Severity scale:  

Windows Malware Firewall. How to remove? (Uninstall guide)

by ,
Also known as Windows Malware Firewall | Type: Rogue Antispyware
SpyHunter is a tool to detect malware. You need to purchase full version to remove infections.
More information about SpyHunter and steps to uninstall.

Windows Malware Firewall is a rogue anti-spyware application that displays exaggerated or completely false scan results and fake security pop-ups to make you think your computer is infected with malware, spyware and ads sponsored software. Once installed, the rogue security application will display a list of fake malware infections and supposed security threat and then will state that you must purchase this program to remove found malware and protect your computer from the newest viruses. Don't pay for the rogue anti-spyware program, it's a scam. You should remove Windows Malware Firewall from your computer upon detection.

Windows Malware Firewall is promoted through the use of Trojan downloaders, fake online virus scanners and hacked websites that load malicious code once you visit them. It's otherwise known as drive-by download. Usually, Trojan viruses display fake security alerts stating that your computer has many security issues or is under attack from a remote server. Fake online anti-malware scanners display similar notifications too but they also hijacks web browsers. While active, Trojans may hijack your Desktop and display the following text:

System Security Warning
Attempt to modify register key entries is detected. Register entries analysis is recommended.
Location: c:\windows\system32\taskmgr.exe
Viruses: Backdoor.Win32.Rbot

While running, Windows Malware Firewall will "scan" your computer for viruses and list a variety of security threats that won't be removed unless you first purchase the rogue security program. The scan results are false, so you can ignore that safely. The same applies to fake security warnings that will come from Windows task bar or Windows Security Center. These are also completely fake. The main problem with those fake security warnings is that they look like legitimate ones and it is very difficult to get rid of them. Fake security alerts will show up like every every two or five minutes. What is more, Windows Malware Firewall will also slow down your computer and block antivirus software. Likely, it will hijack your web browser too.

Windows Malware Firewall is a scam designed to steal money from inexperienced computer users. Do not purchase this program. If you have already paid for it, contact your credit card company and dispute the charges. Then, remove Windows Malware Firewall from your computer using legitimate malware removal software listed below.

The latest parasite names used by FakeVimes:
Windows Internet Guard, Windows Web Watchdog, Windows AntiBreach Patrol, Windows Antivirus Patrol, Windows Pro Defence Kit

Windows Malware Firewall video guide

It might be that we are affiliated with any of our recommended products. Full disclosure can be found in our Agreement of Use.
By downloading any of provided Anti-spyware software you agree with our Privacy Policy and Agreement of Use.
remover for Windows Malware Firewall
Compatible with OS X
Webroot SecureAnywhere AntiVirus is recommended remover to uninstall Windows Malware Firewall. You should confirm using free trial that it detects current version of parasite.
Not using OS X? Download a remover for Windows.
Do it now!
remover for Windows Malware Firewall Happiness
Compatible with Microsoft Microsoft Windows logo
SpyHunter is recommended to uninstall Windows Malware Firewall. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of SpyHunter malware removal tool. More information about this program can be found in SpyHunter review. If you decided to select another anti-spyware, uninstall SpyHunter from your computer.
more than 40.000.000 downloads!
What to do if failed? If you failed to remove infection using Webroot SecureAnywhere AntiVirus SpyHunter, read here how to submit a support ticket or submit a question to our support team and provide as much details as possible.
Alternate Software
We are testing STOPzilla's efficiency (2012-06-01 05:12)
Malwarebytes Anti Malware
We are testing Malwarebytes Anti Malware's efficiency (2012-06-01 05:12)
XoftSpySE Anti Spyware
We are testing XoftSpySE Anti Spyware's efficiency (2012-06-01 05:12)
Defender Pro Ultimate
Windows Malware Firewall screenshot
Windows Malware Firewall snapshot

Windows Malware Firewall manual removal

Kill processes:
Delete registry values:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsafwserv.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsavastsvc.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsavastui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsegui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsekrn.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsascui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsmpeng.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsseces.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSystemRestore "DisableSR " = '1'
Delete files:

Geolocation of Windows Malware Firewall

Map reveals the prevalence of Windows Malware Firewall. Countries and regions that have been affected the most are: United States.

Information updated:

Post a comment

Attention: Use this form only if you have additional information about a parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Home page Name


(All fields are required)
Like us on Facebook