Wombat manual removal:
Kill processes:
deltree.exe, popup.exe, terminate.exe, wupdmgr.exe, 222.exe
Delete registry values:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mike3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mixed1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mixed2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mixed3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\terminate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\twitch
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall=0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions=0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\DisableRegistryTools=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCDBurning=1
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window Title=UNLUCKY
Delete files:deltree.exe, popup.exe, terminate.exe, wupdmgr.exe, 222.exe, internet.bat, bt[X].bat, temp.bat, tweaks.reg
Misc:[X] is a combination of random digits.
File location (may vary):
bt[X].bat - C:\Windows\Temp or C:\Winnt\Temp
terminate.exe, 222.exe, internet.bat - C:\Windows\mui or C:\Winnt\mui
deltree.exe, temp.bat - C:\Windows\System, C:\Windows\System32 or C:\Winnt\System32
Post Comment:
Attention: Use this form only if you have additional information about Wombat parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.