Remove MS Removal Tool

Thanks for the help. I was able to get his junk virus off my system. Talk about a pain in the rear end. I’m running a virus scan now to ensure I don’t have anything else.

Norton did not block this threat from installing so I may just purchase your recommendation of Spyware Doctor.

Thanks for the kind words. I’m told Stopzilla is working at quarantining this threat as well. Worth a try for those who like that product. Here is a direct download link to that product http://www.removevirus.org/go.php?product=Stopzilla-download

I followed you video. seems to have worked. the only problem is that I am unable to delete the bad file. Says I do not have admin rights to delete? I am the admin on the computer. I was able to rename the file folder the file resides in. seems to have worked? Any suggestions on getting the file deleted?

Thanks again for your help. -Sean

What is your operating system? People who have Vista and Windows 7 think they are admins but really they are like semi admins. Boot into safe mode and login under the Administrator account and delete the file.

You may also be able to take ownership of the file first and then delete it in normal mode. I would also suggest you run a full virus scan to ensure you are not infected with anything else.

I am certainly not a computer genius, but using your video and walking through it step by step I was able to take the virus out just as you showed. I think I will give spyware doctor a try also as my symantec protection did nothing to stop it. Thank you again.

I’m pretty sure you just saved my life; thank you!! Your guide worked like a charm. I’ll be buying SpyWare Doctor; McAfee let this right on in.

Thanks for letting us know. Remember if you download the Spyware Doctor with Antivirus client from our website and make a purchase we do get a commission. That helps us build and market our free removal guides to the world.

Thought you might like to know that malware bytes, spybot s&d and symantec endpoint security did not find this and thought my wife’s infected laptop were clean.
You guide worked great thanks.

Hi thanks for this,

I’m horrible at all this technical stuff, and this was fairly easy to follow.

I’m using XP and the strange thing is i cant view the hidden “application data” file even after changing the view settings in folder option as shown on the video. It seems it doesn’t save my settings each time i Hit the radio button “show hidden files and folders”

But I manage to search
C:\Documents and Settings\All Users\Application Data
and found the strange File name

Another way i find to work is to simply use the task manager (CTRL +ALT+DEL) and stop the MS removal tool. And then delete the file in application data for XP users.

Thanks!!

thanks a lot! I wish you all goodness.

Thanks for the video. Your suggestion to rename the exe file worked like a charm. I’m now able to run a full virus scan, hopefully that will take care of the rest. Thanks!

And now off to prepare the lecture for my husband about why staying up all night on a week day surfing for pr0n is a bad thing…. ;D

In these clients defense. This threat did just come out. However if you had a paid version of Malwarebytes and symantec endpoint and they failed to block the threat from installing, that is bad.

Yes surfing porn is a sure fire way to get infected if you do not have proper protection. You should also never install anything from a porn website like video codecs of video updates and the like.

I need to stress that porn is not always responsible. In most cases it’s hacked websites that are injected with malicious code. For instance your child does a simple google search for Bald Eagles for a school book report. He clicks a link in the search engine and bam your infected from a website that has innocent information on it. Happens millions of times a day. The only way not to get infected is to be properly protected online.

I’m trying to remove ms removal tool on my windows 7 laptop but i can’t get the task manager to open as soon as I log in. as you said in the video I try to press ctrl+shift+esc but the task manager doesn’t even open up.

Yes that method will not always work. That is why we list 5 methods in the guide for disabling this. Try one of the other methods

Thank you, I did a search on youtube and found your video. Being someone who knows his ways around computers, it was really frustrating when I couldn’t open my Task manager. I knew then it was a scam virus. I hate to think of how many older people have gotten money stolen from their accounts. I find it strange that microsoft does not update your computer against something like this.

Thanks again, Very clear and detailed video.
Cheers.

Hello,

I recently had my PC infected with the MS Removal Tool. I followed your guide and deleted the file from my program data folder (running win 7) in safe mode.

I then went to the registry to try and delete what was at the following:

KEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce “[random]”

However, when I go into this, all I see is a file titled “Default”. Should I delete this? From looking at the registry I can’t seem to find anything random that could be this MS Removal Tool. Any idea’s?

Also, at the time of infection I was running the Microsoft Security Essentials, I have updated to Zone Alarms Extreme Security and run 2 scans and no further infections/virus’ have been found.

Cheers

Honestly the registry keep listed won’t do any harm if the main executable has been deleted like you already did. I would expect the Zone Alarm Extreme Security client to pick the registry traces some time in the the future and remove it. That or a decent registry cleaner should clear it out.

It’s not doing any harm because the value it points to has been removed. If you recall the name of your executable you may be able to search the registry for that file name and then delete it that way. Personally I would run a full scan with your client and call it a day.

After sending the previous comment, I watched your removal video and was able to stop the fake antivirus program using CTL Shift Escape at logon. The program started with “oak” and was located in a temp folder, not in programdata. I am running a full scan now. Thanks again.

There really is no way for Microsoft to block threats like these. From what they see, it’s a program that you allowed to be installed on the account.

The only real way aorund this is
1. Purchase and anti-virus client.
2. Create a limited account and use that as your main account. If you ever need a program or update installed you would have to log out of the limited account and log-in under an account with admin rights. This is create to use for children.

My sister-in-law has encountered this Ms Removal Toll just today, they do not currently have any protection on their computer, so I am working out a way to help them. My question though is I have Trend Micro Titanium Max Security, on my computer, I have no idea if I have encountered this or not, but I couldn’t find anything when I searched the report files, but i was wondering if in fact Trend Micro would detect this if I ever did encounter this? I read all the comments above but did see where anyone else had this program, if anyone knows I would greatly appreciate a heads up. Thanks again.

I pride myself on being able to fix these things – this one kicked my butt. YOU saved me. Thank you!!!

Right On. Thanks for the kind words

Will Trend Micro Titanium Max Security remove this? No not at this time

Will Trend Micro Titanium Max Security block this? Yes it should block the install of this threat or at the very least warn of it and recommend against the install.

Do I know the above to be fact? No but I would bet some major bucks on it.

The video was extremely helpful when removing the MS Removal Tool virus!! The video walked me through each step and even predicted the problems that may arise as I tried to remove the virus. Thank you very much!

Thank you so much. Your video was excellent to get me through this.
Made it simple and many thanks again

THANK YOU!!!!!! I did everything just like you said and it worked perfectly. It’s good to know that you can get such good information out there. Much appreciated!

Your instructions were spot on and I had no problem getting rid of this virus many thanks and I will not hesitate to recommend you in the future

Thank you very much!!! With your help i could remove this garbage!!! God bless you!!!

my computer has been infected with this virus, and I was killing it as your guide, thank you

Thanks,,, my computer is free from MS Removal tool…

Thanks very much! Getting rid of the files seemed to have fixed the problems.

Just wanted to say THANK YOU for assisting me to remove the virus. You are very precise with instructions and it worked like magic. You are indeed a life saver. A huge shout out to people like you who help out the “infected”.

Your video was extremely helpful and helped me fix the problem within 10 minutes. I really appreciate it thanks again!

Yours is the easiest and most common-sense virus removal guide there is. I got infected with this virus despite having Avira antivirus running. I will definitely load up on some serious antivirus protection from here on out.

After working for 3 hours and trying to follow directions from countless other websites, I was able to finally remove this junk in 15 minutes with the help of your video. I’m clicking on the PC Doctor link right now to buy it! That’s just my little way of saying thank you for all you do!

Thanks! I already had spyware doctor but it was disabled for hell knows why… It would have taken me days to fix this without this website, (Warning not for children ages 13-) REMOVED REST OF COMMENT. TOO VIOLENT

The guide works. Simple as that. It’s the exact method I have used to remove the threat on our test computers.

im still fixing mine. hope it works

It’s really just a matter of preference as to what security client is the best client. Some people will see my recommendations of Spyware Doctor and Stopzilla and blak and swear by Kaspersky or Norton.

I know the guys behind Stopzilla really work hard to bring users the latest updates as fast as they can and they are based in the United States. I would simply install them both. Play with each for 5 minutes and keep the one I like the best. There is a 30 day refund policy on both clients so worst case in a few weeks you call and get your money back and go with a different client.

Family member had laptop infected by this insidious, infectious, disgusting piece of garbage. Your instructions were implemented, and though it took a little more hunting to find the file inside the ‘App Data’ folder, it was duly found, renamed, and laptop restarted without the virus popping up. Task Manager was once again accessible, and anti-virus software was pressed into service.

The infected object was found with the updated anti-virus software in 1 min., 30 seconds. We await the final scan, quarantine and final removal of this nasty infection, but we’re in a much better mood this hour about it.

Many thanks.

Thanks for the video. Great Step by Step detaIL on how to remove this VIRUS:) I do have one tiny question…. I was able to end the process by logging on right away. However, before opening the file location I ended the process. I dont have a file folder called Program Data. Could this folder be called something else? If so, where can I find it so I can delete this MS Tool Virus.

Jacob,
Thank you so much for the help on the removal of MS tool. If anyone has a problem just follow the You Tube video and you will be fine. Also, which Antivirus is better, the Stopzilla or the Spyware Doctor? Again, Thank you for all your help.

For Vista and Windows 7 you will have the mentioned folder in the guide. It’s a hidden folder as stated in the guide. Watch the video for more details on how to show a hidden folder.

We also have the XP video and guide listed on this website http://www.removemsremovaltool.com

I’m glad to see that Stopzilla and others are working to remove this terrible virus. How I ended up with it on my brand new notebook is beyond me, but I was luckily able to terminate the process and remove it. Unfortunately, I wasn’t able to find assistance such as this webpage, since I currently do not have Firefox installed and so MS Removal Tools refused to allow my browser to run. Be careful if you want to remove it manually- the virus will deny the infected account permissions to modify, delete, or even open the folder. Good luck to anyone infected with this!

i am having trouble showing the hidden program. i am using vista. i have typed where you shoow to type hidden it does not appear theere.

thanks a lot dude.
very helpful. and guys please do not click on ads that tell you to
Shoot Romans
Shoot Ipods
Shoot Iphones
and anything else that you think is too good to be true.

I got the virus by shooting the romans
Cheers.

Thanks for giving me the useful information. I think I need it. Thank you

I’ve used this removal for 2 computers now, and it’s done the job immaculately! Your steps are easy to follow and easy to convey over the phone (the first time I used it). I hope to never need it, but in this day in age.. well you know I’ll be back!

So I have gotten all the way up to “application data” however there is no such file in there … as a matter of fact there is nothing in there. I’m not a computer whiz, and I’m aware I probably should have just had a pro do this but how do I find it? Could it be anywhere else in my computer? Other than all that I’d like to say thanks my computer is already working normally again! I just want the final steps to be complete!

My son installed this awful program by mistake, he’s only 15 and thought he was doing the right thing.
Your clear and concise instructions were an absolute God send.
Many thanks Jacob, problem has been fixed.

hey there thanks for the video
I faced same problem but just removed the virus from the computer i am using webroot internet security essentials protection and scaned removed everything but i am stell confused when i was reading ur article: is this supposed to mean i still have in my hard drive even i removed it ?
or ITs gone from my computer
IS it safe for me to go online for my banking account
thank you

If you followed the guide and ran a full scan using either Stopzilla or SPyware Doctor with antivrus and nothing was found then you are clean and good to go.

The message you are referring to is a FAKE message and not anything to be concerned about.

Thank you so much for this guide! I lost my last computer to a similiar threat called Antispy :S I wasnt fast enough with that but now I knew better and thanks to this guide got the MS removal tool deleted now. I dont have a payed anti virus, but Im doing a complete scan on Avira Antivir Personal (free) now. Thanks again, the world needs kind people like you =)

Thanks for the video and other info. I was able to resolve the problem quickly and with confidence thanks to your guidance!

Hi,

I finally got rid of the MS Removal Tool thanks to your help. THANK YOU!

However, I was careless and gave MS Removal Tool numbers and data of my two credit cards. Each time they were “rejected” by the program.

Then I realized that THIS IS the virus and I began to fight it.

It’s a middle of the night and I’m in another country. If I block my cards, I will have no money to come back home.

What should I do then? What is the possibility they will be able to actually steal the money from my accounts?

Simply call the credit card companies and make them aware of the situation. You can have new cards issued or a fraud alert put on the account. It’s them you should be asking what to do.

Impressive solution to a really annoying virus, just cant help wondering how many peps have been had by this one. A very G,day mate from a supporter in Aus.

I have Xp. I don’t find any .exe files in my personal “sdf” folder. could the file be elsewhere? Thank you. I am showing hidden files and folders.

Hey. Badly enough i got effected, i also found your great help too l8.

I tried it on my own, and yes, i managed it, to delete this program. Then i used ccleaner and Ashampoo Winoptimizer to clean the registry and the Temp. But somehow sth. were still infected so as soon as i opened my FireFox my pc crashed and said “Bad Pool Header”. Normally there should be a problem with my RAM, but unfortnatly it´s my Laptop and evrything else works fine. So i recovered my System to some days before, but after i did that all my Internetprogramms (Firefox Opera) crushes my PC. If i use Chrome or IE i can open the WWW but i get a blank page.

I´m totally frustrated and i really need help.

Ps,
Sry for my bad English. I come from Germany and i didnt slept well last night.

You did not mention running an antivirus scan yet! That is what you need to now do. Run a full scan and see what else you are infected with if anything. You may simply have to re-set a few settings.

THANK YOU!!! IT took me like 10 of these videos until i got to yours which was by far the best. YOU SAVE PEOPLES LIVES!!!!! please pat yourself on the back for me because you wouldn’t believe how angry this virus got me. THANK YOU

You guys are geniuses. Your explanation was concise, clear, and it worked. Thank you. You couldn’t have done a better job of demonstrating why someone should buy your products and services if you had hired all of Madison Avenue’s marketing companies.

I went to C:\Documents and Settings\USER NAME\Local Settings\Application Data. however i could not find the program “with a weird name” could it be somewhere else? And how do i find it????

The guide lists other places to look as well. I suggest reading the guide again for the alternative locations, watch the video again.