Remove Wombat

What is Wombat and removal instructions

Wombat is a dangerous trojan that corrupts the infected system. Once executed, it secretly installs itself to the system and runs a payload. The parasite attempts to terminate and then cripple installed antiviruses and security-related programs. It also attempts to delete vital Windows files and folders, and thus destroy the entire system. Furthermore, Wombat disables essential system tools, functions and components such as Registry Editor, Task Manager, CD Burning and Windows Firewall. It can shutdown the compromised computer without asking for user permission. The trojan runs on every Windows startup. Sooner or later Wobmat will destroy the system preventing it from booting and working properly.

Wombat manual removal:

Kill processes:
deltree.exe, popup.exe, terminate.exe, wupdmgr.exe, 222.exe
Delete registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mike3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mixed1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mixed2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mixed3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\terminate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\twitch
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall=0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions=0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\DisableRegistryTools=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCDBurning=1
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window Title=UNLUCKY
Delete files:
deltree.exe, popup.exe, terminate.exe, wupdmgr.exe, 222.exe, internet.bat, bt[X].bat, temp.bat, tweaks.reg
Misc:
[X] is a combination of random digits.

File location (may vary):
bt[X].bat - C:\Windows\Temp or C:\Winnt\Temp
terminate.exe, 222.exe, internet.bat - C:\Windows\mui or C:\Winnt\mui
deltree.exe, temp.bat - C:\Windows\System, C:\Windows\System32 or C:\Winnt\System32

Related Spyware Removal

Previous: Womble Next: Wollf

| 1-9 | O | P | Q | R | S | T | U | V | W | X | Y | N | M | L | A | B | C | D | E | F | G | H | I | J | K | Z