1 of 5
Danger level 9
Type: Rogue Anti-Spyware
Common infection symptoms:
  • Block exe files from running
  • Installs itself without permissions
  • Connects to the internet without permission
  • Slow internet connection
  • System crashes
  • Annoying Pop-up's
  • Slow Computer

Windows Salvor Tool

Getting infected with rogue antispyware application can be only a matter of bad luck, but if you see Windows Salvor Tool pop up into your screen, be aware that this program is up to no good, and you need to get rid of it immediately. Its name should be enough to make you suspicious of it, but you are still doubtful, there is something else you should know about this malicious application.

Windows Salvor Tool belongs to the Fake Microsoft Security Essentials fraud. It means that it copies the name and logo of legitimate program which as a result makes it look more reliable. Some unsuspecting users do not find out more about the program, and they simply trust what they see. It is a detrimental practice as far as Windows Salvor Tool is concerned. This rogue has a notorious background, because it is a direct clone of such threats as Windows Proofness Guarantor, Windows Necessary Firewall, Windows System Integrity and many more.

It spreads through a Trojan infection, so you can never really know when you catch it, because a Trojan does not need your permission to enter your system. It does not prompt you about the download and so you can accidentally initiate the download when you are browsing the Internet. When your computer is infected with the Trojan associated with Windows Salvor Tool, it sends you a security alert which says that you have an Unknown Win 32/Trojan infecting your computer. Step by step the infection then urges you to perform one system scan after the other, and eventually you end up downloading and installing Windows Salvor Tool itself.

Then the rogue performs a fake system scan and gives a low safety rating to your computer. It finds multiple viruses, system and registry errors and then says that you need to fix it immediately. However, once you click on “fix errors” button you are redirected to Windows Salvor Tool’s purchase page. There you are requested to enter your personal and banking information. This is the thing Windows Salvor Tool is after, so you need to close that window at once and remove Windows Salvor Tool from your computer without further ado.

Download Spyware Removal Tool to Remove* Windows Salvor Tool
  • Quick & tested solution for Windows Salvor Tool removal.
  • 100% Free Scan for Windows
disclaimer

How to manually remove Windows Salvor Tool

Files associated with Windows Salvor Tool infection:

%AppData%\Microsoft
geheep.exe
%AppData%\Microsoft\[random].exe
geheep.exe

Windows Salvor Tool processes to kill:

geheep.exe
%AppData%\Microsoft\[random].exe
geheep.exe

Remove Windows Salvor Tool registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe "Debugger" = 'svchost.exe'
Disclaimer

Post comment — WE NEED YOUR OPINION!

Comment:
Name:
Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.