AcidShivers Removal Instructions

Description:

Acid shiver is a trojan that has a lot of damaging abilities. It opens a dynamic port each time, Meaning it changes every time the victim comes online and sends the victims ip number and what port has been opened to the hacker by email.

Warning:

This page provides AcidShivers removal information "AS IS" without a warranty of any kind. You are advised not to use this information if you are not aware of what you are doing. It must be noted that wrongly using the below given information to remove AcidShivers from you PC may generated unexpected results. You must take a registry back and create a System Restore Point before following the below given instructions.

Important Instructions:

Please do not delete any directory unless you are sure that it is related with AcidShivers. Check 'C:\Program Files\', 'C:\Temp', 'C:\Tmp', 'C:\Documents and Settings\(your profile name)\Local Settings\Temp' and/or 'C:\Documents and Settings\All Users\Local Settings\Temp' for these directories. These directories may also exists in 'C:\Windows' directory but deleting a legitimate directory from 'C:\Windows' or sub directories may result in system failure so make sure you have found what you were looking for before deleting any directory. Always use 'System Restore' before following spyware removal instructions.
Files created by AcidShivers must be removed either by using Add / Remove Programs Utility or simply deleting them using Windows Explorer. Note that some EXE files that are running i.e. processes, will not be deleted unless you use Task Manager to kill these processes.
Please take a registry backup using 'regedit.exe' or create a system restore point using 'System Restore Utility' before following these steps. Note that removing legitimate registry entries may result in a system crash.

Remove these directories:

AcidShivers does not create any directories

Remove these files:

%windir% \ wintour.exe

Remove these registry keys:

AcidShivers does not create any registry keys

Remove these registry key values:

HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run \ Wintour
Wintour
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ RunServices \ Explorer

Copyright © 2004-2006 PCPrivacySolutions.com - All rights reserved.

We do not endorse any of the companies, products, or services mentioned on this website. Each product or
service is the trademark of their respective company and all information is provided as opinions only.