Severity scale:  

Windows Malware Firewall. How to remove? (Uninstall guide)

removal by Gabriel E. Hall - -   Also known as Windows Malware Firewall | Type: Rogue Antispyware

Windows Malware Firewall is a rogue anti-spyware application that displays exaggerated or completely false scan results and fake security pop-ups to make you think your computer is infected with malware, spyware and ads sponsored software. Once installed, the rogue security application will display a list of fake malware infections and supposed security threat and then will state that you must purchase this program to remove found malware and protect your computer from the newest viruses. Don't pay for the rogue anti-spyware program, it's a scam. You should remove Windows Malware Firewall from your computer upon detection.

Windows Malware Firewall is promoted through the use of Trojan downloaders, fake online virus scanners and hacked websites that load malicious code once you visit them. It's otherwise known as drive-by download. Usually, Trojan viruses display fake security alerts stating that your computer has many security issues or is under attack from a remote server. Fake online anti-malware scanners display similar notifications too but they also hijacks web browsers. While active, Trojans may hijack your Desktop and display the following text:

System Security Warning
Attempt to modify register key entries is detected. Register entries analysis is recommended.
Location: c:\windows\system32\taskmgr.exe
Viruses: Backdoor.Win32.Rbot

While running, Windows Malware Firewall will “scan” your computer for viruses and list a variety of security threats that won't be removed unless you first purchase the rogue security program. The scan results are false, so you can ignore that safely. The same applies to fake security warnings that will come from Windows task bar or Windows Security Center. These are also completely fake. The main problem with those fake security warnings is that they look like legitimate ones and it is very difficult to get rid of them. Fake security alerts will show up like every every two or five minutes. What is more, Windows Malware Firewall will also slow down your computer and block antivirus software. Likely, it will hijack your web browser too.

Windows Malware Firewall is a scam designed to steal money from inexperienced computer users. Do not purchase this program. If you have already paid for it, contact your credit card company and dispute the charges. Then, remove Windows Malware Firewall from your computer using legitimate malware removal software listed below.

The latest parasite names used by FakeVimes:

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove Windows Malware Firewall you agree to our privacy policy and agreement of use.
do it now!
Reimage (remover) Happiness
Reimage (remover) Happiness
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall Windows Malware Firewall. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manual removal instructions below.

More information about this program can be found in Reimage review.

More information about this program can be found in Reimage review.
Windows Malware Firewall snapshot
Windows Malware Firewall

Windows Malware Firewall manual removal:

Kill processes:

Delete registry values:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsafwserv.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsavastsvc.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsavastui.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsegui.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsekrn.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsascui.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsmpeng.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsseces.exe "Debugger" = 'svchost.exe'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSystemRestore "DisableSR " = '1'

Delete files:

About the author

Gabriel E. Hall
Gabriel E. Hall - Passionate web researcher

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Gabriel E. Hall
About the company Esolutions