When installed, Wolfram Antivirus creates a plain autorun registry entry to run a file called csrss.exe every time Windows starts. Please do not confuse it with the legitimate one which resides in C:\Windows\System32\csrss.exe. The Trojan file then loads the main Wolfram Antivirus executable Wolfram Antivirus.exe. Rogue AV typical behavior, once active, to display fake security alerts as show below and to mimic antivirus system scan. It then reports six non-existent infections that can be removed only with registered version of this software.
Windows Security AlertThe fake scan is super quick and this fake antivirus doesn't even bother to mix up found infections a little bit. It reports the same infections on every compromised machine. What is more, Wolfram Anti Virus blocks legitimate programs and displays the following error message:
To help protect your computer, Windows Firewall has blocked some features of this program.
Do you want to keep blocking this program?
Zeus Trojan
Security warning:
The file C:\WINDOWS\regedit.exe is infected.
Running of application is impossible.
It blocks legitimate antivirus products and on-demand malware scanners as well. Last, but not least, this rogue security program configures Windows operating system to use a proxy server. That means, the rogue program can redirect youto various misleading and malicious websites while surfing the Web or even restrict access to certain websites, for example security related ones.
If you can't use your web browser or and run your favorite malware scanner, you can activate the rogue program by entering this registration code: DB038748-B4659586-4A1071AF-32E768CD-36005B1B-F4520642-3000BF2A-04FC910B. Once this is done, you are free to install anti-malware software and remove the rogue anti-virus program from your computer properly. To remove Wolfram Antivirus and related malware from your computer, please follow the removal instructions below. If you need help removing this scareware from your computer or you have additional questions, please leave a comment below. Good luck and be safe online!
Wolfram Antivirus removal instructions:
1. Reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm
NOTE: Login as the same user you were previously logged in with in the normal Windows mode.
2. Launch Internet Explorer. In Internet Explorer go to: Tools->Internet Options->Connections tab. Click Lan Settings button and uncheck the checkbox labeled Use a proxy server for your LAN. Click OK. You may have to repeat steps 1-2 if you will have problems downloading malware removal programs.
3. Download free anti-malware software from the list below and run a full system scan.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.
Alternate Wolfram Antivirus removal instructions:
1. Go to Start → Run or press WinKey+R. Type in "command" and press Enter key.
2. In the command prompt window type "notepad". Notepad will come up.
3. Copy all the text in blue color below and paste into Notepad.
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"
4. Save file as regfix.reg to your Desktop. NOTE: (Save as type: All files)
regfix.reg is available for download here, in case you can't make your own or it doesn't work.
5. Double-click on regfix.reg file to run it. Click "Yes" for Registry Editor prompt window. Then click OK.
6. Download free anti-malware software from the list below and run a full system scan.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe, explorer.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.
7. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.
Associated Wolfram Antivirus files and registry values:
Files:
Windows XP:
- C:\Documents and Settings\[UserName]\Application Data\Wolfram Antivirus\Wolfram Antivirus.exe
- C:\Documents and Settings\[UserName]\Application Data\Wolfram Antivirus\csrss.exe
- C:\Documents and Settings\[UserName]\Application Data\Wolfram Antivirus\wf.conf
- C:\Users\[UserName]\AppData\Roaming\Wolfram Antivirus\Wolfram Antivirus.exe
- C:\Users\[UserName]\AppData\Roaming\Wolfram Antivirus\csrss.exe
- C:\Users\[UserName]\AppData\Roaming\Wolfram Antivirus\wf.conf
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows "load"="%Temp%\csrss.exe"
No comments:
Post a Comment