Protection Software: MS Removal Tool - Manual Removal Instructions
“MS Removal Tool” is the latest variant in the Security Tool/System Tool family of rogue-antispyware applications. Similar to previous variants, this infection is currently quite widespread.
As with all rogue-antivirus/anti-spyware infections, the purpose of “MS Removal Tool” is to dupe the user into believing their computer is infected and to purchase a license.
To remove this infection from your computer, ensure that you have completed a Smart Update of Spyware Doctor/PC Tools Internet Security, and perform a full scan.
If you are unable to run Spyware Doctor/PC Tools Internet Security, please download and run PC Tools Threat Removal Tool in normal mode.
Alternately, MS Removal Tool can be manually removed from your computer by completing the following procedure.
Clear Proxy Hijack:
- Open Internet Explorer
- Click on ‘Tools’
- Select ‘Internet Options’
- Select the ’Connections’ tab
- Click on the ‘Lan Settings’ button
- Under ‘Proxy Server’, uncheck this option, then click ‘Ok’
- Close the Internet Options menu by clicking ‘Ok’
- Close Internet Explorer.
Remove MS Removal Tool Files:
- Open My Computer (‘Computer’ on Vista/Windows 7)
- Navigate to either of the following locations:
C:Documents and SettingsAll UsersApplication Data<random MS removal tool characters>
C:ProgramData<random MS removal tool characters>
- Open the Control Panel
- Open the ‘Folder Options’ menu
- Select the ‘View’ Tab, and add the following settings:
o Uncheck ‘Hide Protected Operating System Files’
o Uncheck ‘Hide extensions for known file types’
- Click on ’Apply’ then ’Ok’ to apply these settings.
4. Delete the file named <random MS removal tool characters value2>.exe
5. Close the current window, and then reset your folder options to default by undoing the changes above
Remove MS Removal Tool Registry Keys:
- Click on the Start Menu (‘Windows’ button on Vista/Windows 7)
- Select the ‘Run’ menu (Windows XP only)
- Type regedit and click ‘Ok’
- Navigate to the following key:
6. Right-click on this value and select ‘Delete’, then close the Registry Editor.
In place of completing these procedures through Computer/My Computer and the Windows Registry Editor, PC Tools File and Registry Tool can be used to remove the MS Removal Tool files and registry value.
Detailed information regarding the use of the File and Registry Tool can be found in our Malware FAQs forum here.