wmon32.exe is a process which is registered as the W32.Agobot-IT Trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. This process is a security risk and should be removed from your system. W32/Agobot-BT is a network worm which also allows unauthorised remote access to the computer via IRC channels.W32/Agobot-BT copies itself to network shares with weak passwords and attempts to spread to computers using the DCOM RPC and the RPC locator vulnerabilities.
Damage Level : High
Distribution Level: Medium
Download Auto Removal Tool for Wmon32.exe (WORM_FALSU.A/Spybot.Eas worm)
Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal
- %WinDir%\wmon32.exe
- %System32%\wmon32.exe
Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg
Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Download and run this UnHookExec.inf, and then continue with the removal.
Svrchost = "wmon32.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Svrchost = "wmon32.exe"
Exit the Registry Editor,
Restart your Computer.
Search Registry For Virus File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.
Recommended Removal Tools:Edit Menu - Find, enter Keyword and remove all value that find in search.
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)
Killbox (Freeware)
No comments :
Post a Comment
Comment on this Post!!