Severity scale  
  (72/100)

Windows Guard Tools. How to Remove? (Uninstall Guide)

removal by - -   Also known as WindowsGuardTools | Type: Rogue Antispyware
12

Windows Guard Tools is a rogue anti-spyware program from the Fake.Vimes malware family. This rogue anti-spyware program is promoted mostly via Trojans and exploit packs but it can also come via spam messages and misleading notifications on popular social networks. Once installed, Windows Guard Tools displays a list of non-existed infections that were supposedly found during full system scan. It also displays fake security alerts or pop-ups from Windows task bar and hijacks Internet Explorer as well as other web browsers to scare you into thinking that your computer is infected with malware, for example password stealing trojans, rootkits and dangerous viruses. The rogue anti-spyware program then asks to pay for a full version of the program to remove found malware infections, which of course do not actually exist on your computer. As you can see, it's nothing more but a scam, bogus security product. Do not pay for this malware no matter what. We strongly recommend you to remove Windows Guard Tools from your computer as soon as possible using legitimate malware removal software listed below.

The fake system alerts which Windows Guard Tools shows on the victims PC looks like these:

Error
Attempt to modify Registry key entries detected.
Registry entry analysis recommended.

Warning! Spambot detected!
Attention! A spambot sending viruses from your e-mail has been detected on your PC.

Error
Keylogger ativity detected. System information security is at risk.
It is recommended to activate protection and run a full system scan.

Most of the time, Windows Guard Tools must be manually installed, unless it comes via drive-by downloads on infected websites. Don't forget that the scammers use various misleading tactics and social engineering to trick you into installing this malware, so you may think that it's genuine Microsoft software but actually it isn't. Another very popular method is when fake online video websites prompts a user to install flash player update to view requested video. But what he really gets is Trojan virus which later downloads rogue files and displays fake security alerts.

When running, Windows Guard Tools displays many fake security alerts and pop-ups stating that your computer is infected by malicious software. These fake alerts are very annoying and might be difficult to close. I also states that your personal information can be stolen and your files can be deleted if you won't remove supposedly found malware. If you find that your computer is infected with this rogue anti-spyware program, please use the removal guide below to remove Windows Guard Tools from your PC. Most importantly, do not purchase. If you have already paid for it, then contact your credit card company and dispute the charges. Then scan your computer with a reputable and genuine anti-spyware application like Spyware Doctor to make sure that the rogue program is fully removed form your computer.

The latest parasite names used by FakeVimes:
Windows Internet Guard, Windows Web Watchdog, Windows AntiBreach Patrol, Windows Antivirus Patrol, Windows Pro Defence Kit

It might be that we are affiliated with any of our recommended products. Full disclosure can be found in our Agreement of Use. By downloading any of provided Anti-spyware software you agree with our Privacy Policy and Agreement of Use.
Do it now!
Download
Reimage - remover Happiness
Guarantee
Compatible with Microsoft Windows
What to do if failed?
If you failed to remove infection using Reimage Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall Windows Guard Tools. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

More information about this program can be found in Reimage review.
Reimage is recommended to uninstall Windows Guard Tools. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

More information about this program can be found in Reimage review.
Not using OS X? Download a remover for Windows.
Press Mentions on Reimage
Alternate Software
Alternate Software
Plumbytes
We are testing Plumbytes's efficiency (2012-05-27 05:45)
Malwarebytes Anti Malware
We are testing Malwarebytes Anti Malware's efficiency (2012-05-27 05:45)
Hitman Pro
Webroot SecureAnywhere AntiVirus
Windows Guard Tools screenshot
Windows Guard Tools snapshot

Windows Guard Tools manual removal

Kill processes:
Protector-[random].exe
Delete registry values:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsafwserv.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsavastsvc.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsavastui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsegui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsekrn.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsascui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsmpeng.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsseces.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSystemRestore "DisableSR " = '1'
Delete files:
Protector-[random].exe

Removal guides in other languages


Information updated:

Comments on Windows Guard Tools

Post a comment

Attention: Use this form only if you have additional information about a parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Home page Name



«

(All fields are required)