Windows Work Catalyst (WindowsWorkCatalyst) Virus Removal Guide

Virus Type: Rogue Security Application
Threat Level: 8 / 10

Windows Work Catalyst is a fake security application which was released around May 13, 2023. Security applications are designed by companies to provide computer security through computer tools such as antivirus, antispyware, firewall (which will provide internet protection), and privacy protection. A fake security program, such as Windows Work Catalyst, will scan the computer in just seconds, which is not typical for this type of program. A new version of this virus is released generally every day, with the last version being Windows Attention Utility. Other versions include Windows Inspection Utility and Windows Stability Center. The main difference in the clone versions is generally a change in the name and sometimes a change in look. Windows Work Catalyst claims to offer a variety of tools including computer safety, network security, private data protection, hard drive optimization, media components, and memory & devices.

Windows Work Catalyst is generally downloaded and installed without user permission through the use of a trojan horse. The trojan horse is generally downloaded while browsing the internet through some type of security flaw. Once installed, it will set itself to start up with Windows. The best method to avoid infection is to update software regularly. Windows Work Catalyst is similar in functionality to ThinkPoint and CleanThis. Windows Work Catalyst main executable is generally a series of random letters.

Below is our recommended removal tool for Windows Work Catalyst. The removal tool has been rated 5 cows out of 5 by Tucows and was previously CNET’s Editor’s Choice. Feel free to download it below.

If you are unable to run the removal tool, or are unable to run any programs in general, you may need to stop the processes associated with Windows Work Catalyst with task manager. If task manager has been blocked by Windows Work Catalyst, try using Process Explorer.

Windows Work Catalyst, like many other fake antivirus programs, will create a series of warnings and pop ups in order to scare the user into purchasing the fake program. Some of these warnings which are created by Windows Work Catalyst can be found below.

“Warning!

Location: C:\Program Files\java\jre6\bin\jqs.exe
Viruses: Virus.Win32.Sality

Deny – Forbid the execution of potentially harmful software.

Enable Protection – Click to activate antivirus and remove all infections.”

“Microsoft Security Essentials detected potential threats that might compromise your privacy or damage your computer. Your access to these items may be suspended until you take an action. Click ‘Show details’ to learn more.”

It is recommended to use safe mode when removing the virus because Windows Work Catalyst will generally not be able to load in safe mode. To enter safe mode, restart the computer and press F8 multiple times before the Windows screen to bring up the boot options.

Boot Menu

The safe mode with networking option will allow the user to be able to use the internet in safe mode. Windows Work Catalyst can be removed by using the

or by manually removing the virus.

View Windows Work Catalyst Files
View Windows Work Catalyst Keys

The user comments for ThinkPoint and the user comments for CleanThis may provide insight into removing Windows Work Catalyst since the viruses are similar.

Manual Windows Work Catalyst Removal – In order to manually remove Windows Work Catalyst, the processes associated with Windows Work Catalyst must be stopped, the files associated with the processes must be removed, and the registry entries must be corrected to the previous state before Windows Work Catalyst entered the computer.

Important: Before attempting to manually remove Windows Work Catalyst, we recommend that the user read through comments posted by other users on how they removed specific fake antivirus programs since many fake antivirus programs are similar. These comments can be found by clicking here. These comments may provide additional information which may be useful in removing Windows Work Catalyst. However, please use discretion since these specific comments pertain to other fake antivirus programs.

Stop Windows Work Catalyst Processes (Learn How To Do This)
[random letters].exe

Remove Windows Work Catalyst Files (Learn How To Do This)

Windows XP – C:\Documents and Settings\[username]\Local Settings\Application Data\Microsoft\[random letters].exe

Windows Vista & Windows 7 – C:\Users\[username]\AppData\Roaming\Microsoft\[random letters].exe

For example, the executable was named gbgvas.exe when we tested Windows Work Catalyst. Gbgvas.exe is most likely a random six letter executable file.

Remove Windows Work Catalyst Registry Keys (Learn How To Do This)
HKEY_CURRENT_USER\Software\Windows Work Catalyst
HKEY_LOCAL_MACHINE\SOFTWARE\Windows Work Catalyst
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Windows Work Catalyst

Remove Windows Work Catalyst Startup Entry (Learn How To Do This)
[random letters].exe

Common Questions -
1. What is a computer virus? (Click Here To View)
2. How did I get this computer virus? (Click Here To View)
3. What common symptoms show that my computer may be infected? (Click Here To View)
4. What is a rogue security application? (Click Here To View)
5. What are some antivirus and antispyware programs which I can use to remove viruses and spyware? (Click Here To View)

If you have any questions or comments, please don’t hesitate to comment below. If you need any help with any of the steps, please don’t hesitate to comment below. We recommend that you follow our safety tips so that you can keep your computer clean Please Click Here to View Our Safety Tips.

Your feedback is very highly valued by others so please feel free to comment below. Please feel free to share a solution that you may have used to remove Windows Work Catalyst.

This entry was posted on Friday, May 13th, 2023 at 2:53 pm and is filed under Malware Removal. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.

Leave a Reply