How to Remove Microsoft
Analysis:
Type of file: exefile
Description:
Location: C:\WINDOWS\Microsoft\
Size: 3911179 b
MD5: 089D11B01A4C81EDEAB6C582D297D2E9
Attributes: Archive, Hidden, System, Read-Only
File Version: 1.00.0003
Company: By: Morgan Haueisen
Copyright: Copyright (c) 2003
Product Name: USA Quiz
Product Version: 1.00.0003
Original File Name: New.exe
Trademarks:
Internal Name: New
Comments:
Disables Registry Editor
Known system changes:
C:\Documents and Settings\Owner\Application Data\logs.dat
C:\Documents and Settings\Owner\Local Settings\Temp\UuU.uUu
C:\Documents and Settings\Owner\Local Settings\Temp\XxX.xXx
C:\WINDOWS\Microsoft\Microsoft.exe
C:\Documents and Settings\All Users\Application Data\TEMP
C:\WINDOWS\Microsoft
HKLM\SOFTWARE\Classes\CLSID\{24AA3079-047E-4182-047E-4182047E4182}
HKLM\SOFTWARE\Classes\CLSID\{24AA3079-047E-4182-047E-4182047E4182}\Implemented Categories
HKLM\SOFTWARE\Classes\CLSID\{24AA3079-047E-4182-047E-4182047E4182}\Implemented Categories\{00021492-0000-0000-C000-000000000046}
HKLM\SOFTWARE\Classes\CLSID\{24AA3079-047E-4182-047E-4182047E4182}\InProcServer32
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{FHC6186D-X430-3B61-3HFS-4K1554TSXEV6}
HKLM\SOFTWARE\Licenses
HKCU\Software\nagato
HKLM\SOFTWARE\Classes\CLSID\{24AA3079-047E-4182-047E-4182047E4182}\: "&Links"
HKLM\SOFTWARE\Classes\CLSID\{24AA3079-047E-4182-047E-4182047E4182}\MenuTextPUI: "@browselc.dll,-13138"
HKLM\SOFTWARE\Classes\CLSID\{24AA3079-047E-4182-047E-4182047E4182}\InProcServer32\: "%SystemRoot%\system32\SHELL32.dll"
HKLM\SOFTWARE\Classes\CLSID\{24AA3079-047E-4182-047E-4182047E4182}\InProcServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Microsoft\Active
Setup\Installed
Components\{FHC6186D-X430-3B61-3HFS-4K1554TSXEV6}\StubPath:
"C:\WINDOWS\Microsoft\Microsoft.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\Policies: "C:\WINDOWS\Microsoft\Microsoft.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System32: "C:\WINDOWS\Microsoft\Microsoft.exe"
HKLM\SOFTWARE\Licenses\{K7C0DB872A3F777C0}: random data
HKLM\SOFTWARE\Licenses\{I054347D90A928356}: 06 00 00 00
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies: "C:\WINDOWS\Microsoft\Microsoft.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\System: "C:\WINDOWS\Microsoft\Microsoft.exe"
HKCU\Software\nagato\FirstExecution: "31/08/2014 -- 12:24"
HKCU\Software\nagato\NewIdentification: "nagato"
Visit WinXPert's BubbleWS Page
Manual Removal Instructions for Microsoft:
If your computer does not have an up-to-date antivirus, or
does not have an antivirus solution at all, follow the instructions
below to delete the malicious program:
Make sure you create a System Restore point before proceeding:
1. Download Kill_Microsoft.bat and copy it to your Startup folder
2. Log-off
and log-on. The batch file will run in an endless loop. Allow it to
run for a few second until no more Microsoft.exe processes are being
terminated.
3. Delete the following files.
del "%appdata%\\logs.dat" /f
del "%\Temp%\UuU.uUu" /f
del "%Temp%\XxX.xXx" /f
del "%windir%\Microsoft\Microsoft.exe" /f
4. Repair the system registry using the following commands.
reg delete "HKLM\SOFTWARE\Classes\CLSID\{24AA3079-047E-4182-047E-4182047E4182}" /f
reg delete "HKLM\SOFTWARE\Licenses" /f
reg delete "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{FHC6186D-X430-3B61-3HFS-4K1554TSXEV6}" /f
reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /f
reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System32" /f
reg delete "HKCU\SOFTWARE\nagato" /f
5. Delete the following folder. Clean your temps using TFC or CCleaner
rd "%WINDIR%\Microsoft" /s /q
6. Update your antivirus/antimalware program and perform a full scan of the computer.
All content ("Information") contained in this report is the
copyrighted work of WinXPert: Virus and Malware Removal.
The Information is provided on an "as is" basis. WinXPert
disclaims all warranties, whether express or implied, to the maximum
extent permitted by law, including the implied warranties that the
Information is merchantable, of satisfactory quality, accurate, fit for
a particular purpose or need, or non-infringing, unless such implied
warranties are legally incapable of exclusion. Further, WinXPert does
not warrant or make any representations regarding the use or the
results of the use of the Information in terms of their correctness,
accuracy, reliability, or otherwise.
Copyright © 2014 WinXPert. All rights reserved. All other
trademarks are the sole property of their respective owners.
