Windows Salvor Tool

7 July 2011 Rogue 0 Comment

Windows Salvor Tool is a fake anti-virus application that will be distributed by a fake Microsoft Security Essentials alert. Similar to its recent version called Windows Easy Supervisor and Windows System Integrity, this new rogue can incorporate itself on target computer invisibly. Presence of these programs can bring potential damage on the system, particularly on the operation of Windows. Functions like task manager, registry editor and folder options are disabled. Not only that, Windows Salvor Tool virus also forced web browser to visit unsolicited web sites and malicious pages where another type of threat is set to infect victims computer.

Program Windows Salvor Tool was developed primarily to deceive users with a bunch of fake security alerts. Launching a virus scan on Windows start-up also gives additional push to promote this program. The virus-scan will provide fabricated results that will prompt user to remove detected threats but a paid version of Windows Salvor Tool must be purchase first. Without a license, this unwanted application will continue to distract and manipulate the operation of PC. To be able to remove Windows Salvor Tool without its registered copy, follow the procedure on this page and use the free tool provided. This will completely eliminate the rogue program and all the components it has installed on the computer.

Screen Shot Image:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Windows Salvor Tool Removal Procedures

Manual Removal:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “Windows Salvor Tool”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
(random characters).exe

2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the system and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to Windows Salvor Tool Virus.
4. Registry entries created by Windows Salvor Tool must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of Windows Salvor Tool start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
(random characters).exe

7. Click Apply and restart Windows.

Windows Salvor Tool Removal Tool:
In order to completely remove the threat from a computer, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected computer.

Using Portable SuperAntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be get rid as well. Click here to download and run SAS Portable Scanner.

Technical Details and Additional Information:

If Windows Salvor Tool is installed, it will begin to display fake alerts as an scare tactics to mislead victims:

Threat prevention solution found
Security system analysis has revealed critical file system vulnerability caused by severe malware attacks.
Risk of system files infection:
The detected vulnerability may result in unauthorized access to private information and hard drive data with a serious possibility of irreversible data loss and unstable PC performance. To remove the malware please run a full system scan. Press ‘OK’ to install the software necessary to initiate system files check. To complete the installation process please reboot your computer.

Malicious Files Added by Windows Salvor Tool:
%UserProfile%\Application Data\Microsoft\[random].exe

Windows Salvor Tool Registry Entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe “Debugger” = ‘svchost.exe’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = ’0′
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = ’0′
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore “DisableSR ” = ’1′