Mar 12

Remove 5win-wellcome.com hijacker (Removal Instructions)

Hijackers Add comments

Threat Description:

5win-wellcome.com is what we classify as a browser hijacker, i.e. a domain name people hit after their browsers get directed there because of trojan activity. 5win-wellcome.com is promoting the recent scareware called Antivirus 7 which is showing huge rapidity of propagation during the past few days. PC users visit 5win-wellcome.com resulting from a click on a purportedly safe SERPs (Search Engine Results Pages) link or an online advertisement placed by hackers on popular web resources such as social networking portals. You all of a sudden realize you’ve navigated to a web page that right away displays a popup warning telling you that Antivirus 7 has found some unsafe software on your computer. That is just the beginning though. 5win-wellcome.com will then get down to ‘scanning’ your system for malware. This improvised scan is a bogus one and does not reflect any security information you can trust. It’s just picture that was ‘drawn’ by the bad guys beforehand for you to fall for it and think it’s checking your machine online for real. 5win-wellcome.com is not at all trustworthy so just ignore all of the obsessive ads and scan reports it generates. 5win-wellcome.com is meant to have you download rogue anti-spyware (Antivirus 7 fraud). So just be above this malicious process and eliminate the hijacker as fast as you can.

Determine if your system is infected with 5win-wellcome.com hijacker and related threats:

Download 5win-wellcome.com Infection Free Scanner with Remover

5win-wellcome.com Fake Scan Screenshot:

5win-wellcome.com

How to remove this threat manually:

5win-wellcome.com manual uninstall procedure:

Get rid of the related corrupt files:

  • %Documents and Settings%\All Users\Start Menu\AV
  • %Documents and Settings%\All Users\Start Menu\AV\Antivirus7.lnk
  • %Documents and Settings%\All Users\Start Menu\AV\Uninstall.lnk
  • %Documents and Settings%\[UserName]\Desktop\Antivirus7.lnk
  • %Program Files%\AV
  • %Program Files%\AV\Antivirus7.exe
  • %Program Files%\Common Files\Uninstall
  • %Program Files%\Common Files\Uninstall\AV
  • %Program Files%\Common Files\Uninstall\AV\Uninstall.lnk
  • %Program Files%\Antivirus7AV
  • %Program Files%\Antivirus7AV\Antivirus7.exe
  • %Program Files%\Antivirus7AV\unins000.dat
  • %Program Files%\Antivirus7AV\unins000.exe
  • %WINDOWS%\system32\UpdateCheck.dll

Delete the associated registry entries:

  • HKEY_CURRENT_USER\Software\EVAACD
  • HKEY_CLASSES_ROOT\CLSID\{35A5B43B-CB8A-49CA-A9F4-D3B308D2E3CC}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{35A5B43B-CB8A-49CA-A9F4-D3B308D2E3CC}
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Antivirus 7″
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\post platform “WinNT-EVI 25.11.2009″
  • HKEY_CURRENT_USER\Software\FNULL246
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6A23338A-C725-48D0-BA96-B12FDD22DD39}_is1

Please note that 5win-wellcome.com manual removal is a procedure of high complexity and should be performed with extreme caution. Lack of the required skills and even the slightest deviation from the instructions may cause irreparable system damage. To ensure trouble-free deletion, it is recommended to use the automatic removal tool below:

Download 5win-wellcome.com Removal Tool

Leave a Reply