Windows Expert Console

You know you have a rogue to remove when it successfully blocks a variety of system functions. Windows Expert Console is a fake antivirus program that will basically hold your computer hostage, claiming that your system is infected with serious malware, and thus you need to purchase the full version of Windows Expert Console in order to clean your PC. Nevertheless, such claims are absolutely false, because the program that has popped up on your screen is fake, and if you were to follow its orders you would only lose your money. After all, money is the main objective of any rogue antispyware application out there.

One of the facts that should make you rather edgy is that Windows Expert Console is a new addition to an extensive family of computer infections. This family is called Rogue.VirusDoctor based on the first fake antivirus that has appeared years ago. In fact, this group of rogue infections has been rather quiet for almost a year, and now it has reemerged again with Windows Expert Console. Therefore, since we have identified this fake AV as part of Rogue.VirusDoctor group, it means that the program is directly related to such infections as Windows Antivirus Patch, Windows Maintenance Guard, Windows Active Defender and a variety of other applications.

Windows Expert Console may arrive at your computer via Trojan infection, or it could be bundled with freeware. Some users report that they have downloaded a .pdf extension file which in the end turned out to be Windows Expert Console installer. Once the rogue is installed on your computer it is configured to run automatically each time you turn on the PC. Once the rogue pops into action, it blocks your taskbar and Task Manager (virtually blocking you from terminating the program). Windows Expert Console also disables your Start menu and the Internet connection.

To terminate Windows Expert Console, you need to load your PC in Safe Mode with Networking. Then you should download a reliable antimalware tool which would scan your PC and detect all the malicious files present in your system. Then, do not hesitate to invest in a powerful computer security application that would delete Windows Expert Console and other potential threats from your computer once and for all.

How to access Safe Mode with Networking

Windows 8

1. Press Windows key for metro Start menu to open.
2. Move mouse cursor to the bottom right of the screen.
3. When Charm bar appears, click Settings and go to Change PC Settings.
4. Click General and go to Advanced Startup. Select Startup and click Troubleshoot.
5. Choose Advanced Options and click Startup Settings. Click Restart.
6. Press F5 to select Safe Mode with Networking.
7. Go to http://www.pcthreat.com/download-sph and install SpyHunter.
8. Perform a full system scan.

Windows Vista & Windows 7

1. Reboot the PC and tap F8 repeatedly until Advanced Boot Options menu opens.
2. Select Safe Mode with Networking and press Enter.
3. Access http://www.pcthreat.com/download-sph and download SpyHunter.
4. Install the program and run a full system scan.

Windows XP

1. Follow the steps 1 and 2 above.
2. When a confirmation box appears, click Yes.
3. Download SpyHunter.
4. Open Start menu and launch Run.
5. Enter “msconfig” into Open box and press OK.
6. Open Startup tab on System Configuration Utility.
7. Click Disable all and click OK.
8. Restart the PC in Normal mode.
9. Install SpyHunter and scan your PC.

We may expand the article once a more thorough research is carried out on the infection. If you have any further questions on how to remove Windows Expert Console from your computer, do leave us a comment below.

UPDATE

It may not be possible to access the Internet via Safe Mode with Networking, because Windows Expert Console successfully kills Windows Explorer. Therefore, you may use the following instructions to access the Internet and download yourself a reliable antimalware tool and then terminate Windows Expert Console once and for all.

How to delete Windows Expert Console

1. Reboot your computer and  press F8 several times when BIOS screen loads.
2. Choose Safe Mode with Command Prompt on Advanced Boot Options and press Enter.
3. Type cd.. into the Command Prompt next to C:\Windows\system32\ and press Enter.
4. When C:\Windows line appears, type \explorer.exe to complete it and press Enter.
5. Open Start menu and enter %appdata% into the search box. Press Enter. (For Windows XP: Open Start menu, click Run, type %appdata% into open box and press OK.
6. When the directory loads, delete the file "guard-{4 random symbols}.exe".
7. Reboot the PC in Normal Mode.
8. Open Start menu and type regedit into the search box. Hit Enter. (For Windows XP: Open Start menu, click Run, type regedit into open box and press OK.
9. Navigate to HKEY_CURRECT_USER\Software\Microsoft\Windows NT\Current Version\Winlogon.
10. Right-click "Shell" on the right pane, choose Modify.
11. Type in %WinDir%\Explorer.exe  to change Value Data and click OK.
12. Exit Registry Editor and go to http://www.pcthreat.com/download-sph and install SpyHunter.
13.  Scan your PC and remove Windows Cleaning Toolkit from the system.