Jump to content

Removal instructions for Wordinator


Recommended Posts

  • Staff

What is Wordinator?

 

The Malwarebytes research team has determined that Wordinator is adware. These adware applications display advertisements not originating from the sites you are browsing.

 

How do I know if my computer is affected by Wordinator?

You may see this entry in your list of installed programs:

 

warning4.png

and these warnings during install:

main.png

warning1.png

and this type of advertisements:

warning2.png

 

How did Wordinator get on my computer?

 

Adware applications use different methods for distributing themselves. This particular one was bundled with other software.

 

How do I remove Wordinator?

 

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.

  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-version.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to the following:
    • Enable free trial of Malwarebytes Anti-Malware Premium
    • Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • If an update is found, you will be prompted to download and install the latest version.
  • Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
  • When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
  • Reboot your computer if prompted.
Is there anything else I need to do to get rid of Wordinator?
  • No, Malwarebytes' Anti-Malware removes Wordinator completely.
How would the full version of Malwarebytes Anti-Malware help protect me?

 

We hope our application and this guide have helped you eradicate this hijacker.  

 

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Wordinator adware. It would have warned you before the rogue could install itself, giving you a chance to stop it before it became too late.

 

protection1.png

Technical details for experts

 

You will see this sign in a HijackThis log:

O23 - Service: WN 1.10.0.17 Client Service (wsvc_1.10.0.17) - WN - C:\Program Files\Wordinator_1.10.0.17\Service\wsvc.exe
 

You may see these signs in FRST logs:

 (WN) C:\Program Files\Wordinator_1.10.0.17\Service\wsvc.exe R2 wsvc_1.10.0.17; C:\Program Files\Wordinator_1.10.0.17\Service\wsvc.exe [278616 2015-06-03] (WN) R1 wfd_1_10_0_17; C:\Windows\System32\drivers\wfd_1_10_0_17.sys [52736 2015-06-03] (WN) C:\Program Files\Wordinator_1.10.0.17 (WN) C:\Windows\system32\Drivers\wfd_1_10_0_17.sysWordinator 1.10.0.17 (HKLM\...\Wordinator_1.10.0.17) (Version: 1.10.0.17 - Wordinator)
 

 

Alterations made by the installer:

File system details [View: All details] (Selection)---------------------------------------------------    Adds the folder C:\Program Files\Wordinator_1.10.0.17       Adds the file terms-of-service.rtf"="5/30/2015 1:13 AM, 24149 bytes, A       Adds the file Uninstall.exe"="6/3/2015 7:07 PM, 321736 bytes, A    Adds the folder C:\Program Files\Wordinator_1.10.0.17\3rd Party Licenses       Adds the file buildcrx-license.txt"="5/19/2014 9:10 PM, 7074 bytes, A       Adds the file Info-ZIP-license.txt"="5/19/2014 9:10 PM, 2944 bytes, A       Adds the file JSON-simple-license.txt"="10/30/2014 2:55 AM, 11558 bytes, A       Adds the file nsJSON-license.txt"="5/19/2014 9:10 PM, 809 bytes, A       Adds the file Nustache-license.txt"="10/30/2014 2:55 AM, 1079 bytes, A       Adds the file TaskScheduler-license.txt"="10/30/2014 2:55 AM, 0 bytes, A       Adds the file UAC-license.txt"="5/19/2014 9:10 PM, 956 bytes, A    Adds the folder C:\Program Files\Wordinator_1.10.0.17\Service       Adds the file wsvc.exe"="6/3/2015 7:07 PM, 278616 bytes, A    In the existing folder C:\Windows\System32\drivers       Adds the file wfd_1_10_0_17.sys"="6/3/2015 7:06 PM, 52736 bytes, ARegistry details [View: All details] (Selection)------------------------------------------------    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wordinator_1.10.0.17]       "DisplayIcon"="REG_SZ", "C:\Program Files\Wordinator_1.10.0.17\Uninstall.exe"       "DisplayName"="REG_SZ", "Wordinator 1.10.0.17"       "DisplayVersion"="REG_SZ", "1.10.0.17"       "NoModify"="REG_DWORD", 1       "NoRepair"="REG_DWORD", 1       "Publisher"="REG_SZ", "Wordinator"       "UninstallString"="REG_SZ", "C:\Program Files\Wordinator_1.10.0.17\Uninstall.exe"       "URLInfoAbout"="REG_SZ", "http://www.wordinatorapp.com"    [HKEY_LOCAL_MACHINE\SOFTWARE\Wordinator_1.10.0.17]       "cr-at"="REG_SZ", ""       "cr-pid"="REG_SZ", ""       "cr-ver"="REG_SZ", "43.0.2357.124"       "dbsr"="REG_SZ", "iexplore"       "features"="REG_SZ", "0x01000000"       "ff-at"="REG_SZ", ""       "ff-pid"="REG_SZ", ""       "ff-ver"="REG_SZ", "25.0 (en-US)"       "hid"="REG_SZ", "99B84D34-775B-F8F2-2E33-C48517F1E2F6"       "ie-at"="REG_SZ", ""       "ie-pid"="REG_SZ", ""       "ie-ver"="REG_SZ", "11.0.9600.17843"       "iid"="REG_SZ", "00000000-0000-0000-0000-000000000000"       "itm"="REG_SZ", "2015-06-11T14:44:49Z"       "nf-at"="REG_SZ", "11BE4EF3-D51B-6E52-CEA6-FDF7BD4B0912"       "nf-pid"="REG_SZ", "B49A48F0-814E-4D81-91DC-8859B98F1FB1"       "nid"="REG_SZ", "8D41449E-BF91-4FFA-A606-498E2B5BF005"       "osn"="REG_SZ", "Windows 7 Ultimate N"       "ost"="REG_SZ", "x32"       "osv"="REG_SZ", "6.1.7601"       "user_sid"="REG_SZ", "S-1-5-21-4016700205-1717049133-1125222536-1001"       "ver"="REG_SZ", "1.10.0.17"    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wfd_1_10_0_17]       "DisplayName"="REG_SZ", "wfd_1_10_0_17"       "ErrorControl"="REG_DWORD", 1       "Group"="REG_SZ", "PNP_TDI"       "ImagePath"="REG_EXPAND_SZ, "system32\drivers\wfd_1_10_0_17.sys"       "Start"="REG_DWORD", 1       "Tag"="REG_DWORD", 10       "Type"="REG_DWORD", 1    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wfd_1_10_0_17\Enum]       "0"="REG_SZ", "Root\LEGACY_WFD_1_10_0_17\0000"       "Count"="REG_DWORD", 1       "NextInstance"="REG_DWORD", 1    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wsvc_1.10.0.17]       "Description"="REG_SZ", "This service enables WN 1.10.0.17 on HTTP websites"       "DisplayName"="REG_SZ", "WN 1.10.0.17 Client Service"       "ErrorControl"="REG_DWORD", 1       "ImagePath"="REG_EXPAND_SZ, ""C:\Program Files\Wordinator_1.10.0.17\Service\wsvc.exe""       "ObjectName"="REG_SZ", "LocalSystem"       "Start"="REG_DWORD", 2       "Type"="REG_DWORD", 16
Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 6/11/2015Scan Time: 4:52:21 PMLogfile: mbamWordinator.txtAdministrator: YesVersion: 2.01.6.1022Malware Database: v2015.06.11.03Rootkit Database: v2015.06.02.01License: FreeMalware Protection: DisabledMalicious Website Protection: DisabledSelf-protection: DisabledOS: Windows 7 Service Pack 1CPU: x86File System: NTFSUser: MalwarebytesScan Type: Threat ScanResult: CompletedObjects Scanned: 294073Time Elapsed: 4 min, 22 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: DisabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 1PUP.Optional.Wordinator.A, C:\Program Files\Wordinator_1.10.0.17\Service\wsvc.exe, 1828, Delete-on-Reboot, [501f7d3c25655bdbf12096e54fb7cb35]Modules: 0(No malicious items detected)Registry Keys: 4PUP.Optional.Wordinator.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\wsvc_1.10.0.17, Quarantined, [501f7d3c25655bdbf12096e54fb7cb35], PUP.Optional.Wordinator.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\wfd_1_10_0_17, Quarantined, [90df7841eaa078be20f1c1bada2c07f9], PUP.Optional.Wordinator.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Wordinator_1.10.0.17, Quarantined, [e38ca8114a4020168a87a4d77d89e818], PUP.Optional.Wordinator.A, HKLM\SOFTWARE\Wordinator_1.10.0.17, Quarantined, [fa751e9b2565ce6800ffc4c610f5e020], Registry Values: 0(No malicious items detected)Registry Data: 0(No malicious items detected)Folders: 3PUP.Optional.Wordinator.A, C:\Program Files\Wordinator_1.10.0.17, Delete-on-Reboot, [abc4e9d079111323696c47a4ba497b85], PUP.Optional.Wordinator.A, C:\Program Files\Wordinator_1.10.0.17\3rd Party Licenses, Quarantined, [abc4e9d079111323696c47a4ba497b85], PUP.Optional.Wordinator.A, C:\Program Files\Wordinator_1.10.0.17\Service, Delete-on-Reboot, [abc4e9d079111323696c47a4ba497b85], Files: 17PUP.Optional.Wordinator.A, C:\Program Files\Wordinator_1.10.0.17\Service\wsvc.exe, Delete-on-Reboot, [501f7d3c25655bdbf12096e54fb7cb35], PUP.Optional.Wordinator.A, C:\Windows\System32\drivers\wfd_1_10_0_17.sys, Quarantined, [90df7841eaa078be20f1c1bada2c07f9], PUP.Optional.Wordinator.A, C:\Users\{username}\Desktop\wordinator-setup-1.10.0.17.exe, Quarantined, [cca38633b9d141f5050cd7a4bb4b3fc1], PUP.Optional.Wordinator.A, C:\Program Files\Wordinator_1.10.0.17\Uninstall.exe, Quarantined, [e38ca8114a4020168a87a4d77d89e818], PUP.Optional.Vitruvian.A, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-hardwareprofile-v0001, Quarantined, [91de8c2dcfbb4beb36f622577d88c937], PUP.Optional.Vitruvian.A, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-install-v0003, Quarantined, [b3bc7346404a38fe17158beeb352f907], PUP.Optional.Vitruvian.A, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-processes-v0002, Quarantined, [511e2b8e5e2cdb5b210b6b0e59ac50b0], PUP.Optional.Vitruvian.A, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-scheduledtasks-v0001, Quarantined, [b6b9dfdaf397f343fa3281f8f70ecf31], PUP.Optional.Vitruvian.A, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-softwareregkeys-v0002, Quarantined, [91de2990bfcb93a349e371084abb9868], PUP.Optional.Wordinator.A, C:\Program Files\Wordinator_1.10.0.17\terms-of-service.rtf, Quarantined, [abc4e9d079111323696c47a4ba497b85], PUP.Optional.Wordinator.A, C:\Program Files\Wordinator_1.10.0.17\3rd Party Licenses\buildcrx-license.txt, Quarantined, [abc4e9d079111323696c47a4ba497b85], PUP.Optional.Wordinator.A, C:\Program Files\Wordinator_1.10.0.17\3rd Party Licenses\Info-ZIP-license.txt, Quarantined, [abc4e9d079111323696c47a4ba497b85], PUP.Optional.Wordinator.A, C:\Program Files\Wordinator_1.10.0.17\3rd Party Licenses\JSON-simple-license.txt, Quarantined, [abc4e9d079111323696c47a4ba497b85], PUP.Optional.Wordinator.A, C:\Program Files\Wordinator_1.10.0.17\3rd Party Licenses\nsJSON-license.txt, Quarantined, [abc4e9d079111323696c47a4ba497b85], PUP.Optional.Wordinator.A, C:\Program Files\Wordinator_1.10.0.17\3rd Party Licenses\Nustache-license.txt, Quarantined, [abc4e9d079111323696c47a4ba497b85], PUP.Optional.Wordinator.A, C:\Program Files\Wordinator_1.10.0.17\3rd Party Licenses\TaskScheduler-license.txt, Quarantined, [abc4e9d079111323696c47a4ba497b85], PUP.Optional.Wordinator.A, C:\Program Files\Wordinator_1.10.0.17\3rd Party Licenses\UAC-license.txt, Quarantined, [abc4e9d079111323696c47a4ba497b85], Physical Sectors: 0(No malicious items detected)(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.

We use different ways of protecting your computer(s):

  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
Link to post
Share on other sites

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.