Printable View
Hi,
Recently I visited a spanish website for an article. After opening the site a pop up come up saying that there is virus in my system. I run the scan and a antivirus named Nortel was installed. My friend told me that it is a fake antivirus. It installed more threats to the system instead of cleaning. Now whenever I go online it comes again prompting virus alert. How to remove this buggy tool.
It is a malware tool. You must not install such fake recommendation online. Now press Ctrl + Alt + Del and under process tab look for the file name. Kill the process and search for the relevant file. Delete it. The virus normally creates a folder in program files of its name. Delete the same under safe mode. If possible run a antimalware tool.
The fake antivirus creates this files in your computer. They are WinAvXX.exe, wox.exe and mrgdll.exe. This files are created by the virus. You will have to first kill the process by using Task Manager and then your can launch a search process under safe mode. After that run registry editor. Go to the following path and delete the file listed. Click on Run and type Regedit. Navigate to the following path - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”[RANDOM NAME]” = “C:\ProgramData\nol\mrgdll.exe” & HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”[RANDOM NAME]” = “C:\ProgramData\nol\wox.exe”
HKEY_CURRENT_USER\Software\wox
Nortel is a fake antivirus and a malicious tool. After installation it creates a .exe file in your Windows directory which is runs automatically. First delete this files. C:\ProgramData\nol\wox.exe, C:\ProgramData\nol\mrgdll.exe, C:\Documents and Settings\All Users\Application Data\nol\wox.exe, C:\Documents and Settings\All Users\Application Data\nol\mrgdll.exe and C:\ProgramData\nol\. Delete the files wox.exe from each folder listed. Then run a registry repairer tool.