MS Removal Tool is a fake antivirus that impersonates name of legitimate anti-malware tool. The real program is distributed by Microsoft and included in modern Windows OS by default. This is not the first version of malware that uses this name: couple month ago there was another, non related, rogue using Microsoft Malicious software removal tool name. This rogue is far by new, its predecessor System Tool still wrecks havoc on PCs worldwide.
MS Removal Tool infects user PCs through various exploits and trojans. You might get infected when visiting websites displaying infected advertisements or when you download some kind of “free” download from the torrents or web. It is critical to scan all executables downloaded with legitimate antivirus software, or in worst case upload to websites as virustotal.com for double-checking. In other cases your PC will get MS Removal Tool rogue or similar parasite in no time.
After the PC is fully infected, MS Removal Tool will start its advertising campaign to convince you into giving away your credit card details. This malware will replace background with huge warning about infections, and will stop your PC from executing all programs. The malware will display lots of warnings about infections and demand that you launch MS Removal Tool scan and then purchase its full version. This is a trick: There is no full version of this program, and all the files it detect are harmless. However, it is impossible to use PC till MS Removal Tool is removed from PC.
In some cases MS Removal Tool displays various warnings and alerts like these:
MS Removal Tool Warning
Your PC is infected with dangerous viruses. Activate antivirus protection to prevent data loss and avoid the theft of your credit card details.
Click here to activate protection.
MS Removal Tool Warning
Intercepting programs that may compromise your private and harm your system have been detected on your PC.
Click here to remove them immediately with MS Removal Tool.
Security Monitor: WARNING!
Attention: System detected a potential hazard (TrojanSPM/LX) on your computer that may infect executable files. Your private information and PC safety is at risk. To get rid of unwanted spyware and keep your computer safe you need to update your current security software.
CLick Yes to download official intrusion detection system (IDS software).
Warning: Your computer is infected
Windows has detected spyware infection!
Click this message to install the last update of Windows security software…
It also changes the background of Windows desktop and then reports:
Your’re in Danger!
Your Computer is infected with Spyware!
All you do with your computer is stored forever in your hard disk. When you visit sites, send emails… All your actions are logged. And it is impossible to remove them with standard tools. Your data is still available for forensics, and in some cases
For your boss, your friends, your wife, your children. Every site you or somebody or even something, like spyware, opened in your browsers, with all the images, and all the downloaded and maybe later removed movies or mp3 songs – ARE STILL THERE and could break your life!
Secure yourself right now!
Removal all spyware from your PC!
Note: Some users make a mistake and pay for MS Removal Tool or similar rogue. In such case you should contact your bank and dispute the charges. Additionally, it is highly advisable to change your credit card numbers, as you might be charged several times later on.
To remove MS Removal Tool, I recommend following procedure:
1. Reboot into safe mode with networking
2. Disable proxy server in your browser.
3. Start task manager and stop processes that look like garbage: random letter and number combo.
4. Download and scan your PC with spyhunter, Malwarebytes Anti-Malware to identify the infected files. Do full system scan or search for stopped processes on the disk.
5. Delete these files.
6. Restore the windows shell to explorer.exe if you haven’t used automatical removal procedure.
In addition, you can try these keys of System Tool infection That still might work with MS Removal Tool as parasites are closely related:
Full version of Eset Smart Security and most other decent antiviruses, or Spyhunter, Malwarebytes Anti-Malware would have protected from these infections.
Thanks to S!Ri, there have been revealed new registration codes of MS Removal Tool, so try enetering one of them if you have problems with its removal:
Automatic MS Removal Tool removal tools
Important Note: Although it is possible to manually remove MS Removal Tool , such activity can permanently damage your system if any mistakes are made in the process, as advanced spyware parasites are able to automatically repair themselves if not completely removed. Thus, manual spyware removal is recommended for experienced users only, such as IT specialists or highly qualified system administrators. For other users, we recommend using Reimage or other tools found on 2-viruses.com.