1 of 6
Danger level 9
Type: Rogue Anti-Spyware
Common infection symptoms:
  • Block exe files from running
  • Installs itself without permissions
  • Connects to the internet without permission
  • Annoying Pop-up's
  • Slow Computer
Other mutations known as:
WindowsSaviourFirewall

Windows Saviour Firewall

There are many types of harmful threats facing healthy PCs today, and Windows Saviour Firewall is just one of many rogue security tools out to rip you off. This insidious rogue derives from the same despicable family of rogues as Windows Tweaking Utility, Windows Safeguard Utility and Windows Attention Utility, and also forms part of the fake Microsoft Security Essentials scam. Despite what it would like its victims to believe, it has been proven that Windows Saviour Firewall does not own the ability to detect or remove any type of threat from the system.

Windows Saviour Firewall will use any means at its disposal to facilitate its unwarranted and illicit entry into the system. This could include using seditious browser hijackers who forcefully redirect users to its compromised landing pages where it will root the Windows Saviour Firewall into the system via drive-by download tactics. Other forms of infection include infected online flash ads and bogus online malware scanners.

This rogue will edit Windows registry entries to allow itself to launch each time Windows runs. This will also cause a fake system scanner to launch, which will pretend to scan the following system components:

Computer Safety
Network Security
Private Data Protection
Hard Disk Optimization
Media Components
Memory & Devices

Of course these are all fake and were designed only to facilitate Windows Saviour Firewall’s deception of its victims. It will only purport to report on infections, such as IRC-Woem.DOS.Septic and IRC-Worm.FOS.Loa, but will not ‘remove’ it until the user pays for a Windows Saviour Firewall license. The complete Windows Saviour Firewall package sells online for $49.95 for a six month license, $59.95 for a 1 year license and $79.95 for a lifetime license, with an optional $19.95 for lifetime product support. Users are warned never to pay for any Windows Saviour Firewall product, as it is nothing but an empty shell which will cause the system more harm than good.

As a further attack against the PC, Windows Saviour Firewall will prevent the user from accessing the Internet, as well as block his attempts to launch any type of application on the system. This is done in an effort to prevent the user from running or downloading any application which may be able to identify and remove Windows Saviour Firewall from the system. Other reported symptoms associated with Windows Saviour Firewall include the user experience poor system performance and increased erratic system behavior.

At the end of the day the user will only be able to regain control of his PC if he were to get rid of Windows Saviour Firewall immediately. This can easily be achieved by making use of a genuine security tool which will not only erase Windows Saviour Firewall but also protect against similar future infections.

Download Spyware Removal Tool to Remove* Windows Saviour Firewall
  • Quick & tested solution for Windows Saviour Firewall removal.
  • 100% Free Scan for Windows
disclaimer

How to manually remove Windows Saviour Firewall

Files associated with infection (Windows Saviour Firewall):

%AppData%\Microsoft\[random].exe

Processes to kill (Windows Saviour Firewall):

%AppData%\Microsoft\[random].exe

Remove registry entries (Windows Saviour Firewall):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe "Debugger" = 'svchost.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger" = 'svchost.exe'
Disclaimer

Post comment — WE NEED YOUR OPINION!

Comment:
Name:
Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.