Solved! Use FWTHOSTSVC.EXE (Adware Kraddare) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

FWTHOSTSVC.EXE – Adware Kraddare removal

File MD5 Virus Alias
FWTHOSTSVC.EXE 8b0f07b6aa7d77aa52cfbfe5e65c9a81 Adware Kraddare
FWTHOSTSVC.EXE 8b0f07b6aa7d77aa52cfbfe5e65c9a81 Trojan SuspiciousFile
FWTHOSTSVC.EXE 8b0f07b6aa7d77aa52cfbfe5e65c9a81 Trojan Generic

FWTHOSTSVC.EXE size: 273872 bytes
FWTHOSTSVC.EXE hash: 8B0F07B6AA7D77AA52CFBFE5E65C9A81

Created files:

%Program Files%\FreeWebToon\FreeWebToonCtrl.dll
%Program Files%\FreeWebToon\FWTAlert.exe
%Program Files%\FreeWebToon\FWTChkSvc.exe
%Program Files%\FreeWebToon\fwthostsvc.exe
%Program Files%\FreeWebToon\FWTHostSvc.tlb
%Program Files%\FreeWebToon\FWTUninst.exe
%Program Files%\FreeWebToon\FWTUpdate.exe

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\FreeWebToon: %Program Files%\FreeWebToon\FWTUpdate.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\fwtalert: %Program Files%\FreeWebToon\FWTAlert.exe
HKLM\System\CurrentControlSet\Services\FreeWebToon\Type: 10010000
HKLM\System\CurrentControlSet\Services\FreeWebToon\Start: 02000000
HKLM\System\CurrentControlSet\Services\FreeWebToon\DisplayName: 4???T?(FreeWebToon)
HKLM\System\CurrentControlSet\Services\FreeWebToon\ImagePath: %Program Files%\FreeWebToon\FWTChkSvc.exe

Detected by UnHackMe:

FWTHOSTSVC.EXE
Default location: %PROGRAM FILES%\FREEWEBTOON\FWTHOSTSVC.EXE

Dropper information:
MD5: 17d4c8db82cd028234ebb96b0de29ce3
File size: 868304 bytes

Leave a Reply