Windows Express Settings Removal Guide

Windows Express Settings is a fake antivirus program that perform like a real antivirus such as Kaspersky Anti-Virus, AVG Free Antivirus, Avira AntiVir etc. Windows Express Settings infects the computer when the user accidentally downloads a trojan from a website which provide online videos. Windows Express Settings will start automatically when Windows boot. Then, Windows Express Settings will scan the computer and produce fake scan results and display many fake alerts to urge the user to purchase the full version of Windows Express Settings in order to remove the detected malwares.

Windows Express Settings can be removed by stopping the processes and removing the files by using Emsisoft HiJackFree. Then the user should remove the registry entries added or modified by Windows Express Settings shown in the removal guide below. All files related to Windows Express Settings must be deleted.

Windows Express Settings should be removed immediately!

Windows Express Settings Removal Guide
Kill Process
(How to kill a process effectively?)
[random].exe

Delete Registry
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" = '[RANDOM].exe'

Remove Folders and Files
%AppData%\[RANDOM].exe