Windows Salvor Tool

Posted: July 7, 2011

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	12,267
Threat Level:	10/10
Infected PCs:	4,188

First Seen:	July 7, 2011
Last Seen:	September 15, 2023
OS(es) Affected:	Windows

Windows Salvor Tool is just one new entry into a large family of rogue security programs. Windows Salvor Tool and similar rogue software are installed by Trojans that use fake pop-up alerts to make you believe that Windows Salvor Tool is a real security product. After that, Windows Salvor Tool gets in on the game with its own fake alerts, backed up by attacks of unrelated applications that make it look like your PC is being threatened from all directions. Windows Salvor Tool and any related Trojans are the only real problems on your computer, however, and buying Windows Salvor Tool will not solve any of those infection symptoms. You can remove Windows Salvor Tool by using any good anti-virus program, although it's recommended that you update your threat definitions prior to scanning your PC for Windows Salvor Tool files.

An Examination of Windows Salvor Tool's Sham of Salvaging Efforts

The obscurely-named Windows Salvor Tool ('salvor' being an alternate term for 'salvager') is, despite the new moniker, as good as identical to closely-related rogue programs. Some of Windows Salvor Tool's close cousins include Windows Vulnerabilities Rescuer, Windows Easy Supervisor, Windows Debugging Center, Windows Debugging Agent and Windows System Integrity.

Each and every one of these fake security programs, including Windows Salvor Tool, use preset fake system scan displays, security grades and inaccurate pop-up warnings to fool you about your PC health. Although there's nothing you can do to make Windows Salvor Tool tell you that your computer is just fine, the bright side is that you can ignore fake pop-ups like the ones below freely:

Warning!
Location: [application file path]
Viruses: Backdoor.Win32.Rbot

Warning!
Name: [application file name]
Name: [application file path]
Application that seems to be a key-logger is detected. System information security is at risk. It is recommended to enable the security mode and run total System scanning.

System Security Warning
Attempt to modify register key entries is detected. Register entries analysis is recommended.

Warning! Database update failed!
Database update failed!
Outdated viruses databases are not effective and can't [sic] guarantee adequate protection and security for your PC!
Click here to get the full version of the product and update the database!

System component corrupted!
System reboot error has occurred due to lsass.exe system process failure.
This may be caused by severe malware infections.
Automatic restore of lsass.exe backup copy completed.
The correct system performance can not be resumed without eliminating the cause of lsass.exe corruption.

Warning! Running trial version!
The security of your computer has been compromised!
Now running trial version of the software!
Click here to purchase the full version of the software and get full protection for your PC!

Looking Under the Deepest Layers of Windows Salvor Tool Infection

Windows Salvor Tool attacks can also consist of less harmless problems than simple fake infection warnings. Besides inaccurate messages like the ones above, Windows Salvor Tool can also:

Hijack your web browser. Hijacks commonly manifest in the form of a changed homepage or in being redirected to malicious websites like the Windows Salvor Tool domain. You may also be prevented from visiting websites due to fake unsafe websites warnings that Windows Salvor Tool creates.
Blacklist a variety of programs to prevent them from running. Windows Salvor Tool may even create a relevant infection warning to make it appear as though Windows Salvor Tool is protecting you from a virus, Trojans or other PC threat.
As a last and rather insidious function, Windows Salvor Tool may also launch without permission as soon as Windows starts, and refuse to shut down.

Although buying Windows Salvor Tool will not cause these problems to disappear, removing Windows Salvor Tool with an appropriate anti-virus application will solve all related symptoms. Since Windows Salvor Tool is likely to be installed by the Fake Microsoft Security Essentials Alert Trojans, it's recommended that you scan your entire PC for threats instead of stopping once you've deleted Windows Salvor Tool.

File System Modifications

The following files were created in the system:

# File Name

1 %UserProfile%\Application Data\Microsoft\.exe

#	File Name
1	%UserProfile%\Application Data\Microsoft\.exe

Registry Modifications

The following newly produced Registry Values are:
HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = '0'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore "DisableSR " = '1'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = '0'

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%AppData%\Microsoft\geheep.exe

File name: geheep.exe
Size: 1.66 MB (1668096 bytes)
MD5: 5cee6a563b2195095e43b749c2b06ac3
Detection count: 14
File type: Executable File
Mime Type: unknown/exe
Path: %AppData%\Microsoft
Group: Malware file
Last Updated: January 8, 2020

Registry Modifications

The following newly produced Registry Values are:

Regexp file mask%AppData%\Microsoft\[RANDOM CHARACTERS].exe

Windows Salvor Tool

Threat Metric

An Examination of Windows Salvor Tool's Sham of Salvaging Efforts

Looking Under the Deepest Layers of Windows Salvor Tool Infection

File System Modifications

Registry Modifications

Technical Details

File System Modifications

Registry Modifications

Leave a Reply