Sep 21, 2009

Remove SaveArmor - Save Armor Removal Information

SaveArmor is new application that pretends to be legitimate anti-spyware application. But in reality it is another misleading program. Moreover it is representative of infamous Winisoft rogue family, members of which had done a lot of harm to computer users all over the world. SaveArmor is a clone of its predecessors, with the same GUI but different name. Parasite is usually promoted via Trojan-Downloader which install SaveArmor trial version onto victim’s computer without any notification or approval. After installing malicious software into PC, same Trojan will configure it to start automatically every boot up. While running, SaveArmor will bother you with annoying pop-ups, exaggerated scan results and fake security alerts. More about scans, results of which is always predicable because SaveArmor after “landing” on your machine had created a lot of files with random names in order to detect them as infections in further scans. But in reality these files are harmless and won’t carry any danger to your data or privacy. They are only shown in order to mislead you and push into purchasing licensed version of SaveArmor for 50$, which is in reality absolutely useless piece of software. As you see SaveArmor is malicious software that must be removed as soon as detected.

Type: Rogue Anti-Spyware
Malware Author: Unknown

Threat Level: Critical
Screenshot:


How to remove SaveArmor manually:
It's possible to remove SaveArmor manually, but you have to be very experienced in dealing with registry entries, program files and .dll files.

The files to be deleted:

c:\Program Files\SaveArmor Software
c:\Program Files\SaveArmor Software\SaveArmor
c:\Program Files\SaveArmor Software\SaveArmor\SaveArmor.exe
c:\Program Files\SaveArmor Software\SaveArmor\uninstall.exe
c:\WINDOWS\10069zo5-a-virus796.bin
c:\WINDOWS\105579izus27f5.bin
c:\WINDOWS\105899py3cz.dll
c:\WINDOWS\system32\30c9ba5kdzor218.cpl
c:\WINDOWS\system32\31429wor51baz.bin
c:\WINDOWS\system32\3190z59rus461.cpl
c:\Documents and Settings\All Users\Desktop\SaveArmor.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SaveArmor
c:\Documents and Settings\All Users\Start Menu\Programs\SaveArmor\1 SaveArmor.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SaveArmor\2 Homepage.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SaveArmor\3 Uninstall.lnk
%Temp%\Local Settings\Temp\x0lc3bqd.exe


Remove registry entries:

HKEY_CURRENT_USER\Software\SaveArmor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SaveArmor
HKEY_LOCAL_MACHINE\SOFTWARE\SaveArmor
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SAVEARMORSVC
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SaveArmorSvc
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "SaveArmor"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "x0lc3bqd.exe"


Please be careful because manual removal of SaveArmor may seriously damage operational system and sensitive data. Also there is a big possibility of incomplete removal, because some files could be hidden and program could re-install itself after you delete files and registry entries. So we strongly recommend you to use automatical removal tool.

No comments:

/