Watch Out for Memory Watcher
Memory Watcher is an extremely dangerous piece of adware. It claims to help you monitor your memory so that your computer doesn’t get bogged down. What it really does though is download adware, spyware, Trojans, and dialers. It is also usually bundled with a Trojan when it is downloaded, which further contributes to the flood of malware.
Manual removal of this program is very difficult. Memory Watcher can repair itself if part of the program has been deleted. That is why complete removal is imperative. Using a quality antispyware program is highly recommended.
However, if you want to give manual removal a shot, you must start by stopping these processes in Windows Task Manager:
memorywatcher_b.exe
memorywatcher.exe
uninst.exe
wowex32.exe
jqvgne.exe
mcl7.exe
ncisp.exe
pnkdb03.exe
qbk7x.exe
rpbbf5.exe
sdelh.exe
vchsyjo.exe
wprx.exe
wyrgmw.exe
xtgcu7.exe
zvbyl.exe
memorywatcher_b.exe
wowex32[1].exe
Then, you will want to delete the following registry entries:
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\2#9s2kp4ztk7b@
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\2#myg@j2k5x@kh
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\26ayhse3@8zpx7
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\2dh3bz554zbkry
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\2hhypx@3tn4pxc
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\2kad2lz3h23#ma
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\2ljpns64g5gclq
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\2pkwz@j3fmzmrh
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\2tnw49j45s2ltl
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\2w62w2f5kb2@cy
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\2xr4f6w2w9jjgg
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\2zd2bm23y3xhst
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\33lel3q3xzawbs
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\35sjwd74#zbj36
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\3aczez@23gtazq
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\3gmdsrs2ng449t
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\3lq#pte4s5kqew
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\3p@ypjy3ckbtyz
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\3pw#hs@2n34ja9
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\3yrarps2zt8rwd
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\4#yqtfx5pxdzth
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\47gp8ys4shn7×8
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\4a692ay5nrf@3a
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\4aweywx3kr4jel
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\4b#abzb3lxzlex
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\4gmpqkj5la227a
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\4hkmkb74y4ka78
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\522fqqr2akctsm
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\56t2ewf5lccem6
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\5cp9ql238zgwnf
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\5csjp@x23qlbma
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\5p92l533d5#zq@
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\5prkgek5k6l8xe
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\5rr6pl73h594cx
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\5w48w7a5y87h34
HKEY_LOCAL_MACHINE\software\2qcn@364d3eekk\5yzq#tp4wn82hp
HKEY_LOCAL_MACHINE\software\46cq6434r8hj77\3s63s7t5aha@b4
HKEY_LOCAL_MACHINE\software\46cq6434r8hj77\4g4rh6f5#6l9ch
HKEY_LOCAL_MACHINE\software\memorywatcher
HKEY_LOCAL_MACHINE\software\memorywatcher\install_dir
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\2fndpqy4pt3bdm
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\4g9tkjy5b9c7p9
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\memorywatcher
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\memorywatcher\displayname
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\memorywatcher\uninstallstring
On top of this, you should delete these files:
wowex32[1].exe.
memorywatcher_b.exe in c:\memorywatcher_b.exe in Documents and Settings\UserName\local settings\temp\
memorywatcher.exe in Program Files\
comctl32.ocx
eula.url
memorywatcher.exe
trayicon.ocx
uninst.exe
wowex32.exe in Program Files\memorywatcher\
jqvgne.exe
mcl7.exe
ncisp.exe
pnkdb03.exe
qbk7x.exe
rpbbf5.exe
sdelh.exe
vchsyjo.exe
wprx.exe
wyrgmw.exe
xtgcu7.exe
zvbyl.exe in Windows\system32\
memorywatcher_b.exe in Windows\temp\
Finally, delete the directory called: Program Files\memorywatcher
This will remove Memory Watcher if you can get it done fast enough. However, if Memory Watcher starts to repair itself, then you will be fighting a losing battle. On top of that, you will also have to delete the Trojans and other malware that has been downloaded.
If you want to quickly and completely remove Memory Watcher and all of its malicious buddies, then you should use SpyZooka. SpyZooka is the only antispyware that is guaranteed to remove 100% of spyware. With SpyZooka, your computer will be cleaned up in short order and will protected from all future infections.
