| MalwareWar removal process |
|
| Author:admin CopyFrom:web Hits: UpdateTime:2008-4-8 15:21:04 |
Begin of the article MalwareWar removal process
1.DownloadGoogle recommend safer browser Web browser, For more safe , Stay Secure on the Web and stay far away virus,Download URL http://www.oral8.net/firefox/firefox.htm
2. Temporarily Disable System Restore (Windows Me/XP).
3. Update the virus definitions. Reboot computer in SafeMode
4. Run a full system scan and clean/delete all MalwareWar infected files and Delete/Modify any values added to the registry.
Navigate to the subkey and delete the valuesas following:
Behavior
The program must be manually installed.
The program reports false or exaggerated system security threats on the computer.
The user is then prompted to pay for a full license of the application in order to remove the errors.
Installation
When the program is executed, it creates the following folders:
- C:\Documents and Settings\All Users\Application Data\TEMP\
- %Windìr%\Temp\[RANDOM CHARACTERS].tmp
- %Windìr%\Temp\[RANDOM CHARACTERS].tmp
It then creates the following files:
- %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareWar 7.3.lnk
- %UserProfile%\Desktop\MalwareWar 7.3.lnk
- %UserProfile%\Local Settings\Temp\MWLanguage.ini
- %UserProfile%\Start Menu\Programs\MalwareWar 7.3\MalwareWar 7.3 Website.lnk
- %UserProfile%\Start Menu\Programs\MalwareWar 7.3\MalwareWar 7.3.lnk
- %UserProfile%\Start Menu\Programs\MalwareWar 7.3\Uninstall MalwareWar 7.3.lnk
- %UserProfile%\Start Menu\MalwareWar 7.3.lnk
- %ProgramFiles%\MalwareWar 7.3\Lang\English.ini
- %ProgramFiles%\MalwareWar 7.3\MalwareWar 7.3.exe
- %ProgramFiles%\MalwareWar 7.3\MalwareWar 7.3.url
- %ProgramFiles%\MalwareWar 7.3\msvcp71.dll
- %ProgramFiles%\MalwareWar 7.3\msvcr71.dll
- %ProgramFiles%\MalwareWar 7.3\mwdb.dat
- %ProgramFiles%\MalwareWar 7.3\uninst.exe
Next, the program creates the following registry entry so that it executes whenever Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"MalwareWar 7.3" = "C:\Program Files\MalwareWar 7.3\MalwareWar 7.3.exe"
It also creates the following registry subkeys:
- HKEY_CLASSES_ROOT\AppID\MalwareWar.EXE
- HKEY_CLASSES_ROOT\AppID\{C291DEE7-D4B6-42d8-A016-302E6141D63B}
- HKEY_CLASSES_ROOT\CLSID\{13901470-5BCF-0EA6-A762-AD195455772B}
- HKEY_CLASSES_ROOT\Interface\{195EA874-7AD8-4BE2-A1D1-ADDFFDC66DCA}
- HKEY_CLASSES_ROOT\Interface\{2568D1BF-6D5E-4B17-81E5-7A97EF5D8F05}
- HKEY_CLASSES_ROOT\Interface\{2F9DB89F-7F95-4C69-B775-A0C6C01DACE1}
- HKEY_CLASSES_ROOT\Interface\{3CDB3874-DC96-4890-A786-4B6089E10980}
- HKEY_CLASSES_ROOT\Interface\{5C03DE51-7AB7-41FC-8D50-ECDF39BA2DC0}
- HKEY_CLASSES_ROOT\Interface\{5EFA24D1-944B-4ED8-99F1-2283F79E4136}
- HKEY_CLASSES_ROOT\Interface\{65605733-BE0B-445A-B221-3C82A6BB1EE0}
- HKEY_CLASSES_ROOT\Interface\{90E3F5BF-324B-433F-96C6-E272F2040D6B}
- HKEY_CLASSES_ROOT\Interface\{B3FC6AF3-D3F4-496F-B8BF-8373BACE33F1}
- HKEY_CLASSES_ROOT\Interface\{B6CB3B36-6134-45B8-83F0-6907B2538890}
- HKEY_CLASSES_ROOT\Interface\{B71726E1-CBFE-425D-8446-15B51F54E493}
- HKEY_CLASSES_ROOT\Interface\{C68F00CE-07D1-48AB-830E-D311D255C894}
- HKEY_CLASSES_ROOT\Interface\{C9605621-B932-4359-AB54-5D88EB56A2A3}
- HKEY_CLASSES_ROOT\Interface\{C9686C59-8568-40B1-9468-15446A529354}
- HKEY_CLASSES_ROOT\Interface\{DAFAF86D-9B59-48C1-895F-4FF84A794675}
- HKEY_CLASSES_ROOT\Interface\{E0394CFD-D54D-4826-932D-8379AB554882}
- HKEY_CLASSES_ROOT\TypeLib\{2108EBD7-160B-4C23-A99F-1F559DDD320A}
- HKEY_LOCAL_MACHINE\SOFTWARE\MalwareWar 7.3
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwareWar 7.3.exe 7.3
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwareWar
Similar Security Risks
MalwareWipe
5. Exit registry editor .
6.delete the IE temp files or you may download ATF temp files cleaner to run a full cleaning.and restart the computer.
8. Now you may remove MalwareWar successfully.
|
| howtoremoveInputer:admin Editor:admin |
| End Of The Article how to remove MalwareWar |
|
Back 个howtoremove:AntispyDeluxe
Next 个howtoremove: W32.Bancorkut@mm |
