Click on screenshot to zoom
Danger level 9
Type: Rogue Anti-Spyware
Common infection symptoms:
  • Block exe files from running
  • Installs itself without permissions
  • Connects to the internet without permission
  • Slow internet connection
  • System crashes
  • Annoying Pop-up's
  • Slow Computer

Windows Armature Master

Be prepared to deal with yet another rogue antispyware heading your way. Windows Armature Master is fake antivirus program which wants to be taken as a part of the legitimate Microsoft Security Essentials product. Unfortunately, it is only a scareware, designed to scare you into believing that you have been attacked by multiple serious computer threats and that you need to use Windows Armature Master to remove these errors. If you follow the rogue's plan you will end up with a ruined computer system and your money stolen.

The very beginning of this infection might not look dangerous at all. There is a Trojan which delivers Windows Armature Master to your computer and it can remain dormant for some time until eventually you notice that something is wrong. Since the infection pretends to be a legitimate program, this message that you receive from the rogue might look like a real notification:

Microsoft Security Essentials Alert
Potential threat details
Microsoft Security Essentials detected potential threats that might compromise your privacy or damage your computer. Your access to these items may be suspended until you take an action. Click 'Show details' to learn more.

Below this message you will see one parasite among the list of "detected items", called Unknown Win32/Trojan which its alert level indicated as "severe". You are recommended to remove this item while it is suspended at the moment. If click on "Show Details" you will initiate a small system "scan" after which you will be urged to download and install Windows Armature Master into your system, because this will be the "only" reliable program which is capable of removing the threats detected by the FAKE Microsoft Security Essentials.

However, once Windows Armature Master is downloaded and installed, it creates even more problems for you, like slowing down your computer and then blaming it on non-existent parasites. Windows Armature Master offers you to remove these threats if you pay for the full version of the program. Do not do that. If you pay, you will reveal your credit card information for the criminals who have created this rogue, and then your bank account will be hacked without your knowledge.

Before this happens, remove Windows Armature Master from your computer for good. Invest in a reliable antispyware tool which will help you to get rid of this rogue automatically, if manual removal is too tricky for you. As long as you clean your computer of such threats as Windows Armature Master completely, all removal methods are applicable.

Download Spyware Removal Tool to Remove* Windows Armature Master
  • Quick & tested solution for Windows Armature Master removal.
  • 100% Free Scan for Windows

How to manually remove Windows Armature Master

Files associated with Windows Armature Master infection:


Windows Armature Master processes to kill:


Remove Windows Armature Master registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger" = 'svchost.exe'

Post comment — WE NEED YOUR OPINION!

Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.