Manual removal of Wintime.exe

Remove Manually Wintime.exe (Harnig Trojan)
wintime.exe is a virus which downloads other viruses, as well as terminates antivirus software. This virus also creates a phonebook entry, in which it tries to dial a high cost telephone number. This process is a security risk and should be removed from your system.
Harnig Trojan is likely a Trojan and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of wintime.exe may cause serious harm to your system and will likely cause a number of problems, loss of data, loss of control or leaking private information
Damage Level : Highly Dangerous
Distribution Level: High
There is NO Auto Removal Tool for Wintime.exe (Trojan.Downloader/Win32.Harnig Trojan)


Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal

• wintime.exe
• toolbar.exe
• tool[X].exe
• system.exe
• seksdialer.exe
• paytime.exe
• mstasks2.exe
• mstasks1.exe
• kl.exe
• dkdial.exe
• dial32.exe
• desktop.exe

If you have any of these files in running process from task manger, end the process before removal.
Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg
Killbox
KillBox is a tool to delete in-use files, if the file is running, KillBox will attempt to end the process (close the running file) and delete it.

Download KillBox
Download KillBox Beta
Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Download and run this UnHookExec.inf, and then continue with the removal.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\InternetSettings\

\TrustWarningLevel=NoSecurity
\Security_RunScripts=0x01000000
\Security_RunActiveXControls=0x01000000
\SafetyWarningLevel=SucceedSilent
\MinLevel=CodeDownload
\TrustWarningLevel=NoSecurity
\Security_RunScripts=0x01000000
\Security_RunActiveXControls=0x01000000
\SafetyWarningLevel=SucceedSilent
\MinLevel=CodeDownload
\0A323FA1-38DE-44EC-B2FA-4002183C143E

\Trust Warning Level=No Security
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wintime
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet\Settings

Trust Warning Level=No Security
Security_RunScripts=0x01000000
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet\Settings
Security_RunActiveXControls=0x01000000
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet\Settings

Safety Warning Level=SucceedSilent
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet\Settings

MinLevel=Code Download

HKEY_CLASSES_ROOT\CLSID{0A323FA1-38DE-44EC-B2FA-4002183C143E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell\Service\

ObjectDelayLoadSystem={0A323FA1-38DE-44EC-B2FA-4002183C143E}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

\wintime
Delete any of the above Process file listed here

Exit the Registry Editor,
Restart your Computer.

Search Registry For Virus File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

Recommended Removal Tools:
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)
Killbox (Freeware)