Worm.Win32.Sober Removal Guide
Do you know what Worm.Win32.Sober is?
DESCRIPTION
Worm.Win32.Sober is a relentless malware infection, a variant of Trojan.Win32 and Trojan.Win32.agent.akk, that can be found in several bogus video codecs used to view video files, especially with adult content. Worm.Win32.Sober is not a virus by itself, however it distributes rogue anti-spyware programs such as IEDefender.
Worm.Win32.Sober bombards your computer with deceptive warning messages stating that your computer was infected by Worm.Win32.Sober and that it’s dangerous for your system. Worm.Win32.Sober’s incessant fake warning messages are intended to trick you into purchasing a full version of the rogue anti-spyware application. Once you click on the fake alert message, you will be directed to IEDefender’s home site where you get the commercial version of this rogue anti-spyware application.
Worm.Win32.Sober Fake Alert Message:
Critical System Error!
Your computer was infected by Worm.Win32.Sober It’s dangerous for your system, some files can be lost and your browser can be slow!
Click OK to download the antispyware program to clean your computer! (Recommended)
Worm.Win32.Sober’s error message is a crafty and scary approach that ultimately has you convinced that you have a spyware problem and that you need to download their rogue anti-spyware program. Do not fall under the trojan makers’ tricks and do not download any program recommended on Worm.Win32.Sober’s fake alert message.
In non-techie terms: Distributors of trojans conduct illicit installation methods to extort money from you. Worm.Win32.Sober is no different than Zlob Trojan.
Worm.Win32.Sober Automatic Removal Instructions
This automatic removal method is for non-techie computer users. If you’re too lazy to learn about spyware removal or how to access sensitive files in your computer, then this is the method for you.
Before you start: Print or bookmark these instructions because you’ll have to reboot into Safe Mode. Also back up your computer in case you make a mistake.
- Download and save SmitFraudFix to your desktop.
- Restart your computer in Safe Mode (how to do safe mode). Once the
desktop appears, double click on the SmitfraudFix.exe on your desktop. - After the credits screen, you’ll see a menu. Select the option number 2, which is ‘Clean (safe mode recommended)’, and then
press Enter to delete infect files. - SmitFraudFix will begin cleaning your computer and take a series of cleanup processes. When the process is over, it will automatically begin the Disk Cleanup program.
- Once the Disk Cleanup program is complete, you will be prompted with the message ‘Registry cleaning - Do you want to clean the registry’. Answer Y (Yes) and hit Enter. Reboot your computer.
- SmitFraudFix will now check if wininet.dll is infected. SmitFraudFix will ask you whether to replace the infected file (if there’s any) ‘Replace infected
file?’ Answer by typing Y (Yes) and hit Enter. - Reboot your computer to complete the cleaning process.
- After reboot, a Notepad screen may appear containing a log of all the files
removed from your computer. If it doesn’t appear, a file will be created called
rapport.txt in the root of your drive, (Local Disk C:). - Restart your computer in Safe Mode (how to do safe mode).
- Go to C:\Windows\Temp, click Edit, click Select All, press DELETE, and then
click Yes to confirm that you want all the items to go to the Recycle Bin. - Go to C:\Documents and Settings\[LISTED USER]\Local Settings\Temp, click Edit, click Select All, press DELETE, and then click Yes to confirm that
you want all the items to go to the Recycle Bin. - Reboot your computer back to normal mode. Go to Windows Update and download all critical updates.
Worm.Win32.Sober Manual Removal Instructions
This manual removal method is for techie computer users. Worm.Win32.Sober manual removal may be difficult and time consuming to remove. There’s no guarantee that Worm.Win32.Sober will be removed completely. So read the Worm.Win32.Sober removal steps carefully and good luck.
Before you start: Close all programs and Internet browsers. Also back up your computer in case you make a mistake and your computer stops working.
- Uninstall Worm.Win32.Sober Program
Click on Start > Settings > Control Panel > Double-click on Add/Remove Programs. Search for and uninstall Worm.Win32.Sober if found. - To Unregister Worm.Win32.Sober DLLs (view DLL removal steps)
Search and unregister these Worm.Win32.Sober DLLs:
pmspl.dll
windivx.dll
vtssp.dll
websrc32.dll
blopenvxdt.dll
urqnomm.dll
msvideo.dll
ttvbonvgl.dll
mlljh.dll
ecxwp.dll
gqagksr.dll
esent9.dll
ssqppol.dll
cjvy.dll
stream32a.dll
popnetnpr.dll
To locate the Worm.Win32.Sober DLL path, go to Start > Search > All Files or Folders. Type Worm.Win32.Sober and in the Look in: select either My Computer or Local Hard Drives. Click the Search button.
Once you have the Worm.Win32.Sober DLL path, go to Start and then click on Run. In the Run command box, type cmd, and then click on OK.
To locate the exact DLL path, type cd in order to change the current directory. To display the contents of the directory, use the dir command. To remove the DLL file type regsvr32 /u FILENAME.dll (FILENAME is the name of the file that you want to unregister). - To unregister Worm.Win32.Sober registry keys (view registry keys removal steps)
Go to Start > Run > type regedit > press OK.
Edit the value (on the right pane) by right-clicking on it and selecting the Modify option. Select the Delete option.
Search and delete these Worm.Win32.Sober registry keys: - If your homepage has been changed, go to Start > Control Panel > Internet Options > click on the General > click Use Default under Home Page. Add the your desired default homepage, then click Apply > click OK. Open a new web browser to check that you have your desired default homepage.
- Remove Worm.Win32.Sober Directories.
To find Worm.Win32.Sober directories, go to Start > My Computer > Local Disk (C:) > Program Files > Show the contents of this folder.Right-click on the Worm.Win32.Sober folder and select Delete.
A message will appear saying ‘Are you sure you want to remove the folder Worm.Win32.Sober and move all its contents to the Recycle Bin?’, click Yes.
Another message will appear saying ‘Renaming, moving or deleting Worm.Win32.Sober could make some programs not work. Are you sure you want to do this?’, click Yes. - To remove Worm.Win32.Sober icons on your Desktop, drag and drop them to the Recycle Bin.
You’ve completed the Worm.Win32.Sober manual removal instructions!
I hope this article has helped you solve your Worm.Win32.Sober problems. If you want to contribute to this article, post your comment below.
Disclaimer: This article is for educational purposes. By using this information you agree to be bound by the disclaimer. There’s no guarantee that Worm.Win32.Sober will be completely removed from your computer. Seek professional help if your computer continues to experience problems.
Did You Find this Article Helpful?
Subscribe to Spyware Techie for more!
Or get latest articles to your via email:
Wow,
A really nice help article. Ive saved it as a fav.
Ive seen this worm cause alot of trouble at some sites and forums I frequent.
Well done.
Immense thank you for sorting me out. Ended up with the worm.win32.sober critical error messages popping up all over the place, and when doing web searches was automatically directed to some youtube porn videos, which was not ideal for my 7 year old daughter, nor anyone else for that matter. Tries all sorts of fixes, but none work except yours. So thanks! Ed
The SmitfraudFix worked for me (Windows Vista). I didn’t get to all the steps. After the reboot in step 5, it was gone. It seems like this type of fraud should be able to be prosecuted. Thank you so much for hosting this solution. Rich
Hello, I can’t help the problem.
I still have annoying thing.
At first I couldn’t find any file.