Home → Windows → Spyware Removal → Security Monitor 2012
This little issue can be cleaned up by using the most recent copy of MalwareBytes. Before doing that, you must first kill all the processes and disable it from starting up upon reboot. Most importantly, reboot the computer in SAFE MODE. This should disable the autorun on the malware and then install/update MalwareBytes (available here: http://www.malwarebytes.org/)
Since this removal process is fully documented online, please see the following URL for all the details:
http://www.bleepingcomputer.com/virus-removal/remove-security-monitor-2012
We strongly advise you follow the link above for the source of the information on this issue and for any updates that may have been made to the process.
Associated Security Monitor 2012 Files:
%AppData%\Security Monitor\
%AppData%\Security Monitor\IcoActivate.ico
%AppData%\Security Monitor\IcoHelp.ico
%AppData%\Security Monitor\IcoUninstall.ico
%AppData%\Security Monitor\Security Monitor.exe
%AppData%\Security Monitor\securityhelper.exe
%AppData%\Security Monitor\securitymanager.exe
%Desktop%\Security Monitor.lnk
%StartMenu%\Programs\Security Monitor.lnk
%StartMenu%\Programs\Security Monitor\
%StartMenu%\Programs\Security Monitor\Activate Security Monitor.lnk
%StartMenu%\Programs\Security Monitor\Help Security Monitor.lnk
%StartMenu%\Programs\Security Monitor\How to Activate Security Monitor.lnk
%StartMenu%\Programs\Security Monitor\Security Monitor.lnk
%Temp%\02c9c3c35bdx5.exe
%Temp%\17dkf.exe
%Temp%\1iowieoo.exe
%Temp%\472a10e2ebxd9.exe
%Temp%\56493.exe
%Temp%\8gmsed-bd.exe
%Temp%\ae0965a7157cd.exe
%Temp%\al3erfa3.exe
%Temp%\alerfa.exe
%Temp%\alerfa2.exe
%Temp%\altedf.exe
%Temp%\bzqa43d.exe
%Temp%\cocksucker.exe
%Temp%\cosock.exe
%Temp%\format.exe
%Temp%\g_dx234.exe
%Temp%\ggwwef9752.exe
%Temp%\lkhgg_ea.exe
%Temp%\lols.exe
%Temp%\ploper.exe
%Temp%\timem.exe
%Temp%\tryh-blv.exe
%Temp%\w32-reno-c.exe
%Temp%\wrfwe_di.exe
%Temp%\wwautrsd.exe
%Temp%\wwwsssgen.exeFile Location Notes:
%Desktop% means that the file is located directly on your desktop. This is C:\DOCUMENTS AND SETTINGS\<Current User>\Desktop\ for Windows 2000/XP, and C:\Users\<Current User>\Desktop\ for Windows Vista and Windows 7.
%Temp% refers to the Windows Temp folder. By default, this is C:\Windows\Temp for Windows 95/98/ME, C:\DOCUMENTS AND SETTINGS\<Current User>\LOCAL SETTINGS\Temp for Windows 2000/XP, and C:\Users\<Current User>\AppData\Local\Temp for Windows Vista and Windows 7.
%AppData% refers to the current users Application Data folder. By default, this is C:\Documents and Settings\<Current User>\Application Data for Windows 2000/XP. For Windows Vista and Windows 7 it is C:\Users\<Current User>\AppData\Roaming.
%StartMenu% refers to the Windows Start Menu. For Windows 95/98/ME it refers to C:\windows\start menu\, for Windows XP, Vista, NT, 2000 and 2003 it refers to C:\Documents and Settings\<Current User>\Start Menu\, and for Windows Vista/7 it is C:\Users\<Current User>\AppData\Roaming\Microsoft\Windows\Start Menu.
Associated Security Monitor 2012 Windows Registry Information:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Security Monitor
HKEY_CURRENT_USER\Software\Security Monitor
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Security Monitor"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Security Monitor 2012 Security"