Windows Advanced Toolkit

Updated: June 22, 2012 Rogue 0 Comment

When Windows Advanced Toolkit encourages you to purchase a registered version, simply ignore the message. This is because; this program is a virus in disguise of a useful tool. No legitimate antivirus software will utilize a Trojan to promote itself. That is how Windows Advanced Toolkit keeps on spreading online. It deliberately enters the computer when a Trojan spotted a fault on your software and then exploited for this purpose. Next, it directly hit the registry and tweak some settings on it to let the malware run each time you open Windows.

Notice that this rogue program will corrupt whatever security software you have. It is disabled on purpose. Malware authors want their program to reign over your system and ensue with its goal. Windows Advanced Toolkit will produce a barrage of warnings and alerts. It will also carry out a virus scan that shows nothing but false information. The rogue program also makes sure that you cannot open any software. If you try, Windows Advanced Toolkit will declare that the file is infected. On every attempt, it will present corresponding system tray alert. The distraction does not end there. This is just a start of more prevalent damages it can cause.

It is critical that you remove Windows Advanced Toolkit virus at once. If not, it may connect to a remote server and download more malware that can cause more troubles in your end.

Screenshot Image:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Windows Advanced Toolkit Removal Procedures

Manual Removal:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “Windows Advanced Toolkit”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
Protector-[random 3 characters].exe or Protector-[random 4 characters].exe

2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the computer and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to Windows Advanced Toolkit Virus.
4. Registry entries created by Windows Advanced Toolkit must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of Windows Advanced Toolkit start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
Protector-[random 3 characters].exe or Protector-[random 4 characters].exe

7. Click Apply and restart Windows.

Windows Advanced Toolkit Removal Tool:
In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.

Using Portable SuperAntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be remove as well. Click here to download and run SAS Portable Scanner.

Technical Details and Additional Information:

If Windows Advanced Toolkit is installed, it will begin to display fake alerts as an scare tactics to mislead victims:

Warning
Firewall has blocked a program from accessing the Internet.
Windows Media Player Resources
C:\Windows\system32\dllcache\wmploc.dll
C:\Windows\system32\dllcache\wmploc.dll is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server.

Error
Software without a digital signature detected.
Your system files are at risk. We strongly advise you to activate your protection.

Malicious Files Added by Windows Advanced Toolkit:
%AppData%\NPSWF32.dll
%AppData%\Protector-[random 3 characters].exe
%AppData%\Protector-[random 4 characters].exe
%AppData%\result.db
%AppData%\jmsuteyhcn.cnf

Windows Advanced Toolkit Registry Entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegedit” = 0
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegistryTools” = 0
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “EnableLUA” = 0
HKCU\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”
HKCU\Software\Microsoft\Windows\CurrentVersion\Settings “net” = “2012-6-12_6″
HKCU\Software\Microsoft\Windows\CurrentVersion\Settings “UID” = “nmsjwyuets”
HKCU\Software\ASProtect
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smss32.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winssk32.exe