Severity scale:  

Windows Antivirus Rampart. How to remove? (Uninstall guide)

removal by Jake Doevan - -   Also known as Windows Antivirus Rampart | Type: Viruses

Windows Antivirus Rampart is a fake antivirus program, a part of FakeVimes family of rogue programs. Just like its previous versions, Windows Ultimate Security Patch, Windows Guard Tools and others, it displays fake security notifications, disturbs proper functioning of your legitimate programs, uses fake scanners and does more things that damages your system. It enters computer systems imitating some updates, like Adobe Acrobat, Java or others. It is basically impossible to know when this badware is gets access to your machine and to stop it at the stage of infiltration.

Once there, Windows Antivirus Rampart is configured to start automatically with each system reboot. The program pretends to look for infections on your system by running its fake scanner. In fact this badware cannot detect anything so by the end of this scan imitation, the program generates a fake list of infections and tells to remove those files by getting a licensed version of Windows Antivirus Rampart. That is the way the comes comes for cyber criminals. Unfortunately, paying for this type of programs does no good to us, ordinary computer users. You will simply lose your money and stay with the same problems on your system that you had. This rogue will continue running fake scans and disturb you all possible ways.

One of the most annoying things that rogue programs do is displaying tons of different security notifications providing completely false informations. Some of the read:

Keylogger activity detected. System information security is at risk.
It is recommended to activate protection and run a full system scan.

Software without a digital signature detected.
Your system files are at risk. We strongly advise you to activate your protection.

As you see they warn that your system is at risk because of some security related issues. In fact these alerts are completely fake and they are only used to make you believe that your system is infected and pay for Windows Antivirus Rampart. Do not trust this badware under any circumstances. Use a reputable antispyware program to remove Windows Antivirus Rampart as soon as you detect it on your machine. Do not hesitate to do that straight after detecting this badware on your machine. As this malware disables your antivirus, make sure that your antivirus starts normally when you finalize cleaning your PC. The most effective way to do so is using anti-malware programs like Reimage.

The latest parasite names used by FakeVimes:

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove Windows Antivirus Rampart you agree to our privacy policy and agreement of use.
do it now!
Reimage (remover) Happiness
Reimage (remover) Happiness
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall Windows Antivirus Rampart. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manual removal instructions below.

More information about this program can be found in Reimage review.

More information about this program can be found in Reimage review.
Windows Antivirus Rampart snapshot
Windows Antivirus Rampart

Windows Antivirus Rampart manual removal:

Kill processes:

Delete registry values:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsafwserv.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsavastsvc.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsavastui.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsegui.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsekrn.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsascui.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsmpeng.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsseces.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSystemRestore "DisableSR " = '1'

Delete files:

About the author

Jake Doevan
Jake Doevan - Computer technology expert

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Jake Doevan
About the company Esolutions