Do you have WinReanimator?

This “WinReanimator Removal Guide” article will show you how to identify and remove WinReanimator. This guide will be updated as more information is available.

WinReanimator Detection Test

 Run SpyHunter’s Spyware Scanner to check for WinReanimator infections on your PC.

WinReanimator Description

WinReanimator is a rogue anti-spyware application. WinReanimator may be brought into your computer by a Trojan, sneaking past weak security system points, or may be downloaded directly from www.WinReanimator.com. As soon as WinReanimator is installed, it will perform a fake scan that will result in exaggerated threat reports. Below is an example of a fake warning WinReanimator may generate:

“Windows has detected spyware infection!
It is recommended to use special antispyware tools to prevent data loss. Windows will now download and install the most up-to-date antispyware for you
Click here to protect your computer from spyware!”

By clicking on any of such warnings, you will find yourself prompted to purchase the “full version” of WinReanimator, as if it was the only application that can eliminate the parasites it “found”. WinReanimator is yet another scam and, therefore, should not be trusted. We strongly recommend you remove WinReanimator from your system without any hesitation.

Parasite Type: A cocktail of Rogue Anti-Spyware Programs & Trojans.

WinReanimator Method of Automatic Removal

The removal of spyware such as WinReanimator can be a difficult process. If you regularly run a spyware scan with a good spyware remover, you can automatically detect WinReanimator and other Spyware, Trojans, Rogue Anti-spyware, Adware, Browser Hijackers and other unwanted programs.

To quickly remove WinReanimator, follow the instructions below:

1. Download SpyHunter’s Spyware Scanner.

2. Select “Start Scan” to run a full system WinReanimator scan.

3. Reboot your computer.

4. Run another scan to pick up any remaining WinReanimator infections.

** SpyHunter’s Spyware Scanner only allows you to detect WinReanimator and other spyware. In order to remove WinReanimator, we advise you to buy the full-version of SpyHunter. Weekly WinReanimator file updates and technical support are available with SpyHunter’s spyware remover.

WinReanimator Method of Infection

• The Internet user surfs the Web and visits a questionable website. A large amount of rogue anti-spyware programs like WinReanimator is mostly pushed through adult websites.

• The Internet user downloads a free video codec called “Video ActiveX Enhancement 2.07″ which comes bundled with WinReanimator. Freeware or shareware programs tend to come with other unwanted programs such as WinReanimator. Do not install any free software without reading its EULA. By simply reading a program’s EULA, you can determine whether a program you are installing has spyware bundled with it.

• The Internet user is infected with the rogue anti-spyware program WinReanimator. WinReanimator runs a scan on the computer and gives a false spyware report claiming that the computer is infected with spyware. Once the scan is completed, a warning message appears with two buttons, one that says “Buy On-Line” and the other “Delete Spyware”. This deceptive tactic is an attempt to scare the Internet user into clicking the “Buy On-Line” button.

Fake warning message reads:

• “Warning! 24 threats found!
  WinReanimator has detected malicious spyware on your PC. To buy WinReanimator On-Line, click ‘Buy On-Line’.”
• The Internet user closes all the fake Windows error messages and warnings and is unaware that WinReanimator is still running its malicious tasks in the background. WinReanimator reloads itself on a timer so if the Internet user closes the program it will only take a few moments until it opens again. The average Internet user does not realize when spyware has infected his/her computer until it is too late and the spyware problem has already spread throughout the computer.

• Internet user opens web browser and is redirected to a rogue website called Puresafetyhere.com. The Internet user is bombard with websites that pop up messages that tries to push a product on him/her. Ignore such messages! We recommend closing these windows by clicking on the X instead of the OK button.

WinReanimator Symptoms

The following WinReanimator symptoms occur:

• WinReanimator displays a fake system alert similar to a Windows notification message.
  A red or green flashing icon appears in your system tray. If you click on the icon, a fake system alert pops up and directs you to a rogue website called safetyuptodate.com. In some cases, even when you don’t click on the icon the fake system alert may still pop up.

  The fake system alert promises to give you a legitimate anti-spyware program that will help you fix spyware problems, but instead it really reports false information to try to trick you into purchasing the program.

  WinReanimator’s false sytem alert message reads:

  • “System Alert: Trojan-Spy.Win32@mx
    Type: Spyware/Trojan
    Vulnerable: Windows 95/98/ME/NT/2003/Windows XP
    Description: Spyware program that sends confidential information to a remote attacker.
    Protection: Click this baloon to download official security software.”

• WinReanimator hijacks or modifies your homepage and displays new desktop shortcuts.
  WinReanimator changes your default homepage to a different homepage and creates new unnecessary shortcuts on your desktop. Sometimes WinReanimator won’t even allow you to change it back to your original homepage. Websites that redirects you to is asecurevalue.com and malwareburn.com.

• WinReanimator installs a rogue toolbar called Security Toolbar 7.1.
  Security toolbar 7.1 is a rogue toolbar that comes with two green bars, one that says “block adware” and the other “remove spyware”. If you click on either of them you’re directed to a rogue anti-spyware site such as Malwareburn.com which can install additional malware.

• WinReanimator bombards your PC with fake Windows warnings messages.
  Even after you’ve closed all the WinReanimator messages or your PC has been idle for awhile, you’ll still get constant alert popups appearing on your system tray or on your screen.

WinReanimator Anatomy

As new WinReanimator spyware components is reported by our customers and our Spyware Threat Research Labs, we will update this section.

WinReanimator.com WHOIS Information:
Registration Service Provided By: VIVIDS MEDIA GMBH
Contact: +49.3094413291
Domain Name: WINREANIMATOR.COM
Registrant:
TRADEMAX Ltd.
TRADEMAX Ltd.
(shmid@mikitos.com)
18 KRJIJANOVSKOGO st., korp.3
Moskow
0,117218
RU
Tel. +578.3786582
Creation Date: 23-Sep-2007
Expiration Date: 23-Sep-2008
Domain servers in listed order:
ns2.winreanimator.com
ns1.winreanimator.com

WinReanimator Manual Removal Instructions

To learn the WinReanimator manual removal process, read the step-by-step instructions provided on this section.

Use Caution! Please read the instructions below carefully. Manual removal of WinReanimator is a delicate procedure. Proceed at your own risk.

Make sure you backup your system and close all open Internet Explorer windows before you manually remove WinReanimator.

If you are still having problems with WinReanimator after completing these instructions, we recommend you download SpyHunter’s Spyware Detection Tool to safely remove
WinReanimator.

To manually remove WinReanimator, follow these removal steps:

Step #1: How to Kill WinReanimator files using Process Explorer.

• 1a. How to Kill WinReanimator processes.

1. Download and install Process Explorer.

2. Open Process Explorer.

3. Locate the WinReanimator processes listed below.

4. To kill an WinReanimator process, right-click the WinReanimator process and choose the option “Kill Process Tree”.

5. Kill the following WinReanimator processes:
   WinReanimator.exe
   
• 1b. How to Kill WinReanimator DLL files.

1. Right-click the Explorer.exe process and choose the option “Properties”.

2. Click on the “Threads” Tab, locate and highlight the WinReanimator DLL files listed below.

3. To kill WinReanimator DLL files, click the “Kill” button.

4. Kill the following WinReanimator DLL files:
   WinReanimator.dll
   
• Step #2: How to Delete WinReanimator Registry Keys and Values.

1. Right-click on your Desktop > select “New” option > select “Text Document” (.txt file) option.

2. Rename the .txt file as a .reg file and call it “Delete_Registry_
   WinReanimator_Entities.reg”. This renamed .reg file is a command that creates a shortcut to your Windows registry and allows you to easily delete registry values.

3. Right-click and select the “Edit” option.

4. Copy and paste the WinReanimator keys listed below.

5. In the menu bar, go to “File” > select “Save” > then click the “X” button to close the file.

6. Double-click on the .reg file.

7. When the message box appears saying “Are you sure you want to add the information in C:\DOCUME~1\%username%\Desktop\DELETE~1.REG to the registry?”, click the “Yes” button.

8. When the message box appears saying “Information in C:\DOCUME~1\%username%
   \Desktop\DELETE~1.REG has been successfully entered into the registry.”, click the “OK” button.

9. The WinReanimator registry keys have been deleted from your registry.

10. Copy and paste the following WinReanimator keys:
    

11. Windows Registry Editor Version 5.00
    
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\WinReanimator]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\WinReanimator]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks\WinReanimator]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\WinReanimator]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\WinReanimator]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\WinReanimator]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\WinReanimator]
    [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\WinReanimator]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\WinReanimator]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\WinReanimator]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WinReanimator]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\WinReanimator]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\WinReanimator]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWSNT\CURRENTVERSION\WINDOWS\APPINIT_DLLS\WinReanimator.dll]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\WinReanimator.dll]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinReanimator.dll]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\WinReanimator.dll]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks\WinReanimator.dll]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\WinReanimator.dll]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\WinReanimator.dll]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\WinReanimator.dll]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\WinReanimator.dll]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\WinReanimator.dll]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\WinReanimator.dll]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\WinReanimator.dll]
    [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\WinReanimator.dll]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\WinReanimator.dll]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\WinReanimator.dll]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WinReanimator.dll]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\WinReanimator.dll]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\WinReanimator.dll]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\WinReanimator.dll]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\WinReanimator.dll]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\WinReanimator.dll]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWSNT\CURRENTVERSION\WINDOWS\APPINIT_DLLS\WinReanimator.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\WinReanimator.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinReanimator.exe]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\WinReanimator.exe]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks\WinReanimator.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\WinReanimator.exe]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\WinReanimator.exe]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\WinReanimator.exe]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\WinReanimator.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\WinReanimator.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\WinReanimator.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\WinReanimator.exe]
    [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\WinReanimator.exe]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\WinReanimator.exe]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\WinReanimator.exe]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WinReanimator.exe]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\WinReanimator.exe]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\WinReanimator.exe]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\WinReanimator.exe]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\WinReanimator.exe]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\WinReanimator.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWSNT\CURRENTVERSION\WINDOWS\APPINIT_DLLS\WinReanimator.lnk]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\WinReanimator.lnk]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinReanimator.lnk]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\WinReanimator.lnk]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks\WinReanimator.lnk]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\WinReanimator.lnk]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\WinReanimator.lnk]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\WinReanimator.lnk]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\WinReanimator.lnk]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\WinReanimator.lnk]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\WinReanimator.lnk]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\WinReanimator.lnk]
    [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\WinReanimator.lnk]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\WinReanimator.lnk]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\WinReanimator.lnk]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WinReanimator.lnk]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\WinReanimator.lnk]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\WinReanimator.lnk]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\WinReanimator.lnk]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\WinReanimator.lnk]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\WinReanimator.lnk]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWSNT\CURRENTVERSION\WINDOWS\APPINIT_DLLS\winivstr.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\winivstr.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\winivstr.exe]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\winivstr.exe]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks\winivstr.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\winivstr.exe]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\winivstr.exe]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\winivstr.exe]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\winivstr.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\winivstr.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\winivstr.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\winivstr.exe]
    [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\winivstr.exe]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\winivstr.exe]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\winivstr.exe]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\winivstr.exe]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\winivstr.exe]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\winivstr.exe]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\winivstr.exe]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\winivstr.exe]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\winivstr.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWSNT\CURRENTVERSION\WINDOWS\APPINIT_DLLS\cru629.dat]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\cru629.dat]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\cru629.dat]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\cru629.dat]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks\cru629.dat]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\cru629.dat]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\cru629.dat]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\cru629.dat]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\cru629.dat]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\cru629.dat]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\cru629.dat]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\cru629.dat]
    [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\cru629.dat]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\cru629.dat]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\cru629.dat]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\cru629.dat]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\cru629.dat]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\cru629.dat]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\cru629.dat]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\cru629.dat]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\cru629.dat]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWSNT\CURRENTVERSION\WINDOWS\APPINIT_DLLS\karina.dat]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\karina.dat]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\karina.dat]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\karina.dat]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks\karina.dat]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\karina.dat]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\karina.dat]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\karina.dat]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\karina.dat]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\karina.dat]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\karina.dat]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\karina.dat]
    [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\karina.dat]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\karina.dat]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\karina.dat]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\karina.dat]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\karina.dat]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\karina.dat]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\karina.dat]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\karina.dat]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\karina.dat]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWSNT\CURRENTVERSION\WINDOWS\APPINIT_DLLS\buritos.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\buritos.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\buritos.exe]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\buritos.exe]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks\buritos.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\buritos.exe]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\buritos.exe]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\buritos.exe]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\buritos.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\buritos.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\buritos.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\buritos.exe]
    [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\buritos.exe]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\buritos.exe]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\buritos.exe]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\buritos.exe]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\buritos.exe]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\buritos.exe]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\buritos.exe]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\buritos.exe]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\buritos.exe]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\WinReanimator]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\WinReanimator]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\WinReanimator]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\WinReanimator]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\WinReanimator]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\WinReanimator]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\buritos]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\buritos]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\buritos]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\buritos]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\buritos]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\buritos]
    
    

• Step #3: How to Delete WinReanimator Directories.

1. To locate WinReanimator directories, go to “Start” > “My Computer” > “Local Disk (C:)” > “Program Files” > “Show the contents of this folder”.

2. Search and delete the WinReanimator directories listed below.

3. Right-click on the WinReanimator folder and select “Delete”. option.

4. When the message box appears saying “Are you sure you want to remove the folder [FOLDERNAME] and move all its contents to the Recycle Bin?”, click the “Yes” button.

5. When the message box appears saying “Renaming, moving or deleting [FOLDERNAME] could make some programs not work. Are you sure you want to do this?”, click the “Yes” button.

6. Search and delete the following WinReanimator directories:

   WinReanimator

• Step #4: How to Search and Delete C:\WINDOWS\System32\WinReanimator.dll.

1. Go back to “Local Disk (C:)” > “Windows” > “System32″ > “Show the contents of this folder”.

2. Search for WinReanimator.dll.

3. Right-click on the WinReanimator.dll file and select the “Delete” option.

• Step #5: How to Restore Original Default Home Page.

1. Go to “Start” > “Control Panel” > “Internet Options”.

2. Click on the General Tab > click the Use Default button under Home Page.

3. Click “Apply” and then click the “OK” button.

4. Open a Web browser to verify that your default homepage has been restored.

Step #6: How to Remove the WinReanimator Icons.
1. If the WinReanimator icons still remain on your Desktop, you can drag and drop them to the “Recycle Bin”.

2. Reboot your computer to make sure all changes made for the removal of WinReanimator are complete. If your computer still has issues, you should scan your computer for WinReanimator with a spyware scanner.

Congratulations!! You’ve completed our WinReanimator manual removal tutorial.

Submit WinReanimator To Our Spyware Threat Research Labs

Since WinReanimator spyware components change constantly, you may come across application issues that prevent you from removing WinReanimator completely.

You can report WinReanimator spyware components by using SpyHunter’s Free Support Log System. Our Support Log System takes snapshots of all the points of execution on your operating system, allowing us to precisely identify each and any problem.

We encourage you to post your Support Logs on this article so we can help you come up with a custom fix.

Below are the instructions on how to generate Support Logs using SpyHunter.

Open SpyHunter > click on the “Generate Support Log” button > click on the “Copy to Clipboard” button to save your Support Logs > Post your Support Logs to this article.

Disclaimer

Warning!! Enigma Software Group can not be held responsible for any problems that may occur by using the information contained within this WinReanimator removal guide. By following any of these WinReanimator removal instructions, you agree to be bound by the disclaimer. If you do not agree, do not follow these WinReanimator removal instructions. We make no guarantees that these WinReanimator removal instructions will completely remove WinReanimator. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means. In order to effectively clean and secure your computer, we recommend you purchase our spyware remover SpyHunter or seek professional help from a computer expert.





« AntiSpyKit, ProtejaseuDrive, SuspenzorPC, more - SpyHunter Update v.7.75
XP Antivirus 2008 Info & Manual Removal Guide »

This entry was posted by ESGI Advisor on Tuesday, February 26th, 2008 at 12:17 pm and is filed under Spyware Alerts. You can follow any responses to this entry through the RSS 2.0 feed. Responses are currently closed, but you can trackback from your own site.

Do you have WinReanimator?

This “WinReanimator Removal Guide” article will show you how to identify and remove WinReanimator. This guide will be updated as more information is available.

WinReanimator Detection Test

Run SpyHunter’s Spyware Scanner to check for WinReanimator infections on your PC.

WinReanimator Description

Parasite Type: Rogue AntiSpyware Programs

Aliases: Win Reanimator

WinReanimator Method of Automatic Detection

The removal of spyware such as WinReanimator can be a difficult process. If you regularly run a spyware scan with a good spyware remover, you can automatically detect WinReanimator and other Spyware, Adware, Worms, Trojans and Browser Hijackers.

To quickly detect WinReanimator, follow the instructions below:

1. Download SpyHunter’s Spyware Scanner.

2. Select “Start Scan” to run a full system WinReanimator scan.

3. Reboot your computer.

4. Run another scan to pick up any remaining WinReanimator infections.

** SpyHunter’s Spyware Scanner only allows you to detect WinReanimator and other spyware. In order to remove WinReanimator, we advise you to buy the full-version of SpyHunter. Weekly WinReanimator file updates and technical support are available with SpyHunter’s spyware remover.

WinReanimator Manual Removal

Use Caution! Please read the instructions below carefully. Manual removal of WinReanimator is a delicate procedure. Proceed at your own risk. We advise you to backup your system before you manually remove WinReanimator.

If you are still having problems with WinReanimator after completing these instructions, we recommend you download SpyHunter’s Spyware Detection Tool to safely detect WinReanimator.

To manually remove WinReanimator, follow these removal steps:

Find WinReanimator Directory Path

1. Find WinReanimator’s directory path before you remove WinReanimator.

2. Go to Start > Search > All Files or Folders.

3. On All or part of the the file name section, type in “WinReanimator” file name(s).

4. Use directory path for the other manual removal steps.

5. WinReanimator directory path listed below.
   %ProgramFiles%\WinReanimator

Stop WinReanimator Processes

1. To open Task Manager, use CTRL+ALT+DEL or CTRL+SHIFT+ESC.

2. Go to Image Name to find “WinReanimator” processes by name.

3. Find and stop the “WinReanimator” processes listed below.
   buritos.exe
   winivstr.exe
   braviax.exe
   WinReanimator.exe

Unregister WinReanimator DLL Files

1. Go to Start > Run > type cmd and then press OK.

2. To unregister “WinReanimator” DLL file, type in the exact directory path +
   regsvr32 /u + [DLL_NAME] (ex., :C\ WinReanimator \> regsvr32 /u WinReanimator.dll).

3. Find and unregister “WinReanimator” DLL files listed below.
   WinReanimator.dll

Delete WinReanimator Registry Values

1. Go to Start > Run > type regedit and then press OK.

2. To search for WinReanimator, press Ctrl + F and type WinReanimator to
   locate the key that has the value you want to delete.

3. To delete “WinReanimator” value, right-click on it and select Delete.

4. Find and delete “WinReanimator” registry keys listed below.
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
   WinReanimator

WinReanimator Symptoms

There are many signs that your PC has been hijacked and infected with WinReanimator or other spyware applications. To reduce the damage that can be done to your PC, start detecting WinReanimator symptoms on time. Below is a list of possible WinReanimator symptoms that your PC may have. Notice that certain spyware symptoms vary depending on upon the severity of the infection and other factors.

• Installs without your knowledge or permission. Usually spyware such as WinReanimator may be installed from a website through an embedded script or program in a webpage. There are some malwares that install through web pop-ups or free software that require you to accept a downloadable file.

• Tracks your surfing habits. Spyware applications such as WinReanimator are designed to track and collect details such as what websites you visit, what your usernames and passwords are and other sensitive information. Malware may even record and collect your login details for your online bank account.

• Bombards your PC with popup ads. Some unwanted applications such as WinReanimator display annoying popups (often for adult or other objectionable web sites) while you are surfing the Web and even when your PC has been idle for many minutes.

• Modifies or hijacks your homepage and displays new desktop shortcuts. Some spyware programs like WinReanimator add new unnecessary shortcuts on your desktop. Moreover, WinReanimator may actually change your default homepage to a different homepage. Sometimes WinReanimator won’t even allow you to change it back to your original homepage.

• Slows down your PC’s performance. One of the most common spyware symptoms is when your system suddenly starts operating slower than usual. Spyware applications use a lot of your PC’s resources to deliver popup ads and send information to third-parties which can results in a slow computer performance and system crashes.

WinReanimator Method of Infection

One of the most common reasons for getting infected with WinReanimator or other types of spyware is because people do not apply safe Internet practices. It is important to learn how one gets infected with WinReanimator or other types of spyware. Once you know what not to do, you will be able to avoid falling victim to spyware.

Below we provide some possible reasons why you might have become infected with WinReanimator:

1. You received an e-mail with an attachment from someone you don’t know and opened it. This is one of the most common ways for Adware, Viruses, or Spyware like WinReanimator to infect your PC. How do you know that the attachment is dangerous? It usually sends attachments that end with a .exe, .com, .bat, or .pif. Do not open email attactments if you don’t know who the sender is!

2. You were surfing the Web and you clicked on a popup ad warning you that your PC is infected. You panicked and clicked on the ad’s OK button; thus you were directed to WinReanimator’s website and it tried to push a product on you. Ignore such messages! We recommend closing these windows by clicking on the X instead of the OK button.

3. You visited a questionable website. A large amount of spyware is mostly pushed through adult sites. You might have accidentally clicked on a link that automatically installed unwanted software such as WinReanimator.

4. You downloaded a freeware or shareware program. Some developers offer their software for free, but can come with other unwanted programs such as WinReanimator bundled with it. Do not install any free software without reading its EULA. By simply reading a program’s EULA, you can determine whether a program you are installing has spyware bundled with it.

5. You downloaded a peer-to-peer (P2P) or shared network application. Very often peer-to-peer sharing programs are bundled with spyware similar to WinReanimator.

6. You downloaded some program from Warez or Crack websites. The downloads from these websites are often overrun with dangerous infections such as WinReanimator.

WinReanimator Quick Prevention Tips

Follow the WinReanimator prevention tips below to avoid WinReanimator infections and other malicious software.

1. Run Windows Updates regularly to ensure you have the most up-to-date and secure system. A good tactic is to set up your system to check for updates on a regular basis.
   
   To set up your system to access automatic updating services, follow these steps:
   Go to Start > Control Panel > System > Automatic Updates (XP) or Start > Settings > Control Panel > Automatic Updates (2000).

2. Use a firewall. A firewall is a software or hardware that serves as a blockade to keep data secure and safe and unauthorized users off your computer or network. You can choose from a variety of firewalls that are designed to meet different needs.

3. Firmly secure Internet Explorer settings. If you’re using Internet Explorer as your browser, change its settings to block spyware applications.
   
   To change Internet Explorer settings, go to Tools > Internet Options > Security > Custom Level.
   
   You will see a section near the top of the dialogue box devoted to Active X controls. There you should disable downloading of both signed and unsigned Active X controls and those marked as unsafe. Some Active X objects are spyware, and this action will block them.

4. Install a good and reputable anti-virus program. Make sure that you install only reputable anti-spyware and anti-virus software like SpyHunter. Most reputable anti-spyware software programs today are also designed to identify known viruses, which could contain Trojan horses as well.

5. Always keep your anti-spyware or anti-virus up-to-date with the latest malware definitions. The creators of anti-virus applications are constantly finding new security holes in their software and providing software updates. Therefore, it is important to make sure your anti-virus and anti-spyware programs are up-to-date. These updates are typically installed through an integrated update system.

6. Practice safe Internet surfing habits. Stay away from any questionable sites, including pornography, gambling, hacking or other off-beat sites.

The purpose of this “WinReanimator Removal Guide” article is to describe the removal process of SpyLocked. The SpyLocked manual removal instructions are to serve as a guide. We do not guarantee that the manual removal instructions will completely remove WinReanimator. It is advised to use SpyHunter to safely remove SpyLocked.

This entry was posted by Grace Mathews on Wednesday, December 31st, 1969 at 7:00 pm and is filed under Spyware Alerts. You can follow any responses to this entry through the RSS 2.0 feed. Responses are currently closed, but you can trackback from your own site.