CrossKirk manual removal:
Kill processes:
ddialer.exe, kernel32.exe, menf[X].exe, od-asia[X].exe, od-stdn[X].exe, od-teen[X].exe, st-hc[X].exe, tlk[X].exe, sexgay.gif
Delete registry values:HKEY_CURRENT_USER\Software\Webdialer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\tlk[X].exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Webdialer_li-[filename]
Delete files:ddialer.exe, kernel32.exe, menf[X].exe, od-asia[X].exe, od-stdn[X].exe, od-teen[X].exe, st-hc[X].exe, tlk[X].exe, sexgay.gif
Delete directories:C:\Program Files\Webdialer
Misc:[X] is a set of random digits and symbols.
The sexgay.gif file despite the .gif extension is not an image, but an executable that installs the dialer.
CrossKirk uses numerous files with random names.
Post Comment: