Manual Removal Guide for WebWatcher

The following instructions have been created to help you to get rid of "WebWatcher" manually.
Use this guide at your own risk; software should usually be better suited to remove malware, since it is able to look deeper.

If this guide was helpful to you, please consider donating towards this site.

Threat Details:

Categories:

• spyware

Description:

WebWatcher

Privacy Statement:

STEVE KARAS AND ASSOCIATES. SOFTWARE LICENSE AGREEMENT

WebWatcher SOFTWARE

IMPORTANT! The enclosed software is licensed only on the condition that the licensee (referred to in this Agreement as "YOU") agrees with STEVE KARAS AND ASSOCIATES. (referred to in this Agreement as "SKA") to the terms and conditions set forth in the following legal
agreement. READ THIS SOFTWARE LICENSE AGREEMENT CAREFULLY. YOU WILL BE BOUND BY THE TERMS OF THIS AGREEMENT IF YOU OPEN THE SEALED PACKAGE or INSTALL THIS SOFTWARE. If You do not agree to the terms contained in this Software License Agreement, please return this package UNOPENED to your dealer and your license fee will be refunded.

SKA will grant You a nontransferable, nonexclusive license to use the enclosed software (the "Licensed Software") and the accompanying documentation (the Licensed Software, the media embodying the Licensed Software, and the documentation are referred to in this Agreement as the "Licensed Materials"), if You agree to the following terms and conditions:

1. TERM; TERMINATION

This Agreement is effective from the date on which You open the package containing the Licensed Materials. This Agreement may be terminated by You at any time by destroying the Licensed Materials, together with all copies. It will also terminate automatically without notice if You fail to comply with any term or condition of this Agreement.

2. LICENSE GRANT

SKA grants to You the right to use the Licensed Software in conjunction with a single Computer (hereinafter "SYSTEM") as noted herein. YOU MAY NOT USE, COPY, MODIFY, OR TRANSFER THE LICENSED MATERIALS, IN WHOLE OR IN PART, EXCEPT AS PROVIDED IN THIS AGREEMENT.

3. OWNERSHIP

The Licensed Materials are the sole and exclusive property of SKA.

4. COPY RESTRICTIONS

You may make one (1) copy of the Licensed Software for backup purposes. In no event does the copying permitted under this Agreement include the right to decompile, disassemble, or electronically transfer the Licensed Software, or to translate the Licensed Software into another computer language. You may not copy the documentation.

You agree to include the copyright notice set forth on the label of the media and embodied in the Licensed Software on any copy of the Licensed Software in any form, in whole or in part.

5. PROTECTION AND SECURITY

You agree to use your best efforts and take all reasonable steps to safeguard the Licensed Materials to ensure that no unauthorized person shall have access thereto and that no unauthorized copy, publication, disclosure or distribution, in whole or in part, in any form shall be made. You acknowledge that the Licensed materials contain valuable, confidential information and trade secrets and that unauthorized use and/or copying are harmful to SKA.

6. DUTY TO BACKUP DATA

IT IS YOUR RESPONSIBILITY TO MAINTAIN PERIODIC BACKUP COPIES OF ALL DATA AND PROGRAMS USED IN CONJUNCTION WITH THE LICENSED SOFTWARE TO PREVENT CATASTROPHIC LOSS.

7. LIMITED WARRANTY

The only warranty SKA makes to You in connection with the Licensed Materials is that the media on which the Licensed Software is recorded will be replaced without charge, if SKA in good faith determines that it was defective and not subject to misuse, and if the media and proof of purchase of the SYSTEM are returned to SKA or the dealer from whom it was obtained within ninety (90) days of the date of purchase. Because SKA cannot know the purposes for which You acquired the SYSTEM or the uses to which You will put the SYSTEM or the Licensed Software, You assume full responsibility for the selection of the SYSTEM and Licensed Software and for their installation and use and the results of that use.

8. WARRANTY DISCLAIMERS; LIABILITY LIMITATIONS

SKA MAKES NO WARRANTY OR REPRESENTATION WITH RESPECT TO THE LICENSED SOFTWARE AND IT IS LICENSED "AS IS." THE WARRANTY AND REMEDY PROVIDED ABOVE ARE EXCLUSIVE AND IN LIEU OF ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, AND ANY STATEMENTS OR REPRESENTATIONS MADE BY ANY OTHER PERSON OR FIRM ARE VOID.

YOU AGREE NOT TO USE THE LICENSED SOFTWARE IN ANY SITUATION WHERE SIGNIFICANT DAMAGE OR INJURY TO PERSONS, PROPERTY OR BUSINESS COULD OCCUR FROM A SOFTWARE ERROR.

YOU ASSUME ALL RISK AS TO THE SELECTION, USE, PERFORMANCE AND QUALITY OF THE LICENSED MATERIALS. IN NO EVENT WILL SKA OR ANY OTHER PARTY WHO HAS BEEN INVOLVED IN THE CREATION, PRODUCTION OR DELIVERY OF THE LICENSED MATERIALS BE LIABLE FOR SPECIAL, DIRECT, INDIRECT, INCIDENTAL OR CONSEQUENTIAL DAMAGES, INCLUDING LOSS OF PROFITS OR INABILITY TO USE THE LICENSED MATERIALS, EVEN IF SIU OR SUCH OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES IN NO EVENT SHALL SKA'S OR SUCH OTHER PARTY'S LIABILITY FOR ANY DAMAGES OR LOSS TO YOU OR ANY OTHER PARTY EXCEED THE PURCHASE PRICE PAID FOR THE SYSTEM CONTAINING THESE LICENSED MATERIALS.

Some states and/or countries do not allow limitations on how long an implied warranty lasts and some states and/or countries do not allow the exclusion or limitation of incidental or consequential damages, so the above limitation and exclusion may not apply to you. This warranty gives you specific legal rights, and you may also have other rights which vary from state to state and/or country to country.

9. GENERAL

If any provision or portion of a provision of this Agreement is determined to be invalid or unenforceable, it shall be deemed omitted and the remaining provisions of this Agreement shall remain in full force and effect.

This Agreement is governed by and construed in accordance with the laws of the State of Arizona. Any suit brought with respect to this Agreement may be brought ONLY in Maracopa County, Arizona USA and must be filed no later than one (1) year after the purchase date of the System or subsequent software upgrade.

This Agreement constitutes the entire agreement between the parties with respect to the subject matter hereof, and all prior agreements, representations, statements and undertakings are hereby expressly canceled.

Should you have any questions regarding this Agreement, you may contact SKA by certified mail at the address listed in this Software License Agreement.

10. U.S. GOVERNMENT RESTRICTED RIGHTS

The Licensed Materials are provided with RESTRICTED RIGHTS. The use, duplication, or disclosure by the Government is subject to restrictions as set forth in subdivision (c)(1)(ii) of The Rights in Technical Data and Computer Software clause at 52.227-7013. The contractor/ manufacturer of this Software is Steve Kras and Associates, 3341 E Turquoise, Phoenix, Arizona 85028 USA.

Removal Instructions:

Files:

Please use Windows Explorer or another file manager of your choice to locate and delete these files.

• The file at "<$SYSDIR>\config\atww\Application".
• The file at "<$SYSDIR>\config\atww\category.xml".
• The file at "<$SYSDIR>\config\atww\ccp.dll".
• The file at "<$SYSDIR>\config\atww\Config.xml".
• The file at "<$SYSDIR>\config\atww\dprx.dll".
• The file at "<$SYSDIR>\config\atww\FileSystem".
• The file at "<$SYSDIR>\config\atww\FireFox".
• The file at "<$SYSDIR>\config\atww\FireFoxExt".
• The file at "<$SYSDIR>\config\atww\free.idx".
• The file at "<$SYSDIR>\config\atww\Index".
• The file at "<$SYSDIR>\config\atww\mca.dll".
• The file at "<$SYSDIR>\config\atww\mck.dll".
• The file at "<$SYSDIR>\config\atww\mcmsg.dll".
• The file at "<$SYSDIR>\config\atww\mco.dll".
• The file at "<$SYSDIR>\config\atww\mcoexp.dll".
• The file at "<$SYSDIR>\config\atww\mcsc.dll".
• The file at "<$SYSDIR>\config\atww\Processes".
• The file at "<$SYSDIR>\config\atww\Registry".
• The file at "<$SYSDIR>\config\atww\Settings.xml".
• The file at "<$SYSDIR>\config\atww\ShellService.dll".
• The file at "<$SYSDIR>\config\atww\WebBrowser".
• The file at "<$SYSDIR>\config\atww\WebWatcher".
• The file at "<$SYSDIR>\config\atww\Yahoo".
• The file at "<$SYSDIR>\config\atww\avas\AVAS.exe".
• The file at "<$SYSDIR>\config\atww\avas\avas.xml".
• The file at "<$SYSDIR>\config\atww\avas\conflict.xml".

Make sure you set your file manager to display hidden and system files. If WebWatcher uses rootkit technologies, use our RootAlyzer or our Total Commander anti-rootkit plugins.
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify files!

Important: There are more files that cannot be safely described in simple words. Please use Spybot-S&D to remove them.

Folders:

Please use Windows Explorer or another file manager of your choice to locate and delete these folders.

• The directory at "<$SYSDIR>\config\atww".
• The directory at "<$SYSDIR>\config\atww\avas".
• The directory at "<$SYSDIR>\config\atww\Cache".

Make sure you set your file manager to display hidden and system files. If WebWatcher uses rootkit technologies, use our RootAlyzer or our Total Commander anti-rootkit plugins.
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify folders!

Registry:

You can use regedit.exe (included in Windows) to locate and delete these registry entries.

• A key in HKEY_CLASSES_ROOT\ named "AOLMonitorDGC.AOLMonitor", plus associated values.
• A key in HKEY_CLASSES_ROOT\ named "AOLMonitorDGC.AOLMonitor.1", plus associated values.
• Delete the registry key "{27B5E5C3-775A-4870-9BD3-B49694524CFD}" at "HKEY_CLASSES_ROOT\CLSID\".
• Delete the registry key "{2FF1ACE6-7599-4079-A70E-7E83B0267624}" at "HKEY_CLASSES_ROOT\CLSID\".
• Delete the registry key "{3C311150-55BF-4FBD-AFE0-7091E1D2D32B}" at "HKEY_CLASSES_ROOT\CLSID\".
• Delete the registry key "{45E922A0-0CD5-4A7B-BD35-44CA52B8390D}" at "HKEY_CLASSES_ROOT\CLSID\".
• Delete the registry key "{615EB7A2-E5F7-4500-80B7-9F1E72BEC678}" at "HKEY_CLASSES_ROOT\CLSID\".
• Delete the registry key "{67654448-42AD-4097-87AA-BAC1BFDA92B6}" at "HKEY_CLASSES_ROOT\CLSID\".
• Delete the registry key "{891CA317-EB89-4025-ABB8-0C1D1472E4E5}" at "HKEY_CLASSES_ROOT\CLSID\".
• Delete the registry key "{F8A0020A-2C78-47CD-AB7B-CE4181BE2628}" at "HKEY_CLASSES_ROOT\CLSID\".
• A key in HKEY_CLASSES_ROOT\ named "CommonCommandProcessor.CommandProcessor", plus associated values.
• A key in HKEY_CLASSES_ROOT\ named "CommonCommandProcessor.CommandProcessor.1", plus associated values.
• A key in HKEY_CLASSES_ROOT\ named "DataProxy.MonitorDataProxy", plus associated values.
• A key in HKEY_CLASSES_ROOT\ named "DataProxy.MonitorDataProxy.1", plus associated values.
• A key in HKEY_CLASSES_ROOT\ named "KeyLoggerDGC.KeyLogger", plus associated values.
• A key in HKEY_CLASSES_ROOT\ named "KeyLoggerDGC.KeyLogger.1", plus associated values.
• A key in HKEY_CLASSES_ROOT\ named "MSNMonitorDGC.MSNMonitor", plus associated values.
• A key in HKEY_CLASSES_ROOT\ named "MSNMonitorDGC.MSNMonitor.1", plus associated values.
• A key in HKEY_CLASSES_ROOT\ named "OutlookExpressDGC.OEMonitor", plus associated values.
• A key in HKEY_CLASSES_ROOT\ named "OutlookExpressDGC.OEMonitor.1", plus associated values.
• A key in HKEY_CLASSES_ROOT\ named "OutlookMonitorDGC.OutlookMonitor", plus associated values.
• A key in HKEY_CLASSES_ROOT\ named "OutlookMonitorDGC.OutlookMonitor.1", plus associated values.
• A key in HKEY_CLASSES_ROOT\ named "ScreenCaptureDGC.ScreenCapture", plus associated values.
• A key in HKEY_CLASSES_ROOT\ named "ScreenCaptureDGC.ScreenCapture.1", plus associated values.
• Delete the registry key "{16EB59FA-8710-430F-922D-67A8EFC74C18}" at "HKEY_CLASSES_ROOT\TypeLib\".
• Delete the registry key "{3222FE43-306C-4831-B46B-A157B2986DD0}" at "HKEY_CLASSES_ROOT\TypeLib\".
• Delete the registry key "{4AEDB174-8B9C-4DE7-8276-C7B60E0F6896}" at "HKEY_CLASSES_ROOT\TypeLib\".
• Delete the registry key "{682DC0F3-19A4-450A-97FF-EEEB81554ED5}" at "HKEY_CLASSES_ROOT\TypeLib\".
• Delete the registry key "{75BC0CC2-74B3-46A5-BDC5-2D311D479049}" at "HKEY_CLASSES_ROOT\TypeLib\".
• Delete the registry key "{77CADC3F-6244-44DD-96E9-C3D84C0686D1}" at "HKEY_CLASSES_ROOT\TypeLib\".
• Delete the registry key "{8C023226-642E-43D0-8D64-BD6E628CB012}" at "HKEY_CLASSES_ROOT\TypeLib\".
• Delete the registry key "{E9A68ED9-D34F-4F41-91ED-ACC4370DE537}" at "HKEY_CLASSES_ROOT\TypeLib\".

If WebWatcher uses rootkit technologies, use our RegAlyzer, RootAlyzer or our Total Commander anti-rootkit plugins.

Final Words:

If neither Spybot-S&D nor self help did resolve the issue or you would prefer one on one help,

1. Please read these instructions before requesting assistance,
2. Then start your own thread in the Malware Removal Forum where a volunteer analyst will advise you as soon as available.