Solved! Use FWTUPDATE.EXE (Adware Kraddare) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

FWTUPDATE.EXE – Adware Kraddare removal

File MD5 Virus Alias
FWTUPDATE.EXE 5c39b43381f43b4a0d6656133cc5f1ac Adware Kraddare
FWTUPDATE.EXE 5c39b43381f43b4a0d6656133cc5f1ac Trojan SuspiciousFile
FWTUPDATE.EXE 5c39b43381f43b4a0d6656133cc5f1ac Trojan Generic

FWTUPDATE.EXE size: 283088 bytes
FWTUPDATE.EXE hash: 5C39B43381F43B4A0D6656133CC5F1AC

Created files:

%Program Files%\FreeWebToon\FreeWebToonCtrl.dll
%Program Files%\FreeWebToon\FWTAlert.exe
%Program Files%\FreeWebToon\FWTChkSvc.exe
%Program Files%\FreeWebToon\fwthostsvc.exe
%Program Files%\FreeWebToon\FWTHostSvc.tlb
%Program Files%\FreeWebToon\FWTUninst.exe
%Program Files%\FreeWebToon\FWTUpdate.exe

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\FreeWebToon: %Program Files%\FreeWebToon\FWTUpdate.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\fwtalert: %Program Files%\FreeWebToon\FWTAlert.exe
HKLM\System\CurrentControlSet\Services\FreeWebToon\Type: 10010000
HKLM\System\CurrentControlSet\Services\FreeWebToon\Start: 02000000
HKLM\System\CurrentControlSet\Services\FreeWebToon\DisplayName: 4???T?(FreeWebToon)
HKLM\System\CurrentControlSet\Services\FreeWebToon\ImagePath: %Program Files%\FreeWebToon\FWTChkSvc.exe

Detected by UnHackMe:

FWTUPDATE.EXE
Default location: %PROGRAM FILES%\FREEWEBTOON\FWTUPDATE.EXE

Dropper information:
MD5: 17d4c8db82cd028234ebb96b0de29ce3
File size: 868304 bytes

Leave a Reply