How to get rid of Windows Efficiency Kit fake antivirus?

By Andrey Gvozd

Windows Efficiency Kit is a malware. In other words, this is a malicious software. Its origin is from crooks who want to get your money easily through deception. If you’ve seen this program on your PC do not buy it! It is a scam. Remove it right away. This guide explains how to get rid of it easily.

Windows Efficiency Kit virus
Windows Efficiency Kit malware

Windows Efficiency Kit comes to PCs through fake Microsoft Security Essentials alerts. These fake MSE warnings use various available vulnerabilities of your browser. Often this vulnerability happens with Internet Explorer, even though other browsers aren’t an exception either. In all cases the very infiltration of this fake antivirus is absolutely illegal. Users don’t install this malware according to their personal decision.

Windows Efficiency Kit is a rogue antivirus. It claims to be able to clean infections, whereas it can’t in reality. Furthermore, it reports many invented threats on your PC. It self-starts itself whenever you turn your PC on. Then it runs the fake scan of your system and gives a long list of invented infections summarized in a fake virus report. While the fictitious scan takes place Windows Efficiency Kit also throws the bunch of scary alerts to make users think their computer is in danger.

The goal of Windows Efficiency Kit is to make you buy its license (so-called ultimate protection). Please don’t ever make such a mistake. This is not the program that can remove real viruses. Purchasing it is a waste of money.

Windows Efficiency Kit blocks many legitimate programs on your computer. This includes your browsers, Task Manager and all security programs installed. In fact, it blocks all applications which are executables. To facilitate its removal from your PC, we recommend you to activate it first using the product key. This process is very well explained below. Then you may get rid of this rogue using a reliable security software.

Software necessary for Windows Efficiency Kit virus removal:

Windows Efficiency Kit removal steps:

  • In Windows Efficiency Kit click “?” Menu button anc click “Register”:

    • Register FakeVimes virus

  • Paste this product key – 0W000-000B0-00T00-E0022 exactly as shown at the image below, then click “Register“:

    • FakeVimes reg key

  • Afer registration download Plumbytes Anti-Malware without any restrictions on the part of the rogue, scan your PC with Plumbytes Anti-Malware and remove all infections detected by clicking “Apply” button at the end of scan.
  • Restart your computer and repeat scan.

Windows Efficiency Kit similar removal video at YouTube:

Beware of ways how Windows Efficiency Kit is spread today:

Windows Efficiency Kit uses various vulnerabilities of browsers like Internet Explorer, Google Chrome, Mozilla Firefox, Opera and many others for the interference into your computer. For example, you might get the following scary alert, supposedly coming from Microsoft Antivirus:

Microsoft Antivirus fake alert
Microsoft Antivirus has found critical process activity on your PC

Microsoft Antivirus has found critical process activity on your PC. You will need to clean your computer to prevent the system breakage.

If you actually click the “OK” button as shown at the image you will have another fake alert, not associated at all to Microsoft Security Essential Alert, but yet claiming to be such:

Microsoft Security Essentials fake alert
Fake MSE Alert

Microsoft Security Essentials Alert
Potential threat details
Microsoft Security Essentials detected potential threats that might compromise your privacy or damage your computer. You need to clean your computer immediately to prevent the system crash.
Detected items:
– Trojan-PSW.Win32.launch
– HackTool:Win32/Welevate.A
– Adware.Win32.Fraud

Associated files and registry entries:

Related files:

%AppData%\svc-[rnd].exe
%CommonAppData%\connector.swf
%Programs%\Windows Efficiency Kit.lnk
%Desktop%\Windows Efficiency Kit.lnk

Related registry entries:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\PrSft %AppData%\svc-[rnd].exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\Debugger svchost.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger svchost.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe\Debugger svchost.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\k9filter.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\k9filter.exe\Debugger svchost.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger svchost.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe\Debugger svchost.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe\Debugger svchost.exe

Fake security alerts, notifications and warnings of Windows Efficiency Kit scam:

Firewall has blocked a program from accessing the Internet
C:\Program Files\Internet Explorer\iexplore.exe
is suspected to have infected your PC.
This type of virus intercepts entered data and transmits them
to a remote server.

Error
Trojan activity detected. System integrity at risk.
Full system scan is highly recommended.

Error
System data security is at risk!
To prevent potential PC errors, run a full system scan.

You may also enjoy...