How to remove fake MS Removal Tool.?

Just a few important points; Malwarebytes will currently -NOT- detect this malware. Additionally, when you open your processes menu to end program, the virus will sometimes close your processes list every time to prevent you from doing so. Safe mode -should- fix this. At this point, while MWB tries to get an update up, a system restore seems like your safest bet. Otherwise, some of these guides seem alright.

Do not do what any of the above people are suggesting you do to your PC. This is easy just follow the steps. This will avoid any reprogramming. Take it from someone who had this problem last week. Follow the steps and you will have your PC back to normal. By the way, if you have Windows XP, look for a randomly named folder in C:\Documents and Settings\All Users\Application Data\ folder. As far as I know this is not a virus but fake security software. Anyway, it hides in some randomly named folder like "hGdKHt0842", inside that folder there was a file with hGdKHt0842.exe. You can't just delete this file because the virus is active, but you can rename it. You need to rename the file Rename the file C:\ProgramData\virus\virus1.exe instead of C:\ProgramData\hGdKHt0842\hGdKHt0842.exe or whatever it may be named in the folder. Then restart your computer and once you log back on the MS Removal Tool should not show up. Finally, go ahead a delete the entire folder you renamed, and exit anything you had open. _______________________________________… If you didn't understand the above Info just follow these steps: STEPS: 1. Locate and left click "Start" Button. 2. Then left click "My computer" 3. In the "My Computer" address bar copy and paste this file C:\Documents and Settings\All Users\Application Data\ then press "Enter" on your keyboard. 4. Locate a randomly named file for example "hGdKHt0842", "GfdKHt0842" or anything else that looks familiar to the following examples. 5. Once file is located Right click on that file and click "Rename". Rename the file by copying and pasting C:\ProgramData\virus\virus1.exe 6. Then close all applications and "Restart" your computer. 7. Once restarted "MS Removal" should not pop up at this point. 8. Then redo steps 1, 2 & 3. And then go ahead and Delete the renamed file C:\ProgramData\virus\virus1.exe 9. Empty your recycle bin. 10 . And WALA!! your PC is restored.

Follow this removal guide, it might help: http://deletemalware.blogspot.com/2011/03/how-to-remove-ms-removal-tool-uninstall.html You may try to remove it manually too: MS Removal Tool files and registry values: Files: For Windows XP users: C:\Documents and Settings\All Users\Application Data\fHrPqDaZcCg02547\fHrPqDaZcCg02547.e… For Windows Vista and Windows 7 users: C:\ProgramData\fHrPqDaZcCg02547\fHrPqDa… Registry values: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\RunOnce "[fHrPqDaZcCg02547]" Good luck!

Take your computer back to the store you bought it from and get them to fix it.

Got this 18 hrs ago. (Solution below). AVG free anti-virus didn't find it. Spybot Search + Destroy didn't find it (both after "scan whole computer" searches). Spybot Search + Destroy (free download) does allow you to stop it from loading up at startup though. Don't know if it works once MS Removal Tool has popped up, because i got rid of it in Safe Mode (just in case). Please make the distinction between "Microsoft Windows Malicious Software Removal Tool" + "MS Removal Tool" - cos the first one is a proper programme. The virus writers/ scammers rely on us numpties to make a false connection between MS + Microsoft, and therefore we start to believe their false infection reports. Never panic into clicking on a button. STEP BY STEP SOLUTION: Save your work + restart computer. When it begins to start, keep pressing "F8" till you see a black screen with several start-up options on it. Select "Safe-mode with networking". This will allow you to download or update anti malware programmes without the virus interfering. Download or update (important) Spybot Search+ Destroy. READ THE MANUAL - cos it can change your registry entries. MAKE SURE YOU UNDERSTAND THE CONSEQUENCES. In the left-hand column at the bottom (may need to be in 'expert' mode), select TOOLS, then SYSTEM STARTUP. Look in this list for MS Removal tool (it will probably not be called this - dead giveaway for a fake programme). It will probably be listed as a bunch of random letters + numbers (so that you think you had better not touch it), e.g. "iNgJhNcDpMm06511.exe" (make a note of your file name). Uncheck the box next to this item so that Spybot will not allow it to start up at the next re-boot. Close Spybot + restart the PC as normal. If MS Removal Tool does not pop up on the screen, look in the system tray to make sure it's not running in the background. Now go to My Computer\ drive C:(or whatever your main drive letter is)\ Documents + Settings\ All Users\Application Data\ iNgJhNcDpMm06511 (or whatever random name your virus called itself). Delete or erase this folder - MAKE SURE YOU HAVE THE RIGHT NAMED FOLDER. "Eraser" is an excellent free tool to remove things PERMANENTLY from your hard drive. Next, click START \ Run..., type "regedit", (this opens your registry editor - be VERY careful what you click on in here). Go to "HKEY_CURRENT_USER"\ Software\ Microsoft\ Windows\ Current Version\ RunOnce. The registry key for your randomly named virus should show up in the right-hand box. Click on the name, then select Edit, + Delete. JOB DONE.

Reboot your computer into Safe mode.....then download this free utility.....rename it if you have to ...put it on your desktop...open and run.....it will take care of this.... http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html http://download.cnet.com/IObit-Security-360/3000-8022_4-10967594.html?tag=rb_content;contentMain

Reboot your computer in safe mode by taping the F8 key repeatedly and then select "safe mode with networking", then select the option "System Restore" and restore your computer to an earlier date before the problem appeared in your toolbar . I had the same problem today and could fix it by restoring my system to a week earlier. Good luck!

This is why you have to download from a trustworthy site, i take it you downloaded yours on a not so well known site. Either way, go to safe mode with networking, by tapping F8, one of the other, and after you've gone on safe mode, download malwarebytes on cnet and have it run. It SHOULD be gone otherwise, you should take it back to where you got it from so someone can fix it for you, at a price of course.

Reboot in safe mode with networking by repeatedly tapping the F8 key as you boot. When you've entered safemode. Do not use Norton, Norton sucks. Download and install MalwareBytes Anti-Malware which is a free and removes many infections. Super Anti-Spyware works well too. As for an anti-virus program I suggest installing Avast or Avira and canning Norton once you've got rid of the program. As a very last resort if you have a Windows operating system you could download and run ComboFix which can be downloaded from Bleepingcomputer.com, but do so only at the advice of an expert. Also, you could do a scan with Windows Defender if you have 7/Vista. Comes built in with the system. Hope this helps