Mixor.c manual removal:
Kill processes:
wservice.exe, [X1].exe, [X2].t
Delete registry values:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\UpdateService
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateService
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Start=4
Delete files:wservice.exe, [X1].exe, [X2].t
Misc:[X1] is a combination of 7 random letters.
[X2] is a combination of 8 random letters.
The wservice.exe file resides in default system directory, which is one of the following: C:\WINDOWS\System, C:\WINDOWS\System32, C:\WINNT\System32.
[X1].exe can be found in infected RAR archives.
[X2].t is in all local folders and mapped network drives.
Post Comment: