Severity scale:  

Windows Guard Tools. How to remove? (Uninstall guide)

removal by Julie Splinters - -   Also known as WindowsGuardTools | Type: Rogue Antispyware

Windows Guard Tools is a rogue anti-spyware program from the Fake.Vimes malware family. This rogue anti-spyware program is promoted mostly via Trojans and exploit packs but it can also come via spam messages and misleading notifications on popular social networks. Once installed, Windows Guard Tools displays a list of non-existed infections that were supposedly found during full system scan. It also displays fake security alerts or pop-ups from Windows task bar and hijacks Internet Explorer as well as other web browsers to scare you into thinking that your computer is infected with malware, for example password stealing trojans, rootkits and dangerous viruses. The rogue anti-spyware program then asks to pay for a full version of the program to remove found malware infections, which of course do not actually exist on your computer. As you can see, it's nothing more but a scam, bogus security product. Do not pay for this malware no matter what. We strongly recommend you to remove Windows Guard Tools from your computer as soon as possible using legitimate malware removal software listed below.

The fake system alerts which Windows Guard Tools shows on the victims PC looks like these:

Attempt to modify Registry key entries detected.
Registry entry analysis recommended.

Warning! Spambot detected!
Attention! A spambot sending viruses from your e-mail has been detected on your PC.

Keylogger ativity detected. System information security is at risk.
It is recommended to activate protection and run a full system scan.

Most of the time, Windows Guard Tools must be manually installed, unless it comes via drive-by downloads on infected websites. Don't forget that the scammers use various misleading tactics and social engineering to trick you into installing this malware, so you may think that it's genuine Microsoft software but actually it isn't. Another very popular method is when fake online video websites prompts a user to install flash player update to view requested video. But what he really gets is Trojan virus which later downloads rogue files and displays fake security alerts.

When running, Windows Guard Tools displays many fake security alerts and pop-ups stating that your computer is infected by malicious software. These fake alerts are very annoying and might be difficult to close. I also states that your personal information can be stolen and your files can be deleted if you won't remove supposedly found malware. If you find that your computer is infected with this rogue anti-spyware program, please use the removal guide below to remove Windows Guard Tools from your PC. Most importantly, do not purchase. If you have already paid for it, then contact your credit card company and dispute the charges. Then scan your computer with a reputable and genuine anti-spyware application like STOPzilla to make sure that the rogue program is fully removed form your computer.

The latest parasite names used by FakeVimes:

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove Windows Guard Tools you agree to our privacy policy and agreement of use.
do it now!
Reimage (remover) Happiness
Reimage (remover) Happiness
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall Windows Guard Tools. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manual removal instructions below.

More information about this program can be found in Reimage review.

More information about this program can be found in Reimage review.
Windows Guard Tools snapshot
Windows Guard Tools

Windows Guard Tools manual removal:

Kill processes:

Delete registry values:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsafwserv.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsavastsvc.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsavastui.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsegui.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsekrn.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsascui.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsmpeng.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsseces.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSystemRestore "DisableSR " = '1'

Delete files:

About the author

Julie Splinters
Julie Splinters - Malware removal specialist

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Julie Splinters
About the company Esolutions

Removal guides in other languages