and restart your computer.

In Windows 7:Click Start->In the search tab type %APPDATA% in the opened window search for Microsoft folder, in this folder search for a file with random letters (example: gasdf.exe) rename it to abc.exe and restart your computer.

In Windows Vista:Click Start->In the search tab type %APPDATA% in the opened window look for Microsoft folder, in this folder search for a file with random letters (example: gasdf.exe) rename it to abc.exe and restart your computer.

5. When computer restarts Windows Easy Supervisor should be disabled. Fix your Windows Registry Shell value so you could access desktop at the next system start-up. Download the file registyfix.reg then double-click it.

6.Now infection will be disabled but not removed. Download a legitimate anti-spyware software to fully remove Windows Easy Supervisor from your computer. Download remover for Windows Easy Supervision

Other tools known to remove Windows Easy Supervisor:

• iS3 STOPzilla
• Malwarebytes Anti-Malware

Additional information:

Some malicious software modifies browser settings and disables downloads of spyware and virus removing software. If you have problems downloading anti-spyware software with Internet Explorer, try downloading with Chrome, FireFox, Opera, etc.

If you can't access Internet:

Load your computer in safe mode. Click Start, click Shut down, click Restart, click OK. During your computer starting process press F8 key on your keyboard multiple times until you see Windows Advanced Option menu, then select Safe mode with networking from the list.

Start Task manager. Press ctrl+alt+del (or ctrl+shift+esc) and end task the processes of rogue program. ( if after this procedure you can't access any programs press ctrl+alt+del, click File, select New Task, and type explorer.exe then press OK.

Open Internet explorer, click Tools and select Internet Options. Select Connections, then click LAN settings, if a Use a proxy server for your LAN is checked, uncheck it and press OK.

After this procedure you should be able to access Internet. Now you can download anti-spyware software from our "Top spyware removers" section and run a full scan. Download, install and don't forget to update your selected anti-spyware program. Then run a full system scan.

If you are unable to remove Windows Easy Supervisor, you can use this manual removal instruction. Use it at your own risk. If you don't have strong computer knowledge you could harm your operating system. Use it only if you are an experienced computer user. (Instructions on how to end processes, remove registry entries...)

End these Windows Easy Supervisor processes:

[ramdom].exe

Remove these Windows Easy Supervisor entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe "Debugger" = 'svchost.exe'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = '0'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = '0'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore "DisableSR " = '1'

Delete these Windows Easy Supervisor files:

%UserProfile%\Application Data\Microsoft\[random].exe

General Tips on removing Windows Easy Supervisor:

*If you can't download anti-spyware software: Click on the download link, when the save dialog opens change the file name (example: when downloading mbam-setup.exe rename it to iexplore.exe).
*If you have installed anti-spyware program but you can't run it: Click Run, type %ProgramFiles% and press Enter. Open folder of your anti-spyware program, search for executable file and rename it. (example: Open Malwarebytes’ Anti-Malware folder, right-click on the main executable file (mbam.exe) then click rename. Rename the mbam.exe file to iexplore.exe, winlogon.exe firefox.exe ...
*If you can't access your anti-spyware software, try creating a new user account:
Click Start -> Settings -> Control panel.
Click User Accounts and create a new account.
Reboot your computer and login using a newly created user account.
*After this procedure you should be able to access your anti-spyware programs. Update and run a full system scan.