Exploit Child Watchdog manual removal:
Kill processes:
ecwdinst.exe, eitcwd.exe, eitwmon.exe
Delete registry values:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15138B54-7EB6-11D0-9BB7-0000C0F04C96}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{396F7AC9-A0DD-11D3-93EC-00C0DFE7442A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{396F7AD1-A0DD-11D3-93EC-00C0DFE7442A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{396F7AD5-A0DD-11D3-93EC-00C0DFE7442A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{543749DC-8732-11D3-A204-0090275C8BC1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{543749E2-8732-11D3-A204-0090275C8BC1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{543749EA-8732-11D3-A204-0090275C8BC1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{608009F5-E1FB-11D2-9BA1-0040D0002C80}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{608009F8-E1FB-11D2-9BA1-0040D0002C80}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{60800A00-E1FB-11D2-9BA1-0040D0002C80}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{60800A02-E1FB-11D2-9BA1-0040D0002C80}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71A2702F-C7D8-11D2-BEF8-525400DFB47A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71A27032-C7D8-11D2-BEF8-525400DFB47A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71A27034-C7D8-11D2-BEF8-525400DFB47A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{15138B50-7EB6-11D0-9BB7-0000C0F04C96}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{15138B52-7EB6-11D0-9BB7-0000C0F04C96}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{15138B53-7EB6-11D0-9BB7-0000C0F04C96}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CB22240-89B8-11D0-9BC0-0000C0F04C96}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CB22242-89B8-11D0-9BC0-0000C0F04C96}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CB22245-89B8-11D0-9BC0-0000C0F04C96}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CB22247-89B8-11D0-9BC0-0000C0F04C96}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{396F7AC8-A0DD-11D3-93EC-00C0DFE7442A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{396F7ACE-A0DD-11D3-93EC-00C0DFE7442A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{396F7AD0-A0DD-11D3-93EC-00C0DFE7442A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{396F7AD4-A0DD-11D3-93EC-00C0DFE7442A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{543749DB-8732-11D3-A204-0090275C8BC1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{543749E1-8732-11D3-A204-0090275C8BC1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{543749E8-8732-11D3-A204-0090275C8BC1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{543749E9-8732-11D3-A204-0090275C8BC1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{608009F4-E1FB-11D2-9BA1-0040D0002C80}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{608009F6-E1FB-11D2-9BA1-0040D0002C80}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{608009F7-E1FB-11D2-9BA1-0040D0002C80}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{608009FF-E1FB-11D2-9BA1-0040D0002C80}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{60800A01-E1FB-11D2-9BA1-0040D0002C80}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B976285-3692-11D0-9B8A-0000C0F04C96}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B976287-3692-11D0-9B8A-0000C0F04C96}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{71A2702E-C7D8-11D2-BEF8-525400DFB47A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{71A27031-C7D8-11D2-BEF8-525400DFB47A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{71A27033-C7D8-11D2-BEF8-525400DFB47A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{71A27036-C7D8-11D2-BEF8-525400DFB47A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CDA1CA00-8B5D-11D0-9BC0-0000C0F04C96}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CDA1CA02-8B5D-11D0-9BC0-0000C0F04C96}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CDA1CA04-8B5D-11D0-9BC0-0000C0F04C96}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB61DB30-B032-11D0-A853-0000C02AC6DB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F94F4020-B035-11D0-A853-0000C02AC6DB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{15138B51-7EB6-11D0-9BB7-0000C0F04C96}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{396F7AC0-A0DD-11D3-93EC-00C0DFE7442A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{543749C9-8732-11D3-A204-0090275C8BC1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{608009F3-E1FB-11D2-9BA1-0040D0002C80}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{71A2702D-C7D8-11D2-BEF8-525400DFB47A}
HKEY_LOCAL_MACHINE\SOFTWARE\Nelco\6C34460953145150530E103348\6E3F5B0C41267C4B530D
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Exploit
HKEY_CURRENT_USER\Software\Exploit Information Technology Limited\CWD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Exploit Child Watchdog
Delete files:ecwdinst.exe, eitcwd.exe, eitwmon.exe
Delete directories:C:\Program Files\eitcwd