ZenoSearch manual removal:
Kill processes:
kwinosap.exe, inst3.exe, dwdsregt.exe, zigi.exe, kwinpsap.exe, kwinrqez.exe, kwintqez.exe, nwinkrag.exe, nwinlqez.exe, nwinmqez.exe, nwinpsaw.exe, lwinksaw.exe, lwinmrag.exe, lwinnsap.exe, lwintqag.exe, mwinkqez.exe, mwinnag.exe, mwinnsai.exe, mwinprag.exe, mwinqqez.exe, nwinqqez.exe, nwinssaw.exe, owinkqez.exe, winmqez.exe, owinnrag.exe, owinrqez.exe, owinssag.exe, pwinpsap.exe, pwintrai.exe, zxinst12.exe, pwinlqez.exe, rwwnw64d.exe, tcntaxdm.exe, tcntaxdm.exe, rwwnw64d.exe
Delete registry values:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysstart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zeno Browser Enhancer
Delete files:zeno.lnk kwinosap.exe, inst3.exe, dwdsregt.exe, zigi.exe, kwinpsap.exe, kwinrqez.exe, kwintqez.exe, nwinkrag.exe, nwinlqez.exe, nwinmqez.exe, nwinpsaw.exe, lwinksaw.exe, lwinmrag.exe, lwinnsap.exe, lwintqag.exe, mwinkqez.exe, mwinnag.exe, mwinnsai.exe, mwinprag.exe, mwinqqez.exe, nwinqqez.exe, nwinssaw.exe, owinkqez.exe, winmqez.exe, owinnrag.exe, owinrqez.exe, owinssag.exe, pwinpsap.exe, pwintrai.exe, zxinst12.exe, pwinlqez.exe, rwwnw64d.exe, tcntaxdm.exe, tcntaxdm.exe, rwwnw64d.exe
Misc:The threat uses executables with random filenames.
The zeno.lnk file can be found in C:\Documents and Settings\[Current User]\Start Menu\Programs\Startup folder.
Post Comment: