Spyware Techie

Trojan.Win32.Obfuscated.gx Removal Guide

Published by admin on December 13, 2007 11:57 am under Spyware Help

Advertisement (advertise here?)

Do you know what Trojan.Win32.Obfuscated.gx is?

DESCRIPTION

Trojan.Win32.Obfuscated.gx is a malicious Trojan that can be found in several video codecs used to view video files, especially with adult content. Once your system is infected with Trojan.Win32.Obfuscated.gx, you’ll get bombarded with fake system alerts meant to trick you into purchasing popular rogue anti-spyware programs. Trojan.Win32.Obfuscated.gx may advertise IEDefender or VirusProtect.

Trojan.Win32.Obfuscated.gx Fake Alert Message:

Critical System Error!
“Your browser was infected by Trojan.Win32.Obfuscated.gx You need to clean your system immediately, in other case it can be crashed soon! Click OK to download the high-tech antispyware protection software! (Recommended)”

Do not click or download any product that is recommended on Trojan.Win32.Obfuscated.gx’s fake alert message.

In non-techie terms: Distributors of trojans conduct illicit installation methods to extort money from you. Trojan.Win32.Obfuscated.gx is no different than Zlob Trojan.

Trojan.Win32.Obfuscated.gx Removal Guide Automatic Removal Instructions

Trojan.Win32.Obfuscated.gx Manual Removal Instructions

This manual removal method is for techie computer users. Trojan.Win32.Obfuscated.gx manual removal may be difficult and time consuming to remove. There’s no guarantee that the infection will be removed completely. So read the removal steps carefully and good luck.

Before you start: Close all programs and Internet browsers. Also back up your computer in case you make a mistake and your computer stops working.

Uninstall Trojan.Win32.Obfuscated.gx Program
Click on Start > Settings > Control Panel > Double-click on Add/Remove Programs. Search for and uninstall the infection if found.
To stop Trojan.Win32.Obfuscated.gx processes (view process removal steps)
Go to Start > Run > type taskmgr. The click the Processes tab and you’ll see a list of running processes.
Search and stop these processes:
berwlkhc.exe
lylopybc.exe
telghgtw.exe
kzgdudgj.exe
wlczwfwp.exe
potohsxq.exe
javclcte.exe
vcncdqdo.exe
bknafypg.exe
tebuzejs.exe
For each unwanted process, right-click on it and then select “End task”.
To Unregister Trojan.Win32.Obfuscated.gx DLLs (view DLL removal steps)
Search and unregister these DLLs:
windivx.dll
vipextqtr.dll
ddcbyvt.dll
stream32a.dll
sgqddvym.dll
ddayv.dll
mlljh.dll
ljjhedc.dll
ddccd.dll
advpac.dll

To locate the DLL path, go to Start > Search > All Files or Folders. Type Trojan.Win32.Obfuscated.gx and in the Look in: select either My Computer or Local Hard Drives. Click the Search button.
Once you have the DLL path, go to Start and then click on Run. In the Run command box, type cmd, and then click on OK.
To locate the exact DLL path, type cd in order to change the current directory. To display the contents of the directory, use the dir command. To remove the DLL file type regsvr32 /u FILENAME.dll (FILENAME is the name of the file that you want to unregister).
To unregister Trojan.Win32.Obfuscated.gx registry keys (view registry keys removal steps)
Go to Start > Run > type regedit > press OK.
Edit the value (on the right pane) by right-clicking on it and selecting the Modify option. Select the Delete option.
Search and delete these registry keys:
MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\WpH96hHiLI 3ba096caa45ab117721e725079cc53a1 1057a2dcd13130963be0a51c41dc4d1c 7a329404de21925daacbbbee093ff6dc 7df5417b22988d88e8080a44392ade95 MICROSOFT\WINDOWS\CURRENTVERSION\RUN\winchksmart MICROSOFT\WINDOWS\CURRENTVERSION\RUN\commnt 5f9523529ce2cac480acbda2b8bf4e1e MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\d6iLCNeFnm bcf3a381bbe26d9c1ec24bac8b18f567 bb5be1c92c299a1c6bcfe67655b0a0c7 696ce23305a35bb118afc42d58845791 MICROSOFT\WINDOWS\CURRENTVERSION\RUN\mongenen MICROSOFT\WINDOWS\CURRENTVERSION\RUN\apiwin 396955766b2e512bc3545a24bc485dbe 40613dee6ad5fec910606c25b25262fd cbdc7b3033e82c2065a1b48061b2ca01 2982068d063848ddb0b8029750411a84 MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\HbLLkibcUl MICROSOFT\WINDOWS\CURRENTVERSION\RUN\DbHlp 9ceecf911241c9890541167edf53739f MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\zrhka4t0RS 7d4b39e4cab018496e2fe9bf9c3234b2 fe6e6a62a572e84e9eaee12eb3ee8a2b e05997f932f826f0271cf32d00bbd3be MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\St3GCPYjpi MICROSOFT\WINDOWS\CURRENTVERSION\RUN\SetDsc 69c9be662f7f284aae171adeb136cb24 6d3c4dbecf4aaf1ae826a0a7edde5951 1bc5752bd72f44f004d9f061dd7f9e00 c18c3b4771120703624baaf835feecd8 9a9f57899a28547b04fc2da3700c95cf 8266c79a434aed795a5f3f7abb0aff0d MICROSOFT\WINDOWS\CURRENTVERSION\RUN\websmartchk
If your homepage has been changed, go to Start > Control Panel > Internet Options > click on the General > click Use Default under Home Page. Add the your desired default homepage, then click Apply > click OK. Open a new web browser to check that you have your desired default homepage.
Remove Trojan.Win32.Obfuscated.gx Directories.
To find infection directories, go to Start > My Computer > Local Disk (C:) > Program Files > Show the contents of this folder.
Search and delete the following directories:
There are no directories.

Right-click on the named folder and select Delete.
A message will appear saying ‘Are you sure you want to remove the selected folder and move all its contents to the Recycle Bin?’, click Yes.
Another message will appear saying ‘Renaming, moving or deleting a folder could make some programs not work. Are you sure you want to do this?’, click Yes.
To remove Trojan.Win32.Obfuscated.gx icons on your Desktop, drag and drop them to the Recycle Bin.

You’ve completed the manual removal instructions!
I hope this article has helped you solve your problems. If you want to contribute to this article, post your comment below.

Disclaimer