CGI Doctor - spyware removal help » Worms

Get rid of W32.Wergimog that lurks in Windir expecting to remain invisible for antivirus

admin — Wed, 28 Mar 2012 09:30:39 +0000

W32.Wergimog is a computer infection reported at the mid of March, 2012. The infection is a worm. That is, it has a capacity for replicating itself dropping its copies onto shared drives.
The worm tries to get its components installed into the following locations: System folder in Windows directory, and immediately into Windows directory. The worm tries to look like a legitimate system file. In spite of that the tricks it applies are rather obsolete, many security solutions give up performing removal of W32.Wergimog under the pretext of the damage that causes in case the detection is a false positive.
As matter of fact, the worm is clearly different from any common system driver or system file. Free scanner available here would experience no difficulties to remove W32.Wergimog covering its high precaution original locations in Windir, as well as its copies created elsewhere for the purpose of infecting other machines.

W32.Wergimog malware details:


Threat type: Worm Threat version: 2012 Country (state) of origin: EU, Russia Risk: Moderate

Signs of W32.Wergimog virus infection:

There may be no direct signs of the threat. Therefore, as soon as you have any ground to suspect the infection introduction, click here to check whether your apprehensions were true launching free scan in order to detect and remove W32.Wergimog, as well as other detected parasites.

W32.Wergimog automatical removal:

Contemporary malware has a habit of acting in groups. The threat considered in this post may have several threats assisting it and may be used as assistant to other infections, which is why complex malware removal is the best way to get rid of W32.Wergimog. In addition, if you remove it automatically, your PC will get a life-time armor against future malware introductions.

Remove Worm:Win32/Morto.A

admin — Mon, 14 Nov 2011 21:55:04 +0000

Worm:Win32/Morto.A is kind of rogue that mostly affects local network computers exploiting weakness of passwords and account names in user accounts. It is strongly recommended to have strong passwords and give preference to uncommon account names to prevent the rogue from capturing your PC. A captured PC immediately becomes a platform for further malware propagation. This is ensured by creating dll file recognized by Windows as its genuine file, which, according to the operating system instructions, is to be launched with Regedit. The trickery enables the rogue to start immediately on system loading.
The dll starts remote session by finding subnet computers, and then attempts to access their memory trying popular passwords and user names. Removal of Worm:Win32/Morto.A is thus a measure to be executed on local network level, if the captured PC belongs to any.
While running the adware establishes a communication link to remote attacker. The IP it connects to is not constant. The instructions it receives from the contacted attacker makes it ban selected applications and update itself. Actions it is programmed to do are not limited to the above though.
Click here to remove Worm:Win32/Morto.A and other pests without chance for most tricky rogues to escape detection and extermination regardless of the pranks they apply.

Worm:Win32/Morto.A malware details:

Threat type: Computer Worm

Threat version:2011

Country (state) of origin:Russian Federation

Risk: High

Signs of Worm:Win32/Morto.A infection:

Worm:Win32/Morto.A automatical removal:

Contemporary malware has a habit of acting in groups. The threat considered in this post may have several threats assisting it and may be used as assistant to other infections, which is why complex malware removal is the best way to get rid of Worm:Win32/Morto.A. In addition, if you remove it automatically, your PC will get a life-time armor against future malware introductions.

Remove Nav.exe virus

admin — Tue, 18 Oct 2011 08:33:01 +0000

Nav.exe, otherwise known as Nav virus, is a platform for misleading tools installed under the guise of Microsoft update. Naturally the program targets Windows computers.
It is also distributed by infection detected as RBOT-IV Worm.
The two methods are combined to efficiently spread copies of the malware.
In the course of the propagation of the worm and malicious executable, IRC backdoor is created. It is first used to introduce the exe infection, but then it does not cease to exist and is likely to be exploited by other cyber parasites. Click here to launch free scan in order to get rid of Nav.exe and its distributor (RBOT-IV Worm). The technology recommended for Nav.exe removal provides exhausting cleanup of computer memory and fix for backdoors created.

Nav.exe details:

Threat type: Malware, Computer worm

Threat version: 2011

Risk: Extreme

Signs of Nav.exe infection:

Nav.exe automatical removal:

Contemporary malware has a habit of acting in groups. The threat considered in this post may have several threats assisting it and may be used as assistant to other infections, which is why complex malware removal is the best way to get rid of Nav.exe. In addition, if you remove it automatically, your PC will get a life-time armor against future malware introductions.

Remove VirTool:Win32/Keylogger.A for data safety reasons

admin — Thu, 08 Sep 2011 14:25:38 +0000

VirTool:Win32/Keylogger.A is a data collecting infection targeting any kind of data entered from the keyboard at a compromised machine. It might be associated with cracking infection, which is activated, if passwords are entered, for security reasons, from virtual keyboard.
Not only banking information private to user only is subjected to the keylogger attacks. The keylogger might be used to collect information on user’s preferences, according to which the PC might be infected with relevant adware.
As a conclusion, VirTool:Win32/Keylogger.A removal itself seldom settles the issue as the spying malware is designed to cooperate with a host of complementary infections that make use of the data collected by the parasite. Click here to run free scan and get rid of VirTool:Win32/Keylogger.A, as well as other threats, including the infections that cooperate with the keylogger. Please take into account that the scanner suggested might detect the threat under alternate name.

VirTool:Win32/Keylogger.A details:


Threat type: Trojan horse, Threat version: 2011 Risk: Moderate

Signs of VirTool:Win32/Keylogger.A infection:

VirTool:Win32/Keylogger.A automatical removal:

Contemporary malware has a habit of acting in groups. The threat considered in this post may have several threats assisting it and may be used as assistant to other infections, which is why complex malware removal is the best way to get rid of VirTool:Win32/Keylogger.A. In addition, if you remove it automatically, your PC will get a life-time armor against future malware introductions.

Remove W32/Qbot

admin — Fri, 20 May 2011 14:28:32 +0000

W32/Qbot is not a program that adhere to system rules established for computer residents.
Its introduction is itself a violation of system rules that, as they should be originally understood, are equal for all programs, unless otherwise is claimed by user or by operating system developer on supplying the computer system.
However, the infection does not simply neglect rules of procedure established for a particular computer system. The bot infection developers know that the final goal is to conquer compromised machine and use it in a large-scale bot attacks on global networks, as well as in smaller scams.
Get rid of W32/Qbot to undo malevolent changes to system regulation caused by the rogue. Click here to execute W32/Qbot removal performing comprehensive system cleanup at once.

W32/Qbot details:


Threat type: Malware Threat version: 2011 Risk: High Country of origin: Russia

Signs of W32/Qbot infection:

W32/Qbot automatical removal:

Contemporary malware has a habit of acting in groups. The threat considered in this post may have several threats assisting it and may be used as assistant to other infections, which is why complex malware removal is the best way to get rid of W32/Qbot. In addition, if you remove it automatically, your PC will get a life-time armor against future malware introductions.

Remove Win32/Ptcasino

admin — Fri, 06 May 2011 21:46:48 +0000

Win32/Ptcasino is an online gambling related infection which is dropped through the vulnerabilities of online games websites and steal user’s private data.
Security tools alarm users of possible illegal actions taken through the remote server, if they display the above threat specific warning or include it into scan summary.
Being gambling related infection does not limit the virus payload to stealing info important for players of inline games only. Peculiarities of data exchange between website running online games enables to get extended access to a range of compromised by win32/Ptcasino computer and to retrieve various kind of info, turn the computer into spybot and much more.
The infection is usually spread via online card games such as pocker, but also can be transmitted otherwise.
Removal of win32/Ptcasino is recommended not for online gamers only. If you suspect the infection to be your resident, click here to start free scan and get rid of win32/Ptcasino or ensure your suspicions have been groundless.

Win32/Ptcasino details:


Threat type: Malware Threat version: 2011 Risk: High Country of origin: Russia

Signs of Win32/Ptcasino infection:

Win32/Ptcasino automatical removal:

Contemporary malware has a habit of acting in groups. The threat considered in this post may have several threats assisting it and may be used as assistant to other infections, which is why complex malware removal is the best way to get rid of Win32/Ptcasino. In addition, if you remove it automatically, your PC will get a life-time armor against future malware introductions.

Remove WORM/Slenfbot.DP.5

admin — Fri, 06 May 2011 19:26:07 +0000

WORM/Slenfbot.DP.5 removal seems to be an everlasting topic for some security tools. In the meantime, the said tools are not counterfeits. At least, so far there is no fake antivirus tool which refer to the worm in its reports. That is, the detection of the threat actually happens, and happens recurrently. Then, WORM/Slenfbot.DP.5 removal is reported to be successfully completed – but, alas, in a while a user is notified of the same detection and recommended to get rid of WORM/Slenfbot.DP.5.
With some outdated security tools, the worm simply performs a kind of a rare mockery as it enables it to detect its dummy copies, which are intentionally made out of the date. However, essentials of the worm are properly concealed and invisible for outdated security tools so that they propagate freely and execute the worm’s payload. The payload is to provide permanent online control over infected machine for remote hackers, or, in IT terms, to make a bot of a compromised machine.
Once its dummy files are deleted by such security tools, the worm provides new dummies for immediate or postponed detection. Perhaps, the mockery is not just for fun as repeated detection of one and same infection induces users to remove WORM/Slenfbot.DP.5 detectors due to their annoying behaviors.
Click here to run free scan and detect and delete WORM/Slenfbot.DP.5, with all its dummy and essential components covered. Needless to say, that will be a one time ultimate fix for the issue.

WORM/Slenfbot.DP.5 details:


Threat type: Malware, Worm Threat version: 2011 Risk: High Country of origin: Russia

Signs of WORM/Slenfbot.DP.5 infection:

WORM/Slenfbot.DP.5 automatical removal:

Contemporary malware has a habit of acting in groups. The threat considered in this post may have several threats assisting it and may be used as assistant to other infections, which is why complex malware removal is the best way to get rid of WORM/Slenfbot.DP.5. In addition, if you remove it automatically, your PC will get a life-time armor against future malware introductions.

IM-Worm.Win32.Kelvir.k Removal Guide

admin — Tue, 26 Apr 2011 15:42:10 +0000

The variable payload infection is a worm. That is, it comes onto computer system crawling via instant messengers, primarily using Windows Messenger.
The workflow of the scam implies delivery to the users of attacked PC of a massage that contains url related to the worm. The url is a link that downloads the worm instantly on its activation. IM-Worm.Win32.Kelvir.k sends the message itself from computer systems which instant messenger is captured.
Removal of IM-Worm.Win32.Kelvir.k is usually to be performed in one move with W32/Rbot-Fam removal, as the worm drops the above infection.
Click here to run free scan and get rid of IM-Worm.Win32.Kelvir.k, as well as other threats resulted from its payload.

IM-Worm.Win32.Kelvir.k details:


Threat type: Malware, Worm Threat version: 2011 Risk: High Country of origin: Europe

Signs of IM-Worm.Win32.Kelvir.k infection:

IM-Worm.Win32.Kelvir.k automatical removal:

Contemporary malware has a habit of acting in groups. The threat considered in this post may have several threats assisting it and may be used as assistant to other infections, which is why complex malware removal is the best way to get rid of IM-Worm.Win32.Kelvir.k. In addition, if you remove it automatically, your PC will get a life-time armor against future malware introductions.

Remove Worm:Win32/Ainslot.A

admin — Tue, 29 Mar 2011 17:08:09 +0000

Worm:Win32/Ainslot.A is a self-propagating infection that multiplies its copies through removable and network drives and is capable of reaching several computers from a single shared location.
By its follow-up activities on compromised computers it is classified as a browser hijacker because of its influence on web-browser. In particular, the worm tries to exclude its associated record from the Firewall list of program unauthorized to administrate web-browser. If it succeeds, the browser will start receiving commands from the worm and will download other malware and unwanted websites on request.
The list of tasks assigned to the worm is subject to modifications by its authors and therefore is not limited to browser hijacking.
Click here to get rid of Worm:Win32/Ainslot.A on completing free scan; Worm:Win32/Ainslot.A removal in the above suggested way also covers malicious objects downloaded by browser captured by the worm.

Worm:Win32/Ainslot.A details:


Threat type: Trojan horse, Malware Threat version: 2010 Risk: High Country of origin: Russian Federation

Signs of Worm:Win32/Ainslot.A infection:

Worm:Win32/Ainslot.A automatical removal:

Contemporary malware has a habit of acting in groups. The threat considered in this post may have several threats assisting it and may be used as assistant to other infections, which is why complex malware removal is the best way to get rid of Worm:Win32/Ainslot.A . In addition, if you remove it automatically, your PC will get a life-time armor against future malware introductions.

Remove W32.Spyrat

admin — Sun, 23 Jan 2011 21:35:37 +0000

W32.Spyrat is a rogue program that provides unlimited administrator’s powers to the attacker that spreads the infection. It is dropped itself by means of related toolkit that also assigns unique identifier to infected PC so that hackers could recognize it, if necessary. If you need to get rid of W32.Spyrat after the infection has stayed at your PC for considerable period of time (in IT terms it is no less than a few hours) there are undoubtedly other threats to exterminate as the worm would drop at least several threats in that case.
Removal of W32.Spyrat and any other threat, including infections dropped by the worm, needs to executed on free scan basis. The free SpywareDoctor scanner is ready for download here.

W32.Spyrat details:


Threat type: Trojan horse, Malware Threat version: 2011 Risk: High Country of origin: EU

Signs of W32.Spyrat infection:

Once you have noted any strange changes in your computer system behavior, it might be the infection’s impact. This threat intentionally customizes system settings and adds new values to the system registry. Such measures allow it launching automatically as your system is warming up.
There may be no direct signs of the threat. Therefore, as soon as you have any ground to suspect the infection introduction, click here to check whether your apprehensions were true launching free scan in order to detect and remove W32.Spyrat, as well as other detected parasites.

W32.Spyrat automatical removal:

Contemporary malware has a habit of acting in groups. The threat considered in this post may have several threats assisting it and may be used as assistant to other infections, which is why complex malware removal is the best way to get rid of W32.Spyrat. In addition, if you remove it automatically, your PC will get a life-time armor against future malware introductions.