Solved! Use FWTUNINST.EXE (Adware Kraddare) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

FWTUNINST.EXE – Adware Kraddare removal

FileMD5Virus Alias
FWTUNINST.EXE 99299f35fe813f6241aefabf08e49e60 Adware Kraddare
FWTUNINST.EXE 99299f35fe813f6241aefabf08e49e60 Trojan SuspiciousFile
FWTUNINST.EXE 99299f35fe813f6241aefabf08e49e60 Trojan Agent

FWTUNINST.EXE size: 214992 bytes
FWTUNINST.EXE hash: 99299F35FE813F6241AEFABF08E49E60

Created files:

%Program Files%\FreeWebToon\FreeWebToonCtrl.dll
%Program Files%\FreeWebToon\FWTAlert.exe
%Program Files%\FreeWebToon\FWTChkSvc.exe
%Program Files%\FreeWebToon\fwthostsvc.exe
%Program Files%\FreeWebToon\FWTHostSvc.tlb
%Program Files%\FreeWebToon\FWTUninst.exe
%Program Files%\FreeWebToon\FWTUpdate.exe

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\FreeWebToon: %Program Files%\FreeWebToon\FWTUpdate.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\fwtalert: %Program Files%\FreeWebToon\FWTAlert.exe
HKLM\System\CurrentControlSet\Services\FreeWebToon\Type: 10010000
HKLM\System\CurrentControlSet\Services\FreeWebToon\Start: 02000000
HKLM\System\CurrentControlSet\Services\FreeWebToon\DisplayName: 4???T?(FreeWebToon)
HKLM\System\CurrentControlSet\Services\FreeWebToon\ImagePath: %Program Files%\FreeWebToon\FWTChkSvc.exe

Detected by UnHackMe:

FWTUNINST.EXE
Default location: %PROGRAM FILES%\FREEWEBTOON\FWTUNINST.EXE

Dropper information:
MD5: 17d4c8db82cd028234ebb96b0de29ce3
File size: 868304 bytes

Leave a Reply