Saturday, January 9, 2010

Remove Zwunzi adware

Zwunzi (also known as Adware.Zwunzi) is an adware application that pretends to be a Browser Search Plugin for Internet Explorer, Firefox and probably other well known browsers. It has to be manually installed. Once active, it creates a new service with an automatic start up type called Zwunzi Service. The biggest problem is that this virus hijacks a web browser and redirects users' searches to zwunzi.com.



How to remove Zwunzi virus manually? First of all, you havw to end its ptocesses: zwunzi128.exe and zwunzi.exe. Then remove the following directories with all files in those directories:
  • C:\Program Files\Zwunzi
  • C:\Documents and Settings\All Users\Application Data\Zwunzi 
Then use Regedit and delete the following registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zwunzi\"DisplayName" = "Zwunzi 1.0 build 128"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zwunzi\"UninstallString" = "%ProgramFiles%\Zwunzi\uninstall.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Zwunzi\"Cid" = "466705c1534b4aee8c896579946b055f"
HKEY_LOCAL_MACHINE\SOFTWARE\Zwunzi\"DllPath = "%ProgramFiles%\Zwunzi\zwunzi.dll"
HKEY_LOCAL_MACHINE\SOFTWARE\Zwunzi\"Initial" = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Zwunzi\"Partner" = "ZWUNZI128"
HKEY_LOCAL_MACHINE\SOFTWARE\Zwunzi\"Primary" = "f403"
HKEY_LOCAL_MACHINE\SOFTWARE\Zwunzi\"ShowBarSign" = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Zwunzi\"ShowToolbarButton" = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Zwunzi\"Src" = "zwunzi"
HKEY_LOCAL_MACHINE\SOFTWARE\Zwunzi\"Version" = "1001c"

No comments:

Post a Comment