Antimalware Tool

3 April 2011 Rogue 0 Comment

Antimalware Tool is another must-removed application that will disguise as a security program for Windows system. It was analyzed that Antimalware Tool virus usually spreads by means of an associated Trojan that can be acquired when visiting malicious web sites. File-sharing networks that hosts these rogue programs are another way to transmit the infection to its victims. Spam email messages that has an attached file that when executed will also install a copy of Antimalware Tool is also a different source of contamination. No matter how Antimalware Tool enters into the system, its purpose was simply to provide misleading warning messages and alert the user about computer infection, which actually does not occur. This way, the developer can easily convince that a paid version of Antimalware Tool is needed to solve computer security issues.

It has been told several times that a licensed version of a rogue program was never created to protect but rather to scam users and steal money from their credit card account. In fact, this registered version was not designed to protect a computer neither remove any types of viruses. So paying for the Antimalware Tool registration key is useless and will mean another profit for the rogue developer. Remove Antimalware Tool virus with simple and free tools provided on this page. Make sure to update the removal tool after installation to have the latest and most reliable database to detected Antimalware Tool and other infected files hidden on the system.

Screen Shot Image:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Antimalware Tool Removal Procedures

Manual Removal:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “Antimalware Tool”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
(random characters).exe

2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the computer and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to Antimalware Tool Virus.
4. Registry entries created by Antimalware Tool must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of Antimalware Tool start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
(random characters).exe

7. Click Apply and restart Windows.

Antimalware Tool Removal Tool:
In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.

Using Portable SuperAntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be remove as well. Click here to download and run SAS Portable Scanner.

Technical Details and Additional Information:

Malicious Files Added by Antimalware Tool:
%UserProfile%\Application Data\[random].exe

Antimalware Tool Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon “Shell” = ‘%UserProfile%\Application Data\[random].exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe “Debugger” = ‘svchost.exe’