Quick Keylogger manual removal:
Kill processes:
svchost.exe, qpanel.exe
Delete registry values:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window_Placement
HKEY_LOCAL_MACHINE\SOFTWARE\RockinFewl\LaunchinIE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\svchost
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\svchost
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LaunchInIE.Launch
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LaunchInIE.Launch.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4BEF2011-88FB-0546-1BD1-FCD02B406654}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8809076-71C2-4B90-8DD6-6BF107F4F029}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7EBC9879-80A3-4F7C-8962-CB66B7D25F19}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D1008EEB-37BC-4E5C-8A18-F30A111D98DF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EEA8E1E1-81D8-4AB9-B796-58C5A057A022}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AC348A2D-469C-4346-A115-4CB9F1EC5FEB}
HKEY_LOCAL_MACHINE\SOFTWARE\Licenses\{0566CAE8832A7BB26}
HKEY_LOCAL_MACHINE\SOFTWARE\Licenses\{I566CAE8832A7BB26}
HKEY_LOCAL_MACHINE\SOFTWARE\Licenses\{K7C0DB872A3F777C0}
HKEY_LOCAL_MACHINE\SOFTWARE\Licenses\{R7C0DB872A3F777C0}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RFC1156Agent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RFC1156Agent\CurrentVersion\Parameters\TrapPollTimeMilliSecs =3A98
Unregister DLLs:launchinie.dll, qlib.dll, qutils.dll
Delete files:svchost.exe, qpanel.exe, launchinie.dll, qlib.dll, qutils.dll
Misc:Quick Keylogger files can be found in one of the following directories:
C:\Windows\System
C:\Windows\System32
C:\Winnt\System32
Post Comment: