Manual removal of xxx.exe

xxx.exe (W32.Bropia)
xxx.exe is registered as a downloader. This process usually comes bundled with a virus or spyware and its main role is to do nothing other than download other viruses/spyware to your computer. This process is a security risk and should be removed from your system.
Damage Level : Highly Dangerous
Distribution Level: Medium
Download Auto Removal Tool for xxx.exe (W32 Bropia)
Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal

• %System%\msnadp32.exe
• %System%\adaware.exe
• %System%\VB6.EXE
• %System%\lexplore.exe
• %System%\Win32.exe
• %System%\xxx.exe

The worm also uses P2P networks to spread. It copies itself to the shared directory of numerous P2P applications using the following file names:
Adult ID Check.exe, Aim Flooder.exe, Aim Hacker.exe, AIMHacks.exe, Anarchist CookBook.exe, AVPDVDRip.mpg.exe, BF1942FULL.exe, BFVietnam.exe, BigBoobs.exe, BigBoobsXXX.exe, Britney XXX.exe, broadband wizard.exe, cable accelerator.exe, cable uncapper.exe, CallofDutyFULL.exe, CoolGames.exe, Cool_Games.exe, CounterStrike.exe, CounterStrikeSOURCE.exe, CounterStrikeSourceFULL.exe, Cracker Game.exe, Cracks Collections.Exe, Credit Card.exe, Delphi6 Keygen.exe, DOOM3_FULL.exe, DownLoad Accelerator Plus.exe, Dreamcast BootDisc.exe, Dropitlikeitzhot.exe, DVDRipper.exe, Easy CD Creator 5.exe, email hacker.exe, exeeenSaver.exe, F-ProtAV-Full.exe, FBISecretDocuments.exe, FTP Commander.exe, Ftp Cracker.exe, Ftp Hacker.exe, FuckedHARDXXX.exe, Gladiator (Movie) - Full Downloader.exe, GTAViceCity.exe, Hacker Kit.exe, Hacker.exe, HackingWebpage.exe, HackingWindowsXP.exe, HackingXP.exe, HalfLife2FULL+Crack.exe, HalfLife2FULL.exe, Halflife2KeyGen.exe, HalfLife2_FULL.exe, Hotmail Account Hacker.exe, Hotmail Hack.exe, Hotmail Hacker.exe, Hotmail Password Cracker.exe, HotmailHackerKit.exe, How-to-Hack.exe, HowtoHack.exe, Icq Ad Remover.exe, Icq Banner Remover.exe, ICQ Hack.exe, icq hacker.exe, icq ip patch.exe, Ident Faker.exe, Ident Spoofer.exe, IE6 Final.exe, InDaClub.exe, irc flooder.exe, IRobotDVDRip.mpg.exe, Jasc Paint Shop Pro 7 (Full).exe, JeniferLopezNUDE.exe, Johnny English (Movie) - Full Downloader.exe, Kazaa ad remover.exe, LanGuard NetScan.exe, Linux RootKit.exe, Matrix Reloaded.exe, McafeeAntiVirus.exe, MedalofHonorPacificAssultFULL.exe, Microsoft Office Full.exe, MiddleSchoolPornXXX.exe, Mirc6 Full.exe, mirc6 keygen.exe, Mp3 Maker Pro.exe, mp3 to wav full.exe, Msn Hacker.exe, MSN Messenger Password Stealer.exe, MS_Frontpage.exe, NeroBurningRom 6.exe, Norton AntiVirus Full.exe, Norton Keygen-All Vers.exe, NortonAntirVirus2005FULL.exe, NortonAntiVirus2005FULL.exe, NortonPersonalFirewallFULL.exe, NudeCheerleaders.exe, OfficeXP sp2 express.exe, PasswordCrackers.exe, PCChillen.exe, pE packer.exe, Peck.exe, PhotoShopCS8.0_Crack.exe, PipeBombTutorial.exe, PreTeenBlowJob.exe, PreTeenSEX.exe, PreTeenXXX.exe, PS1 BootDisc.exe, PS2 BootDisc.exe, PSXCopy Full.exe, Salford.exe, Serials 2k.exe, Serials Collections.exe, SexyChickXXXHarcore.exe, SexyTeen.exe, Simpsons.exe, SluttyCheerleaders.exe, SohposAntiVirusFULL.exe, Sopohs_Anti_Virus.exe, SpywareKiller.exe, SteelCap.exe, StylesXP.exe, Sub7 Master Password.exe, Sub7 Remover.exe, SwordFish (Movie) - Full Downloader.exe, SxyTeenagePorn.exe, SxyTeenageSEX.exe, SxyTeenFuckedHARD.exe, SxyTeenGetsItuptheASS.exe, TeenSexHardcore.exe, Trillian Patcher.exe, Trillian Pro Full.exe, Trojan Remover.exe, uin2ip.exe, VS.Net Patcher.exe, Wadle.exe, WallPapersXXX.exe, webpage hacker.exe, WebpageHackingTools.exe, WebRootSpySweeper.exe, Westdene.exe, Win Proxy.exe, Win Shares Cracker.exe, Win-RAR-FULL+CRACK.exe, Win-RAR-FULL.exe, Win98 Hacker.exe, WinXP Keygen.exe, WinXPHacking.exe, www hacker kit.exe, XPHackes.exe, xxx exeeensaver.exe, XXX Virtual Sex.exe, XXXCollection.exe, XXXHighSchoolSluts.exe, XXXMagaPack.exe, XXXTeenSexXXX.exe, XXXWallpaperCollection.exe, Yahoo Hacker.exe, Zip_RAR_PWCracker.exe, ZoneAlarm Pro Full.exe, ZoneAlarm.exe


If you have any of these files in running process from task manger, end the process before removal.
Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg


Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Download and run this UnHookExec.inf, and then continue with the removal.

HKEY_USERS\S-1-5-21-1482476501-162531612-839522115-1003\Software\Microsoft\OLE

WinPWD Manager="pwmgr.exe"
HKEY_USERS\S-1-5-21-1482476501-162531612-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run
WinPWD Manager="pwmgr.exe"
HKEY_USERS\S-1-5-21-1482476501-162531612-839522115-1003\Software\Microsoft\Windows\CurrentVersion\RunServices
WinPWD Manager="pwmgr.exe"
HKEY_USERS\S-1-5-21-1482476501-162531612-839522115-1003\SYSTEM\CurrentControlSet\Control\Lsa

WinPWD Manager="pwmgr.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole

WinPWD Manager="pwmgr.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

WinPWD Manager="pwmgr.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

WinPWD Manager="pwmgr.exe"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa

WinPWD Manager="pwmgr.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

WinPWD Manager="pwmgr.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\Software\Microsoft\OLE
In the right pane, delete the value:
"win32" = "winhost.exe"

Exit the Registry Editor,
Restart your Computer.

Search Registry For Virus File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

Recommended Removal Tools:
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)
Killbox (Freeware)

Manual removal of Wupdt.exe

Wupdt.exe (Backdoor Trojan)
wupdt.exe is added to the system as a result of the IMISERV virus. It is a backdoor Trojan used to control a target computer from a remote location. This process is a security risk and should be removed from your system. If found on your system make sure that you have downloaded the latest update for your antivirus application.
Damage Level : High
Distribution Level: Medium 
There is NO Auto Removal Tool for Wupdt.exe (Adware.IEPlugin/Backdoor)
Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal

• %Windir%\Winobject.dll
• %Windir%\Winserv.exe
• %Windir%\Wupdt.exe
• %Windir%\Systb.dll
• %Windir%\Kw.dat
• %Windir%\Toserver.pst
• %Windir%\Lu.dat
• %Windir%\Extract.exe
• %Windir%\Button0.ico
• %Windir%\Button1.ico
• %Windir%\Button2.ico
• %Windir%\Logo.ico
• %Windir%\pxckdlauninstall.exe
• %Windir%\dsr.dll
• %Windir%\dinst.exe

If you have any of these files in running process from task manger, end the process before removal.
Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg
To un-register the .dll Files
Click Start, and then click Run.
Type, or copy and paste, the following text:

regsvr32 /u winobject.dll
then click OK.
If a dialog box confirming this action appears, click OK.

regsvr32 /u systb.dll
then click OK.
If a dialog box confirming this action appears, click OK.

Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Download and run this UnHookExec.inf, and then continue with the removal.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
In the right pane, delete the following values if found:

"Win Server Updt" = "%WinDir%\[DROPPED ADWARE FILE]"
"Win Server" = "%WinDir%\winserv.exe"
"wdskctl" = "C:\Windows\wdskctl.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs
In the right pane, delete the following values if found:

"C:\WINDOWS\wupdt.exe" = ""
"C:\WINNT\wupdt.exe" = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar

HKEY_CURRENT_USER\SOFTWARE\Microsoft\SearchAssistant
In the right pane, delete the following value if found:
 

"DefaultSearchURL" = "[http://]websearch.drsnsrch.com/[REMOVED]/q.cgi?="
 

In the right pane, delete the following values if found:

"{2CDE1A7D-A478-4291-BF31-E1B4C16F92EB}" = ""
"{69135BDE-5FDC-4B61-98AA-82AD2091BCCC}" = ""

Delete the following registry subkeys if they are present:

HKEY_CLASSES_ROOT\CLSID\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}
HKEY_CLASSES_ROOT\CLSID\{1C896551-8B92-4907-8C06-15DB2D1F874A}
HKEY_CLASSES_ROOT\CLSID\{D36F70B1-7DF5-4FD4-A765-70CCC8F72CD7}
HKEY_CLASSES_ROOT\CLSID\{E2BF1BF3-1FDB-4C93-8874-0B09E71C594C}
HKEY_CLASSES_ROOT\CLSID\{F3155057-4C2C-4078-8576-50486693FD49}
HKEY_CLASSES_ROOT\CLSID\{69135BDE-5FDC-4B61-98AA-82AD2091BCCC}
HKEY_CLASSES_ROOT\CLSID\{00F1D395-4744-40F0-A611-980F61AE2C59}
HKEY_CLASSES_ROOT\CLSID\{8B51FC2F-C687-40A3-B54A-BB9EBF8D407F}
HKEY_CLASSES_ROOT\CLSID\{CE27D4DF-714B-4427-95EB-923FE53ADF8E}
HKEY_CLASSES_ROOT\CLSID\{E2D2FE40-5674-4B77-802B-EC86B6C2C41D}
HKEY_CLASSES_ROOT\CLSID\{E311D3A5-4A3B-4E49-9E0A-B40FAE1F0B28}
HKEY_CLASSES_ROOT\Interface\{F9B9C9A3-9D2D-423D-ABA5-80D83A915023}
HKEY_CLASSES_ROOT\Interface\{220959EA-B54C-4201-8DF2-1CFAC8B59FD7}
HKEY_CLASSES_ROOT\Interface\{3E589169-86AD-44FE-B426-F0BF105D5582}
HKEY_CLASSES_ROOT\Interface\{6A288140-3E1C-4CD9-AAC5-E20FDD4F5D64}
HKEY_CLASSES_ROOT\Interface\{7371AD3F-C419-4DC0-8E8A-E21FAFAD53E0}
HKEY_CLASSES_ROOT\Interface\{98B2DDBA-6DA2-4421-AF2B-814E98F53649}
HKEY_CLASSES_ROOT\Interface\{E4458B4A-6149-4450-84F2-864ADB7E8C52}
HKEY_CLASSES_ROOT\Interface\{0667935E-6350-4BF3-9F97-952363D87C1F}
HKEY_CLASSES_ROOT\Interface\{0F72A081-4DCA-4288-970E-2F7DBBF8B54C}
HKEY_CLASSES_ROOT\Interface\{7092C637-9298-4ACD-8E4D-E7C8157ABDCC}
HKEY_CLASSES_ROOT\Interface\{C43CB2BC-DE30-4FDA-B982-9312ED9940F6}
HKEY_CLASSES_ROOT\Interface\{D2378491-228B-4398-A041-8967952E79EF}
HKEY_CLASSES_ROOT\Interface\{F8084C00-5E03-4B9F-8846-EFE24334C44A}
HKEY_CLASSES_ROOT\TypeLib\{57ADD57B-173E-418A-8F70-17E5C9F2BCC9}
HKEY_CLASSES_ROOT\Typelib\{58D419E8-1321-4DD2-A6FC-7B41C14DCD79}
HKEY_CLASSES_ROOT\TypeLib\{8F73AC0F-5769-4282-8762-B396A3BFF377}
HKEY_CLASSES_ROOT\Wbho.Band.1
HKEY_CLASSES_ROOT\Wbho.Band
HKEY_CLASSES_ROOT\IMIToolbar.imiTool
HKEY_CLASSES_ROOT\IMIToolbar.imiTool.1
HKEY_CLASSES_ROOT\IMIToolbar.PopupBrowser.1
HKEY_CLASSES_ROOT\IMIToolbar.PopupBrowser
HKEY_CLASSES_ROOT\IMIToolbar.LeftFrame.1
HKEY_CLASSES_ROOT\IMIToolbar.LeftFrame
HKEY_CLASSES_ROOT\IMIToolbar.BottomFrame.1
HKEY_CLASSES_ROOT\IMIToolbar.BottomFrame
HKEY_CLASSES_ROOT\IMIToolbar.PopupWindow.1
HKEY_CLASSES_ROOT\IMIToolbar.PopupWindow
HKEY_CLASSES_ROOT\DSrch.Band
HKEY_CLASSES_ROOT\DSrch.Band.1
HKEY_CLASSES_ROOT\DSrch.PopupBrowser.1
HKEY_CLASSES_ROOT\DSrch.PopupBrowser
HKEY_CLASSES_ROOT\DSrch.LeftFrame.1
HKEY_CLASSES_ROOT\DSrch.LeftFrame
HKEY_CLASSES_ROOT\DSrch.BottomFrame.1
HKEY_CLASSES_ROOT\DSrch.BottomFrame
HKEY_CLASSES_ROOT\DSrch.PopupWindow.1
HKEY_CLASSES_ROOT\DSrch.PopupWindow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
\Browser Helper Objects\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
\Browser Helper Objects\{00F1D395-4744-40F0-A611-980F61AE2C59}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
\Browser Helper Objects\{69135BDE-5FDC-4B61-98AA-82AD2091BCCC}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
Uninstall\Upspiral Desktop Search
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
\Uninstall\intexp
HKEY_CURRENT_USER\Software\intexp
HKEY_CURRENT_USER\Software\inst
HKEY_CURRENT_USER\Software\dsktb
HKEY_CURRENT_USER\Software\dsrch
HKEY_CURRENT_USER\Software\Classes\Remove
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{666E4D35-E955-11D0-A707-000000521958}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions
\{A80F2DB2-80A9-4834-8F5A-4AB70F4EF4C3}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage
\C:/WINDOWS/wupdt.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage
\C:/WINNT/wupdt.exe

HKEY_CLASSES_ROOT\clsid\{f3155057-4c2c-4078-8576-50486693fd49}\inprocserver32 c:\windows\systb.dll

Exit the Registry Editor,
Restart your Computer.

Search Registry For Virus File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

Recommended Removal Tools:
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)
Killbox (Freeware)

Manual removal of Wmon32.exe

Wmon32.exe (GAOBOT.BAJ/W32.Agobot-IT Trojan)
wmon32.exe is a process which is registered as the W32.Agobot-IT Trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. This process is a security risk and should be removed from your system. W32/Agobot-BT is a network worm which also allows unauthorised remote access to the computer via IRC channels.W32/Agobot-BT copies itself to network shares with weak passwords and attempts to spread to computers using the DCOM RPC and the RPC locator vulnerabilities.
Damage Level : High
Distribution Level: Medium
Download Auto Removal Tool for Wmon32.exe (WORM_FALSU.A/Spybot.Eas worm)
Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal

• %WinDir%\wmon32.exe
  
• %System32%\wmon32.exe
  

If you have any of these files in running process from task manger, end the process before removal.
Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg


Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Download and run this UnHookExec.inf, and then continue with the removal.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
Svrchost = "wmon32.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Svrchost = "wmon32.exe"

Exit the Registry Editor,
Restart your Computer.

Search Registry For Virus File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

Recommended Removal Tools:
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)
Killbox (Freeware)

Manual removal of Winxp.exe

Remove Manually Winxp.exe (W32.Beagle)
winxp.exe is a process which is registered as W32.Beagle.AG@mm. This virus is distributed via the Internet through e-mail and comes in the form of an e-mail message, in the hopes that you open its hostile attachment. The worm has its own SMTP engine which means it gathers E-mails from your local computer and re-distributes itself. In worst cases this worm can allow attackers to access your computer, stealing passwords and personal data. This process is a security risk and should be removed from your system.
Damage Level : High
Distribution Level: Medium
Read Removal of W32.Beagle #1
Read Removal of W32.Beagle #2
There is NO Auto Removal Tool for Winxp.exe (W32.Beagle)
Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal

• winxp.exe
  

If you have any of these files in running process from task manger, end the process before removal.
Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg

Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Download and run this UnHookExec.inf, and then continue with the removal.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

In the right panel, locate and delete the entry:

"%System%\winxp.exe"

Exit the Registry Editor,
Restart your Computer.

Search Registry For Virus File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

Recommended Removal Tools:
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)
Killbox (Freeware)

Manual removal of Winupdate.exe

Remove Manually Winupdate.exe (WORM_FALSU.A/Spybot.Eas worm)
winupdate.exe is added to the system as a result of the WORM_FALSU.A virus. It is a backdoor Trojan horse and gives remote access to your computer. This process is a security risk and should be removed from your system. If found on your system make sure that you have downloaded the latest update for your antivirus application.
Spybot.Eas Worm is likely a virus and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of winupdate.exe may cause serious harm to your system and will likely cause a number of problems, such as slow performance, loss of data or leaking private information to websites.
Damage Level : High
Distribution Level: Unknown
There is NO Auto Removal Tool for Winupdate.exe (WORM_FALSU.A/Spybot.Eas worm)


Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal

• %\system32\winupdate.exe
• %\Documents and Settings\All Users\Documents\winupdate.exe
• %\shared\winupdate.exe
• %\windows\system32\winupdate.exe
• %\winnt\system32\winupdate.exe
• %\winupdate.exe
• IPC%\winupdate.exe
• PRINT%\winupdate.exe
• %Windir%\WinExec.exe
• %\system32\con.exe
  

If you have any of these files in running process from task manger, end the process before removal.
Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg 
Killbox
KillBox is a tool to delete in-use files, if the file is running, KillBox will attempt to end the process (close the running file) and delete it.

Download KillBox
Download KillBox Beta
Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Download and run this UnHookExec.inf, and then continue with the removal.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

In the right pane, delete the value:

"winupdate.reg" = "winupdate.exe"
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\con.exe
In the left hand pane, delete the key
con.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
In the right pane, delete the value:
"WinExec" = "%Windir%\WinExec.exe"

HKEY_CURRENT_USER\Software\Kazaa\LocalContent
In the right pane, restore the values to their original value, if applicable:
"DisableSharing" = "0"
"dir0" = "012345:%Windir%\shared"
"dir1" = "012345:%Windir%\shared"
"dir2" = "012345:%Windir%\shared"
"dir3" = "012345:%Windir%\shared"
"dir4" = "012345:%Windir%\shared"
"dir5" = "012345:C:\"

HKEY_CURRENT_USER\Software\KAZAA\ResultsFilter
In the right pane, restore the values to their original value, if applicable:
"virus_filter" = "0"
"firewall_filter" = "0"

Exit the Registry Editor,
Restart your Computer.

Search Registry For Virus File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

Recommended Removal Tools:
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)
Killbox (Freeware)

Manual removal of Wintime.exe

Remove Manually Wintime.exe (Harnig Trojan)
wintime.exe is a virus which downloads other viruses, as well as terminates antivirus software. This virus also creates a phonebook entry, in which it tries to dial a high cost telephone number. This process is a security risk and should be removed from your system.
Harnig Trojan is likely a Trojan and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of wintime.exe may cause serious harm to your system and will likely cause a number of problems, loss of data, loss of control or leaking private information
Damage Level : Highly Dangerous
Distribution Level: High
There is NO Auto Removal Tool for Wintime.exe (Trojan.Downloader/Win32.Harnig Trojan)


Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal

• wintime.exe
• toolbar.exe
• tool[X].exe
• system.exe
• seksdialer.exe
• paytime.exe
• mstasks2.exe
• mstasks1.exe
• kl.exe
• dkdial.exe
• dial32.exe
• desktop.exe

If you have any of these files in running process from task manger, end the process before removal.
Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg
Killbox
KillBox is a tool to delete in-use files, if the file is running, KillBox will attempt to end the process (close the running file) and delete it.

Download KillBox
Download KillBox Beta
Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Download and run this UnHookExec.inf, and then continue with the removal.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\InternetSettings\

\TrustWarningLevel=NoSecurity
\Security_RunScripts=0x01000000
\Security_RunActiveXControls=0x01000000
\SafetyWarningLevel=SucceedSilent
\MinLevel=CodeDownload
\TrustWarningLevel=NoSecurity
\Security_RunScripts=0x01000000
\Security_RunActiveXControls=0x01000000
\SafetyWarningLevel=SucceedSilent
\MinLevel=CodeDownload
\0A323FA1-38DE-44EC-B2FA-4002183C143E

\Trust Warning Level=No Security
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wintime
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet\Settings

Trust Warning Level=No Security
Security_RunScripts=0x01000000
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet\Settings
Security_RunActiveXControls=0x01000000
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet\Settings

Safety Warning Level=SucceedSilent
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet\Settings

MinLevel=Code Download

HKEY_CLASSES_ROOT\CLSID{0A323FA1-38DE-44EC-B2FA-4002183C143E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell\Service\

ObjectDelayLoadSystem={0A323FA1-38DE-44EC-B2FA-4002183C143E}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

\wintime
Delete any of the above Process file listed here

Exit the Registry Editor,
Restart your Computer.

Search Registry For Virus File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

Recommended Removal Tools:
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)
Killbox (Freeware)