1 of 7
Danger level 10
Type: Rogue Anti-Spyware
Common infection symptoms:
  • Block exe files from running
  • Installs itself without permissions
  • Connects to the internet without permission
  • Slow internet connection
  • Annoying Pop-up's
  • Slow Computer
Other mutations known as:

MS Removal Tool

MS Removal Tool is a new rogue antispyware which pretends to be a legitimate security program. It is a direct clone of System Tool and System Tool 2011. These malicious software applications were the hottest parasites in 2010. As a rogue program, MS Removal Tool is created to trick unsuspecting user into believing that this program could be trusted. However, the real aim of the rogue is to steal your financial information and then use it for its own purposes. The relationship between MS Removal Tool and its predecessors is more than obvious, because all software applications share the same infection symptoms.

The most popular way for the rogue to arrive at your computer is through fake online malware scanners. Are you wondering how it is possible to land in an infected site? The answer is simple – one click on a hijacked link from a search engine result can lead you to the site which hosts a download file for MS Removal Tool. Sometimes you don't even need to initiate the download yourself. The download starts automatically, when you land in the infected site. When the download is done, you need to initialize the installation yourself, but clicking on the rogue’s icon. Sometimes, however, the rogue can be downloaded an installed by a Trojan infection, which you have caught some time earlier. Depending on your operating system, MS Removal Tool's infection files are created in random folders in the following directories: C:\Documents and Settings\All Users\Application Data\ for Windows XP, and C:\Documents and Settings\All Users\Application Data\ for Windows Vista and Windows 7.

Download Spyware Removal Tool to Remove* MS Removal Tool
  • Quick & tested solution for MS Removal Tool removal.
  • 100% Free Scan for Windows

When MS Removal Tool infiltrates in your computer, it initiates a fake system scan, and it will always show you that you have numerous infections, such as rogues, backdoors, worms and Trojans. The infections in scan results always appear in the same order, no matter how many times you perform the scan. MS Removal Tool also disables your task manager and does not allow you to execute .exe files. The rogue also floods you with fake security alert messages, which might look legitimate at first glance, because they are constructed to look reliable. Nevertheless messages are not true, and MS Removal Tool is programmed to bombard you with these fraudulent notifications so that you would believe your computer is seriously compromised. Here are some of the fake messages that MS Removal Tool shows you:

MS Removal Tool Warning
Your PC is infected with dangerous viruses. Activate antivirus protection to prevent data loss and avoid the theft of your credit card details.
Click here to activate protection.

MS Removal Tool Warning
Intercepting programs that may compromise your privacy and harm your system have been detected on your PC.
Click here to remove them immediately with MS Removal Tool.

Security Monitor: WARNING!
Attention: System detected a potential hazard (TrojanSPM/LX) on your computer that may infect executable files. Your private information and PC safety is at risk. To get rid of unwanted spyware and keep your computer safe you need to update your current security software.
CLick Yes to download official intrusion detection system (IDS software).

Warning: Your computer is infected
Windows has detected spyware infection!
Click this message to install the last update of Windows security software...

If that weren't enough, MS Removal Tool will change your desktop background into a blue screen with extensive warning.

With such poorly written messages you are urged to activate the protection by providing your credit card number and other personal information to MS Removal Tool. If you do so, you might as well say good-bye to your money for good. In order to prevent that, you need to acquire a good security program or do the manual removal to terminate MS Removal Tool.

In order to make the removal process smoother, you need to “register” the program. It will allow you to terminate MS Removal Tool easier. To “register” the problem, use one of the codes below:

Download Spyware Removal Tool to Remove* MS Removal Tool
  • Quick & tested solution for MS Removal Tool removal.
  • 100% Free Scan for Windows


If you use one of these codes to "register" the program, MS Removal Tool's interface will change from wash-out pink into light blue, and if you perform the scan again, the rogue will find no infections whatsoever. You will be allowed to access your Task Manager again, and load the .exe files. Also, when you have registered the program, another function appears, where you can contact MS Removal Tool's support service by the number 1-800-417-5679.

We have tried contacting them, with intention to say that there is something wrong with the software, and we were immediately asked for the transaction ID, which was supposed to be in our email inbox. If you don't have it, they ask for the first 6 and the last 4 digits of your credit card, and then checks in a data base, to see if they have a record of you. This implies that the people behind MS Removal Tool are storing the credit card information of every single person they have managed to trick.

They also offer a refund if you are not satisfied with the product, but for that you need to tell your transaction ID as well. Also, if you say that you think MS Removal Tool is a virus, the "support center" claims that malicious programs have merely infected MS Removal Tool and they are using the interface of the program. They try to look legitimate by saying their support extension number, and they assure that it is possible to use the same license on a a few computers. That is, they indirectly forces the user to infect as many computers as possible.

Not to mention, that MS Removal Tool's customer support is not your best service ever. We have contacted Anastasia and Max, and some of their answers were harsh, drenched with strong Russian accent. We even heard them swearing. The fact that there is more than 1 person answering the customer's support calls means that the creators of MS Removal Tool are well-prepared to make this scam a successful operation.

This program will always hinder your attempts to remove it, because it needs to stay in your computer for as long as possible. In order to do that, MS Removal Tool blocks your internet connection. When your internet connection is blocked you cannot search for the ways how to get rid of this rogue. The parasite allows you to load only MS Removal Tool’s purchase sites.

Download Spyware Removal Tool to Remove* MS Removal Tool
  • Quick & tested solution for MS Removal Tool removal.
  • 100% Free Scan for Windows

To restore your internet connection, please follow the instructions below:

How to renew your internet connection:

This rogue antispyware blocks your Internet connection to prevent you from removing the rogue application. To enable the Internet connection, please follow these instructions:
  1. Open Internet Explorer and go to >Tools< select >Internet Options<

  2. Select >Connections<

  3. Select >LAN Settings<

  4. Now you need to uncheck the checkbox labeled >Use a proxy server for your LAN< in Proxy Server section. Then press the >OK< button to close this screen and press the >OK< button to close the Internet Options screen.

  5. Now you can download the SpyHunter scanner and remove the infection.

Download Spyware Removal Tool to Remove* MS Removal Tool
  • Quick & tested solution for MS Removal Tool removal.
  • 100% Free Scan for Windows

How to manually remove MS Removal Tool

Files associated with MS Removal Tool infection:


MS Removal Tool processes to kill:


Remove MS Removal Tool registry entries:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce “[random]”


  1. dennis Apr 7, 2011

    It is crazy. My son thought he downloaded a game and bye the time i got to the computer it was just ms tools. I wound up just deleting his account. It was not on main account. I then made a new account for him and so far so good. Is it still on my PC?

  2. George Apr 7, 2011

    Hey i need help. I don't know what's happening about the "registration" code, because i write it, but the proglam says tha is not real or invalid. I need Help about this Malaware or what it is, plase. I'm sorry my english isn't perfect.

  3. Pcthreat Apr 8, 2011

    did you try all listed serial numbers?

  4. Matt Apr 9, 2011

    Thank you so much for the reg code, i found the registry entry, the directories and program locations once it let go of the task manager and i could open a command window! All random numbers.. to make it harder to find, but legit programs don't use random directory/process/file names.

  5. Neil Apr 10, 2011

    Thankyou for the help. "register", kill the process, delete the folder, remove the registry key. Perfect. Cheers

  6. Cdog Apr 18, 2011

    Thanks so much i copied it and when i did it it said thanks for enstalling bye bye but i can do everything i knew it was a scam so i searched and you helped thanks for saving my money.

  7. Mehrdad Apr 21, 2011

    Hi how can I delete it? It came to my computer and my make lots of problem on mu computer?

  8. Pcthreat Apr 21, 2011


    You can download our offered solution. It will scan Your computer and will show all found infections. You can then remove all bad parasites including MS Removal Tool

  9. Ben Apr 27, 2011

    proxy doesn't work the virus still blocks me

  10. Pcthreat Apr 28, 2011

    Could You be more specific? How does it block your computer? Are You able to open a web browser and open a webpage?

  11. wareagle Apr 30, 2011

    Thank you for the code. I tried your last code and was able to access my programs, IE etc. The file is horrific, I spent almost 8 hours trying to fix it via safe mode with connectivity to no avail. Used your code and I am able to restart windows with no problem. Thank you for your valuable advice.

  12. nilotpal basu May 1, 2011

    i have a usb modem not a lan connection. So how to remove ms removal tool . Tata photon+

  13. Austin May 21, 2011

    copying and pasting the serial key worked. I was able to open taskmanager and delete the exe. I hope it doesn't come back again :(

  14. Sandra Jun 3, 2011

    My computer has just been infected with the MS Removal Tool virus. I have a dial-up connection and don't know how to remove it. Help me, please

  15. Pcthreat Jun 3, 2011


    Download our offered scanner. It will look for all infected files and after the scan is done will show them in a list.
    Its Your choice then - delete them yourself or with Spyhunter.

  16. Dak Jun 13, 2011

    I did not act quickly enough, my laptop will not even boot up now! I never gave any of my personal or financial information but I fear it may already be too late! What type of danger might i be in!?

  17. saundrobe@netzero.net Aug 19, 2011

    I need the phone number for Spy-Blocker.com. Do you have it?

  18. Magdalene Dec 9, 2011

    on what collumn is the code which you guys used?

  19. Greta Nov 27, 2016

    It's wodufrenl to have you on our side, haha!

  20. Cady Nov 30, 2016

    Great common sense here. Wish I'd thghout of that.

  21. Mildred Dec 1, 2016


  22. Champ Dec 3, 2016

    That's a smart answer to a diicufflt question.

Post comment — WE NEED YOUR OPINION!

Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.