Friday
2008-12-01, 10:26
The following instructions have been created to help you to get rid of "MalwareBOT" manually.
Use this guide at your own risk; software should usually be better suited to remove malware, since it is able to look deeper.
If this guide was helpful to you, please consider donating towards this site (http://www.safer-networking.org/index.php?page=donate).
Threat Details:
Categories:
malware
Description:
MalwareBot claims to be a solution against all kinds of malware. When the user starts a scan, it finds some harmless cookies as high risk problems. MalwareBot is the same malicious program as SpywareBOT.
Removal Instructions:
Desktop:
Please remove the following files from your desktop.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.
Shortcuts named "MalwareBot.lnk" and pointing to "<$PROGRAMFILES>\MalwareBot\MalwareBot.exe".
Shortcuts named "MalwareBot.lnk" and pointing to "<$PROGRAMFILES>\MalwareBot\*.exe".
Shortcuts named "MalwareBot.lnk" and pointing to "<$PROGRAMFILES>\MalwareBot\*.exe".
Start Menu:
Please remove the following items from your start menu.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.
Items named "MalwareBot on the Web.lnk" and pointing to "<$PROGRAMFILES>\MalwareBot\MalwareBot.url".
Items named "MalwareBot.lnk" and pointing to "<$PROGRAMFILES>\MalwareBot\MalwareBot.exe".
Items named "MalwareBot.lnk" and pointing to "<$PROGRAMFILES>\MalwareBot\*.exe".
Items named "MalwareBot.lnk" and pointing to "<$PROGRAMFILES>\MalwareBot\*.exe".
Items named "Uninstall MalwareBot.lnk" and pointing to "<$PROGRAMFILES>\MalwareBot\unins000.exe".
Quicklaunch area:
Please remove the following items from your start quick launch area text to the "Start" button in the taskbar at the bottom.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.
Quicklaunch symbols named "MalwareBOT.lnk" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe".
Quicklaunch symbols named "MalwareBOT.lnk" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe".
Quicklaunch symbols named "MalwareBot.lnk" and pointing to "<$PROGRAMFILES>\MalwareBot\MalwareBot.exe".
Autorun:
Please use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd), RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer) or msconfig.exe to remove the following autorun entries.
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBot" and pointing to "<$PROGRAMFILES>\MalwareBot\MalwareBot.exe -boot".
Entries named "MalwareBot" and pointing to "<$PROGRAMFILES>\MalwareBot\*.exe".
Entries named "MalwareBot" and pointing to "<$PROGRAMFILES>\MalwareBot\*.exe".
Entries named "MalwareBot" and pointing to "<$PROGRAMFILES>\MalwareBot\*.exe".
Entries named "MalwareBot" and pointing to "<$PROGRAMFILES>\MalwareBot\*.exe".
Installed Software List:
You can try to uninstall products with the names listed below; for items identified by other properties or to avoid malware getting active again on uninstallation, use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) or RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer) to locate and get rid of these entries.
Products that have a key or property named "MalwareBOT_is1".
Products that have a key or property named "MalwareBot_is1".
Files:
Please use Windows Explorer or another file manager of your choice to locate and delete these files.
The file at "<$COMMONPROGRAMS>\MalwareBOT\MalwareBOT on the Web.lnk".
The file at "<$COMMONPROGRAMS>\MalwareBOT\MalwareBOT.lnk".
The file at "<$COMMONPROGRAMS>\MalwareBOT\Uninstall MalwareBOT.lnk".
The file at "<$APPDATA>\MalwareBOT\rs.dat".
The file at "<$APPDATA>\MalwareBOT\Settings\ScanResults.pie".
The file at "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe".
The file at "<$PROGRAMFILES>\MalwareBOT\Launcher.exe".
The file at "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.url".
The file at "<$PROGRAMFILES>\MalwareBOT\DataBase.ref".
The file at "<$PROGRAMFILES>\MalwareBOT\SpyCleaner.dll".
The file at "<$PROGRAMFILES>\MalwareBOT\TCL.dll".
The file at "<$PROGRAMFILES>\MalwareBOT\vistaCPtasks.xml".
The file at "<$PROGRAMFILES>\MalwareBOT\zlib.dll".
The file at "<$PROGRAMFILES>\MalwareBOT\AddOns\PostQuarantine.pie".
The file at "<$COMMONDESKTOP>\MalwareBOT.lnk".
The file at "<$WINDIR>\Tasks\MalwareBOT Scheduled Scan.job".
The file at "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.srv.exe".
The file at "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.dll".
The file at "<$PROGRAMFILES>\MalwareBOT\Scheduler.exe".
The file at "<$PROGRAMFILES>\MalwareBOT\FilterDrv\antispyfilter.amd64.sys".
The file at "<$PROGRAMFILES>\MalwareBOT\FilterDrv\antispyfilter.cat".
The file at "<$PROGRAMFILES>\MalwareBOT\FilterDrv\antispyfilter.inf".
The file at "<$PROGRAMFILES>\MalwareBOT\FilterDrv\antispyfilter.x86.sys".
The file at "<$PROGRAMFILES>\MalwareBOT\Databases\Spy.ref".
The file at "<$PROGRAMFILES>\MalwareBOT\license.txt".
The file at "<$COMMONPROGRAMS>\MalwareBOTApp\MalwareBOT on the Web.lnk".
The file at "<$COMMONPROGRAMS>\MalwareBOTApp\MalwareBOT.lnk".
The file at "<$COMMONPROGRAMS>\MalwareBOTApp\Uninstall MalwareBOT.lnk".
The file at "<$APPDATA>\MalwareBOTApp\rs.dat".
The file at "<$APPDATA>\MalwareBOTApp\Settings\ScanResults.pie".
The file at "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe".
The file at "<$PROGRAMFILES>\MalwareBOTApp\Launcher.exe".
The file at "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.url".
The file at "<$PROGRAMFILES>\MalwareBOTApp\DataBase.ref".
The file at "<$PROGRAMFILES>\MalwareBOTApp\SpyCleaner.dll".
The file at "<$PROGRAMFILES>\MalwareBOTApp\TCL.dll".
The file at "<$PROGRAMFILES>\MalwareBOTApp\vistaCPtasks.xml".
The file at "<$PROGRAMFILES>\MalwareBOTApp\zlib.dll".
The file at "<$PROGRAMFILES>\MalwareBOTApp\AddOns\PostQuarantine.pie".
The file at "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.srv.exe".
The file at "<$PROGRAMFILES>\MalwareBOTApp\Scheduler.exe".
The file at "<$PROGRAMFILES>\MalwareBOTApp\FilterDrv\antispyfilter.amd64.sys".
The file at "<$PROGRAMFILES>\MalwareBOTApp\FilterDrv\antispyfilter.cat".
The file at "<$PROGRAMFILES>\MalwareBOTApp\FilterDrv\antispyfilter.inf".
The file at "<$PROGRAMFILES>\MalwareBOTApp\FilterDrv\antispyfilter.x86.sys".
The file at "<$PROGRAMFILES>\MalwareBOTApp\Databases\Spy.ref".
The file at "<$PROGRAMFILES>\MalwareBOTApp\license.txt".
The file at "<$PROGRAMFILES>\MalwareBot\DataBase.ref".
The file at "<$PROGRAMFILES>\MalwareBot\DataBaseNew.ref".
The file at "<$PROGRAMFILES>\MalwareBot\Launcher.exe".
The file at "<$PROGRAMFILES>\MalwareBot\MalwareBot.dll".
The file at "<$PROGRAMFILES>\MalwareBot\MalwareBot.exe".
The file at "<$PROGRAMFILES>\MalwareBot\MalwareBot.url".
The file at "<$PROGRAMFILES>\MalwareBot\unins000.dat".
The file at "<$PROGRAMFILES>\MalwareBot\unins000.exe".
The file at "<$PROGRAMFILES>\MalwareBot\Settings\CustomScan.stg".
The file at "<$PROGRAMFILES>\MalwareBot\Settings\IgnoreList.stg".
The file at "<$PROGRAMFILES>\MalwareBot\Settings\ScanInfo.stg".
The file at "<$PROGRAMFILES>\MalwareBot\Settings\SelectedFolders.stg".
The file at "<$PROGRAMFILES>\MalwareBot\Settings\Settings.stg".
Make sure you set your file manager to display hidden and system files. If MalwareBOT uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify files!
Important: There are more files that cannot be safely described in simple words. Please use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) to remove them.
Folders:
Please use Windows Explorer or another file manager of your choice to locate and delete these folders.
The directory at "<$COMMONPROGRAMS>\MalwareBOT".
The directory at "<$APPDATA>\MalwareBOT".
The directory at "<$APPDATA>\MalwareBOT\Log".
The directory at "<$APPDATA>\MalwareBOT\Settings".
The directory at "<$PROGRAMFILES>\MalwareBOT".
The directory at "<$PROGRAMFILES>\MalwareBOT\MalwareBOT".
The directory at "<$PROGRAMFILES>\MalwareBOT\AddOns".
The directory at "<$PROGRAMFILES>\MalwareBOT\FilterDrv".
The directory at "<$PROGRAMFILES>\MalwareBOT\Databases".
The directory at "<$PROGRAMFILES>\MalwareBOT\Microsoft.VC80.ATL".
The directory at "<$PROGRAMFILES>\MalwareBOT\Microsoft.VC80.CRT".
The directory at "<$PROGRAMFILES>\MalwareBOT\Quarantine".
The directory at "<$PROGRAMFILES>\MalwareBOT\Registry Backups".
The directory at "<$PROGRAMFILES>\MalwareBOT\Settings".
The directory at "<$COMMONPROGRAMS>\MalwareBOTApp".
The directory at "<$APPDATA>\MalwareBOTApp".
The directory at "<$APPDATA>\MalwareBOTApp\Log".
The directory at "<$APPDATA>\MalwareBOTApp\Settings".
The directory at "<$PROGRAMFILES>\MalwareBOTApp".
The directory at "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT".
The directory at "<$PROGRAMFILES>\MalwareBOTApp\AddOns".
The directory at "<$PROGRAMFILES>\MalwareBOTApp\FilterDrv".
The directory at "<$PROGRAMFILES>\MalwareBOTApp\Databases".
The directory at "<$PROGRAMFILES>\MalwareBOTApp\Microsoft.VC80.ATL".
The directory at "<$PROGRAMFILES>\MalwareBOTApp\Microsoft.VC80.CRT".
The directory at "<$PROGRAMFILES>\MalwareBOTApp\Quarantine".
The directory at "<$PROGRAMFILES>\MalwareBOTApp\Registry Backups".
The directory at "<$PROGRAMFILES>\MalwareBOTApp\Settings".
The directory at "<$COMMONPROGRAMS>\MalwareBot".
The directory at "<$PROGRAMFILES>\MalwareBot".
The directory at "<$PROGRAMFILES>\MalwareBot\Log".
The directory at "<$PROGRAMFILES>\MalwareBot\Quarantine".
The directory at "<$PROGRAMFILES>\MalwareBot\Registry Backups".
The directory at "<$PROGRAMFILES>\MalwareBot\Settings".
Make sure you set your file manager to display hidden and system files. If MalwareBOT uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify folders!
Registry:
You can use regedit.exe (included in Windows) to locate and delete these registry entries.
Delete the registry key "MalwareBOT" at "HKEY_CURRENT_USER\Software\".
Delete the registry key "MalwareBOT" at "HKEY_LOCAL_MACHINE\Software\".
Delete the registry value "<$PROGRAMS>\MalwareBOT\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOT\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOT\FilterDrv\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOT\AddOns\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOT\Databases\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOT\Microsoft.VC80.ATL\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOT\Microsoft.VC80.CRT\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMS>\MalwareBOTApp\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOTApp\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOTApp\FilterDrv\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOTApp\AddOns\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOTApp\Databases\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOTApp\Microsoft.VC80.ATL\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOTApp\Microsoft.VC80.CRT\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry key "MalwareBot" at "HKEY_CURRENT_USER\Software\".
If MalwareBOT uses rootkit technologies, use our RegAlyzer (http://www.safer-networking.org/index.php?page=regalyzer), RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
Final Words:
If neither Spybot-S&D nor self help did resolve the issue or you would prefer one on one help,
Please read these instructions (http://forums.spybot.info/showthread.php?t=288) before requesting assistance,
Then start your own thread in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) where a volunteer analyst will advise you as soon as available.
Use this guide at your own risk; software should usually be better suited to remove malware, since it is able to look deeper.
If this guide was helpful to you, please consider donating towards this site (http://www.safer-networking.org/index.php?page=donate).
Threat Details:
Categories:
malware
Description:
MalwareBot claims to be a solution against all kinds of malware. When the user starts a scan, it finds some harmless cookies as high risk problems. MalwareBot is the same malicious program as SpywareBOT.
Removal Instructions:
Desktop:
Please remove the following files from your desktop.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.
Shortcuts named "MalwareBot.lnk" and pointing to "<$PROGRAMFILES>\MalwareBot\MalwareBot.exe".
Shortcuts named "MalwareBot.lnk" and pointing to "<$PROGRAMFILES>\MalwareBot\*.exe".
Shortcuts named "MalwareBot.lnk" and pointing to "<$PROGRAMFILES>\MalwareBot\*.exe".
Start Menu:
Please remove the following items from your start menu.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.
Items named "MalwareBot on the Web.lnk" and pointing to "<$PROGRAMFILES>\MalwareBot\MalwareBot.url".
Items named "MalwareBot.lnk" and pointing to "<$PROGRAMFILES>\MalwareBot\MalwareBot.exe".
Items named "MalwareBot.lnk" and pointing to "<$PROGRAMFILES>\MalwareBot\*.exe".
Items named "MalwareBot.lnk" and pointing to "<$PROGRAMFILES>\MalwareBot\*.exe".
Items named "Uninstall MalwareBot.lnk" and pointing to "<$PROGRAMFILES>\MalwareBot\unins000.exe".
Quicklaunch area:
Please remove the following items from your start quick launch area text to the "Start" button in the taskbar at the bottom.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.
Quicklaunch symbols named "MalwareBOT.lnk" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe".
Quicklaunch symbols named "MalwareBOT.lnk" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe".
Quicklaunch symbols named "MalwareBot.lnk" and pointing to "<$PROGRAMFILES>\MalwareBot\MalwareBot.exe".
Autorun:
Please use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd), RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer) or msconfig.exe to remove the following autorun entries.
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBOT" and pointing to "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe*".
Entries named "MalwareBot" and pointing to "<$PROGRAMFILES>\MalwareBot\MalwareBot.exe -boot".
Entries named "MalwareBot" and pointing to "<$PROGRAMFILES>\MalwareBot\*.exe".
Entries named "MalwareBot" and pointing to "<$PROGRAMFILES>\MalwareBot\*.exe".
Entries named "MalwareBot" and pointing to "<$PROGRAMFILES>\MalwareBot\*.exe".
Entries named "MalwareBot" and pointing to "<$PROGRAMFILES>\MalwareBot\*.exe".
Installed Software List:
You can try to uninstall products with the names listed below; for items identified by other properties or to avoid malware getting active again on uninstallation, use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) or RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer) to locate and get rid of these entries.
Products that have a key or property named "MalwareBOT_is1".
Products that have a key or property named "MalwareBot_is1".
Files:
Please use Windows Explorer or another file manager of your choice to locate and delete these files.
The file at "<$COMMONPROGRAMS>\MalwareBOT\MalwareBOT on the Web.lnk".
The file at "<$COMMONPROGRAMS>\MalwareBOT\MalwareBOT.lnk".
The file at "<$COMMONPROGRAMS>\MalwareBOT\Uninstall MalwareBOT.lnk".
The file at "<$APPDATA>\MalwareBOT\rs.dat".
The file at "<$APPDATA>\MalwareBOT\Settings\ScanResults.pie".
The file at "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.exe".
The file at "<$PROGRAMFILES>\MalwareBOT\Launcher.exe".
The file at "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.url".
The file at "<$PROGRAMFILES>\MalwareBOT\DataBase.ref".
The file at "<$PROGRAMFILES>\MalwareBOT\SpyCleaner.dll".
The file at "<$PROGRAMFILES>\MalwareBOT\TCL.dll".
The file at "<$PROGRAMFILES>\MalwareBOT\vistaCPtasks.xml".
The file at "<$PROGRAMFILES>\MalwareBOT\zlib.dll".
The file at "<$PROGRAMFILES>\MalwareBOT\AddOns\PostQuarantine.pie".
The file at "<$COMMONDESKTOP>\MalwareBOT.lnk".
The file at "<$WINDIR>\Tasks\MalwareBOT Scheduled Scan.job".
The file at "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.srv.exe".
The file at "<$PROGRAMFILES>\MalwareBOT\MalwareBOT.dll".
The file at "<$PROGRAMFILES>\MalwareBOT\Scheduler.exe".
The file at "<$PROGRAMFILES>\MalwareBOT\FilterDrv\antispyfilter.amd64.sys".
The file at "<$PROGRAMFILES>\MalwareBOT\FilterDrv\antispyfilter.cat".
The file at "<$PROGRAMFILES>\MalwareBOT\FilterDrv\antispyfilter.inf".
The file at "<$PROGRAMFILES>\MalwareBOT\FilterDrv\antispyfilter.x86.sys".
The file at "<$PROGRAMFILES>\MalwareBOT\Databases\Spy.ref".
The file at "<$PROGRAMFILES>\MalwareBOT\license.txt".
The file at "<$COMMONPROGRAMS>\MalwareBOTApp\MalwareBOT on the Web.lnk".
The file at "<$COMMONPROGRAMS>\MalwareBOTApp\MalwareBOT.lnk".
The file at "<$COMMONPROGRAMS>\MalwareBOTApp\Uninstall MalwareBOT.lnk".
The file at "<$APPDATA>\MalwareBOTApp\rs.dat".
The file at "<$APPDATA>\MalwareBOTApp\Settings\ScanResults.pie".
The file at "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.exe".
The file at "<$PROGRAMFILES>\MalwareBOTApp\Launcher.exe".
The file at "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.url".
The file at "<$PROGRAMFILES>\MalwareBOTApp\DataBase.ref".
The file at "<$PROGRAMFILES>\MalwareBOTApp\SpyCleaner.dll".
The file at "<$PROGRAMFILES>\MalwareBOTApp\TCL.dll".
The file at "<$PROGRAMFILES>\MalwareBOTApp\vistaCPtasks.xml".
The file at "<$PROGRAMFILES>\MalwareBOTApp\zlib.dll".
The file at "<$PROGRAMFILES>\MalwareBOTApp\AddOns\PostQuarantine.pie".
The file at "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT.srv.exe".
The file at "<$PROGRAMFILES>\MalwareBOTApp\Scheduler.exe".
The file at "<$PROGRAMFILES>\MalwareBOTApp\FilterDrv\antispyfilter.amd64.sys".
The file at "<$PROGRAMFILES>\MalwareBOTApp\FilterDrv\antispyfilter.cat".
The file at "<$PROGRAMFILES>\MalwareBOTApp\FilterDrv\antispyfilter.inf".
The file at "<$PROGRAMFILES>\MalwareBOTApp\FilterDrv\antispyfilter.x86.sys".
The file at "<$PROGRAMFILES>\MalwareBOTApp\Databases\Spy.ref".
The file at "<$PROGRAMFILES>\MalwareBOTApp\license.txt".
The file at "<$PROGRAMFILES>\MalwareBot\DataBase.ref".
The file at "<$PROGRAMFILES>\MalwareBot\DataBaseNew.ref".
The file at "<$PROGRAMFILES>\MalwareBot\Launcher.exe".
The file at "<$PROGRAMFILES>\MalwareBot\MalwareBot.dll".
The file at "<$PROGRAMFILES>\MalwareBot\MalwareBot.exe".
The file at "<$PROGRAMFILES>\MalwareBot\MalwareBot.url".
The file at "<$PROGRAMFILES>\MalwareBot\unins000.dat".
The file at "<$PROGRAMFILES>\MalwareBot\unins000.exe".
The file at "<$PROGRAMFILES>\MalwareBot\Settings\CustomScan.stg".
The file at "<$PROGRAMFILES>\MalwareBot\Settings\IgnoreList.stg".
The file at "<$PROGRAMFILES>\MalwareBot\Settings\ScanInfo.stg".
The file at "<$PROGRAMFILES>\MalwareBot\Settings\SelectedFolders.stg".
The file at "<$PROGRAMFILES>\MalwareBot\Settings\Settings.stg".
Make sure you set your file manager to display hidden and system files. If MalwareBOT uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify files!
Important: There are more files that cannot be safely described in simple words. Please use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) to remove them.
Folders:
Please use Windows Explorer or another file manager of your choice to locate and delete these folders.
The directory at "<$COMMONPROGRAMS>\MalwareBOT".
The directory at "<$APPDATA>\MalwareBOT".
The directory at "<$APPDATA>\MalwareBOT\Log".
The directory at "<$APPDATA>\MalwareBOT\Settings".
The directory at "<$PROGRAMFILES>\MalwareBOT".
The directory at "<$PROGRAMFILES>\MalwareBOT\MalwareBOT".
The directory at "<$PROGRAMFILES>\MalwareBOT\AddOns".
The directory at "<$PROGRAMFILES>\MalwareBOT\FilterDrv".
The directory at "<$PROGRAMFILES>\MalwareBOT\Databases".
The directory at "<$PROGRAMFILES>\MalwareBOT\Microsoft.VC80.ATL".
The directory at "<$PROGRAMFILES>\MalwareBOT\Microsoft.VC80.CRT".
The directory at "<$PROGRAMFILES>\MalwareBOT\Quarantine".
The directory at "<$PROGRAMFILES>\MalwareBOT\Registry Backups".
The directory at "<$PROGRAMFILES>\MalwareBOT\Settings".
The directory at "<$COMMONPROGRAMS>\MalwareBOTApp".
The directory at "<$APPDATA>\MalwareBOTApp".
The directory at "<$APPDATA>\MalwareBOTApp\Log".
The directory at "<$APPDATA>\MalwareBOTApp\Settings".
The directory at "<$PROGRAMFILES>\MalwareBOTApp".
The directory at "<$PROGRAMFILES>\MalwareBOTApp\MalwareBOT".
The directory at "<$PROGRAMFILES>\MalwareBOTApp\AddOns".
The directory at "<$PROGRAMFILES>\MalwareBOTApp\FilterDrv".
The directory at "<$PROGRAMFILES>\MalwareBOTApp\Databases".
The directory at "<$PROGRAMFILES>\MalwareBOTApp\Microsoft.VC80.ATL".
The directory at "<$PROGRAMFILES>\MalwareBOTApp\Microsoft.VC80.CRT".
The directory at "<$PROGRAMFILES>\MalwareBOTApp\Quarantine".
The directory at "<$PROGRAMFILES>\MalwareBOTApp\Registry Backups".
The directory at "<$PROGRAMFILES>\MalwareBOTApp\Settings".
The directory at "<$COMMONPROGRAMS>\MalwareBot".
The directory at "<$PROGRAMFILES>\MalwareBot".
The directory at "<$PROGRAMFILES>\MalwareBot\Log".
The directory at "<$PROGRAMFILES>\MalwareBot\Quarantine".
The directory at "<$PROGRAMFILES>\MalwareBot\Registry Backups".
The directory at "<$PROGRAMFILES>\MalwareBot\Settings".
Make sure you set your file manager to display hidden and system files. If MalwareBOT uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify folders!
Registry:
You can use regedit.exe (included in Windows) to locate and delete these registry entries.
Delete the registry key "MalwareBOT" at "HKEY_CURRENT_USER\Software\".
Delete the registry key "MalwareBOT" at "HKEY_LOCAL_MACHINE\Software\".
Delete the registry value "<$PROGRAMS>\MalwareBOT\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOT\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOT\FilterDrv\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOT\AddOns\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOT\Databases\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOT\Microsoft.VC80.ATL\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOT\Microsoft.VC80.CRT\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMS>\MalwareBOTApp\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOTApp\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOTApp\FilterDrv\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOTApp\AddOns\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOTApp\Databases\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOTApp\Microsoft.VC80.ATL\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry value "<$PROGRAMFILES>\MalwareBOTApp\Microsoft.VC80.CRT\" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\".
Delete the registry key "MalwareBot" at "HKEY_CURRENT_USER\Software\".
If MalwareBOT uses rootkit technologies, use our RegAlyzer (http://www.safer-networking.org/index.php?page=regalyzer), RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
Final Words:
If neither Spybot-S&D nor self help did resolve the issue or you would prefer one on one help,
Please read these instructions (http://forums.spybot.info/showthread.php?t=288) before requesting assistance,
Then start your own thread in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) where a volunteer analyst will advise you as soon as available.