Windows Care Tool

10 February 2011 Rogue 0 Comment

Windows Care Tool is considered as rogue security application because it is being promoted as an anti-virus program though it was very clear that it has no capability to protect a computer neither remove any potential threats. Developers created Windows Care Tool as a virus that will spread via the Internet and attempts to infect as many online users and deceive them with fake security reports. Commonly, Windows Care Tool works side-by-side with a rootkit Trojan to be able to avoid detection from installed legitimate AV program. Once this malicious application has penetrated the system, it will make itself run automatically by configuring registry and provide its start-up entry. When loaded, this rogue product will simulate a virus scan and displays fabricated results that aims to mislead computer users into purchasing the Windows Care Tool registration key.

Beware of this unwanted program, its contraction will be camouflage by a mimic of MSE. Although this is just a fake Microsoft Security Essentials Alert, it may be hard to distinguished because it will pop-up and contains a very considerable message like:

Microsoft Security Essentials Alert
Potential Threat Details
Microsoft Security Essentials detected potential threats that might compromise your private or damage your computer. Your access to these items may be suspended until you take an action. Click ‘show details’ to learn more.

Windows Care Tool also provides numerous alert messages that provides false information regarding viruses found on the system. It was already stated on that this is just a rogue program and all of its security messages are part of the scam activities so never suppose that computer is in danger. The best thing to do is download and scan with a legitimate anti-virus and anti-malware program to double check the security status of the computer. Most of all, remove Windows Care Tool virus that have caused the computer to display annoyances.

Screen Shot Image:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Windows Care Tool Removal Procedures

Manual Removal:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “Windows Care Tool”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
(random characters).exe

2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the computer and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to Windows Care Tool Virus.
4. Registry entries created by Windows Care Tool must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of Windows Care Tool start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
(random characters).exe

7. Click Apply and restart Windows.

Windows Care Tool Removal Tool:
In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.

Using Portable SuperAntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be remove as well. Click here to download and run SAS Portable Scanner.

Technical Details and Additional Information:

If unregistered version of Windows Care Tool is installed, it will continuously prompt user to register the program by means excessive pop-up alerts:

System Security Warning
Attempt to modify register key entries is detected. Register entries analysis is recommended.

Malicious Files Added by Windows Care Tool:
%UserProfile%\Application Data\[random].exe

Windows Care Tool Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon “Shell” = ‘%UserProfile%\Application Data\.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe “Debugger” = ‘svchost.exe’