Cline Computers is finding many customers infected with MS REMOVAL TOOL Virus

May 7, 2011 - PRLog -- MS Removal Tool is similar in design and behavior to the System Tool rogue. It uses yellow system alert messages to get itself installed. MS Removal Tool blocks execution of most programs and Windows administrative tasks like Task Manager, Command prompt, Registry editor etc., presumably to protect itself and at the same time to scare... the user to purchase a fraudulent subscription.

Once installed on the victim’s system, the MS Removal Tool rogue security software proceeds to close other applications and generates fake system security warnings about non-existent malware. The malware creates a random named folder and file in \All Users\Application Data\ folder. The last five characters always ended in 07003 in this variant, presumably the affiliate code. E.g: C:\Documents and Settings\All Users\Application Data\dHdGiAkCkEi07003\dHdGiAkCkEi07003.exe

One of the Mutex created reads Don’t stop me! I need some money!

MS Removal Tool Fake System Scan

Scareware like MS Removal Tool are commonly installed when users are redirected to fake online scanner pages or fake ‘video codec required’ pages distributed through out the Web by cyber criminals using blackhat SEO techniques, Spam and Malicious flash advertisements.

---

Cline Computers is located at 2161 Van Giesen in Richland, Washington.  Cline Computers focuses on virus/spyware cleaning, computer upgrades, windows troubleshooting, on-site service calls, business to business monthly service contracts, computer networking, and much more.  Cline Computers also provides dial-up, DSL, Fixed Wireless, WiFi, web hosting, domain name registrations, and much more.