As with any other fake anti-spyware that is part of the Fake Microsoft Security Essentials infection, Windows Amrour Master infects a computer via a Trojan that once on the system in question it will start displaying fake Microsoft Security Essentials alerts stating that an Unknown Win32/Trojan has been detected on the computer.
The alert messages will then suggest that you scan your computer, a process that is fake and meant to scare you into thinking that your machine has been infected with Trojan.Horse.Win32.PAV.64.a. The fake alert messages will then suggest that the only way to remove this threat is by installing Windows Amrour Master. Clicking Ok on these alert messages will automatically download and install Windows Amrour Master on your computer, after which your system will reboot.
How To: Remove Windows Armour Master Virus / Malware ( Removal Guide )
After the reboot you will not be able to access your regular desktop screen. Instead you will see a Windows Amrour Master main window suggesting that you should perform another (fake) scan. Once the fake scan is completed Windows Amrour Master will attempt to scare you into thinking that your computer has been infected with a multitude of threats and that the only way of getting rid of these infections is by purchasing the full version of Windows Amrour Master.
Do NOT let yourself scared into purchasing this so called full version as it is just another fake program meant to get a hold on your money and credit card information.
Also keep in mind that in order to access your regular desktop screen you will need to go through the (fake) scan every time you reboot your computer.
Windows Amrour Master Removal Guide
In order to go through the steps of this Removal guide you will need to download some programs. However, Windows Amrour Master might prevent you from accessing the internet. If this is the case you will need to download these programs on a working computer and then transfer them on the infected PC via CD/DVD or any other portable means.
- Download and Install RKill. This program will help you kill any processes related to Windows Amrour Master. Windows Amrour Master however might sense this threat and it will most likely warn you about RKill being a threat to your computer. Ignore these messages and if Windows Amrour Master will still give you troubles running RKill go do the link above and download a renamed version of RKill like iExplore.exe. Do not reboot your computer after this step else you will need to repeat the entire process all over again.
- In order to make your desktop screen disappear Windows Amrour Master will mess with your Windows Registry Shell value. Before you go on with the disinfection process it is vital that you download and execute Shell.reg in order to restore these registry values, else you won’t be able to access your desktop screen once Windows Amrour Master will be removed from your computer.
- Download and install Malwarebytes’ Anti-Malware (MBAM) while making sure that during the installation process both the Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware options are checked. After the MBAM installation is complete reboot your computer if prompted to do so.
- Once your computer reboots, MBAM will automatically update itself after which you will be presented with the main MBAM window. From here go to the Scanner tab, check the Perform Full Scan radio button and then click on the Scan button below. The scanning process might take a while so please be patient.
- After the scanning is complete MBAM will show you the full list of threats found on your computer. Make sure that all these threats are checked and click on the Remove Selected button. After the disinfection is completed reboot your computer if MBAM will recommend you to do so.
If you’ve followed this guide accordingly your computer should now be clean of any infections, including Windows Amrour Master. However, considering the fact that your PC got infected in the first place you should consider following this Secunia PSI guide in order to determine whether or not there are vulnerable programs on your computer that might open the door for other future threats.
