Hawawi manual removal:
Kill processes:
explore.exe, media player.exe, sys32.exe
Delete registry values:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ioadqm
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explore
Delete files:explore.exe, media player.exe, sys32.exe, hawawi.pif, hawa.pif, smtpmailer.dll, smtp.ocx
Misc:The parasite may install files with random names.
hawawi.pif and hawa.pif are typical filenames of infected e-mail attachments.
Most Hawawi files can be found in the default system directory C:\Windows\System, C:\Windows\System32 or C:\Winnt\System32.
Post Comment: