Windows Warding Module
Written by Tomas Meskauskas
Damage level: High
Windows Warding Module removal instructions
Windows Warding Module is a fake antivirus program that reports nonexistent security infections to scare unsuspecting PC users into purchasing it's useless license key. This rogue program is created by Cyber criminals who are distributing it using fake online security scanners and exploit kits. Internet users should know that there is no such thing as an online security scanner that can indicate possible security infections on one's computer - such pop-up ads pretend to detect high risk security infections to trick Internet users into downloading Windows Warding Module. Exploit kits are security infections that infiltrate user's operating system using outdated software, after successful infiltration such malware has full control of user's operating system and thus can easily install fake antivirus programs, ransomware viruses, and Trojans.
This fake antivirus program originates from a family of rogue security scanners called FakeVimes. Computer users shouldn't trust this program as it reports non existent security infections to scare PC users into activating it's "ultimate protection," in reality this program doesn't have a virus definition database nor a legitimate virus scan engine - it pretends to detect identical security threats on every computer that it infiltrates. Windows Warding Module has some similarities to ransomware infections - it doesn't allow users to access their desktop unless they purchase it's fake license key, in comparison ransomware viruses block access to user's desktop unless they pay a fake fine for supposedly made law violations. PC users should know that this program is a total scam - paying for it's license would equal to sending one's money to Cyber criminals.
Windows Warding Module is just one of many fake antivirus program which originate from a family of rogues called FakeVimes, previous it's variants were named Windows Active Hotspot and Windows Cleaning Toolkit. To protect one's computer from such bogus antivirus programs, computer users should keep their installed programs up-to-date and use legitimate antivirus and anti-spyware programs. Computer users who have already payed for the license key of this rogue program should contact their credit card companies and dispute the charges explaining that they have been tricked into buying a fake antivirus program. If you already see Windows Warding Module scanning your computer for security infections you can be sure that your PC is infected with a rogue antivirus program, ignore it's fake security threat detections and use the provided removal guide to eliminate this scam from your operating system.
Windows Warding Module removal:
Before downloading the removal software for this rogue antivirus program complete these steps:
1. Wait until this rogue antivirus program finishes it's fake security scan and click "Settings" (at the top of the main window).
2. Select "Allow unprotected Startup"
3. After selecting "Allow unprotected Startup", close Windows Warding Module. Notification will appear "Unprotected startup is unsafe for your private data!". Click "OK".
4. Windows 7 users: Click on a Windows logo, in the "Search programs and files" field type "Command Prompt". In the opened list click the right mouse button over "Command Prompt" entry and select "Run as administrator".
Windows XP users: Click Start and navigate to Accessories menu - Start > All Programs > Accessories. Select Command Prompt.
5. In the opened windows (command prompt) type: taskkill /IM guard* and press Enter.
6. After killing the process of Windows Warding Module download legitimate anti-spyware software to completely remove this rogue antivirus program from your computer.
If you can't download or run spyware remover try running registry fix (link below). It enables execution of programs. download registryfix.reg file, double click it, click YES and then OK.
Windows Warding Module removal using Safe Mode with Networking:
Windows XP and Windows 7 users: During your computer starting process press F8 key on your keyboard multiple times until Windows Advanced Options menu shows up, then select Safe mode with networking from the list and press ENTER.
Video showing how to start Windows 7 in "Safe Mode with Networking":
Video showing how to start Windows XP in "Safe Mode with Networking":
Remove proxy settings from Internet Explorer. This rogue antivirus adds a proxy to user's Internet connection settings to show various errors when user tries accessing the Internet. To remove proxy settings: Open Internet Explorer and click on the gear icon. In the opened menu select "Internet Options."
In the opened window select "Connections" tab.
In the "Connections" tab, click on "LAN settings".
If "Use a proxy server for your LAN" is checked, uncheck it and click OK.
Download legitimate anti-spyware software to completely remove this fake antivirus program from your computer.
After removing this rogue software, you should reset one's Hosts file. Don't skip this step, Windows Warding Module modifies your Hosts files, and you will encounter browser redirect problems if malicious entries will not be eliminated.
Hosts file is used to resolve some canonical names of websites to IP addresses. When it's modified users may be redirected to malicious websites while still seeing a good URL in the address bar. To fix this, please download Microsoft Fix It tool, it restores one's hosts file to Windows default. Run this tool when downloaded and follow the on-screen instructions. Download link below:
After completing all these steps your computer should be clean.
Other tools known to remove Windows Warding Module: