Click on screenshot to zoom
Danger level 7
Type: Trojans

Threat Finder

Threat Finder is a computer infection that is extremely dangerous and irritating. Even though Threat Finder cannot download more malware, that you would need to remove, or hijack your personal accounts, this clandestine threat is annoying because it can encrypt your personal files. Once the attack is in full swing, the infection presents a notification indicating that the files will be decrypted only if you pay a certain sum of money. Do you want to learn how to remove Threat Finder and how to restore your personal files? If you do, read this report and check the removal guide.

The devious Threat Finder is no better than ZeroLocker, CTB-Locker, or other infamous ransomware threats that can encrypt personal files. Note that the mentioned infections also require removal, and they could attack your computer as soon as you delete Threat Finder itself. These malicious threats can be distributed using various drive-by download and social engineering scams, but it is most likely that you will encounter Threat Finder after opening a corrupted spam email attachment. Once executed, the infection will encrypt your personal files, which means that you will not be able to open them unless you obtain the so-called private key. Here are a few extracts from the Threat Finder notification.

Warning! Your personal files are encrypted!
Don’t switch off your computer and/or internet, otherwise your key will be disabled
Your important files encryption produced on this computer: photos, videos, documents, etc. Here is a complete list of encrypted files, and you can personally verify this.

To obtain the private key for this computer, which will automatically decrypt files, you need to pay 300 USD / 300 EUR / similar amount in another currency.

The intimidating notification is followed by a disclaimer indicating that if you try to remove or damage Threat Finder, the private key will be destroyed, meaning that you will not be able to restore your own files, and there will be nothing left to do but remove them. Obviously, this is not a big deal if you have created backups for your personal photos, videos, documents, and other files. However, if your only copies are encrypted, you might be tempted to pay the $300 ransom. Even though it is terrible to have your personal files removed, we warn you that there are no guarantees that the payment will work. In the worst case scenario, your money will be gone together with your files.

Our malware researchers warn that there isn’t much to do once Threat Finder corrupts your operating system. If you are willing to take the risk, you will pay the requested ransom, but first we recommend using alternative decryption software that might be able to help you restore files for free. Regardless of the outcome regarding your files, you need to delete Threat Finder from your operating system, and we have prepared a guide that will help you install automatic malware removal software. Use this software to remove Threat Finder components.

Threat Finder Removal

Remove from Windows XP

  1. Restart the PC and wait for the BIOS screen to load.
  2. Immediately start tapping F8 to access the Windows Advanced Options Menu.
  3. Using arrow keys on your keyboard choose Safe Mode with Networking and tap Enter.
  4. Click Yes on the Windows is running in safe mode notification.
  5. Launch the browser and visit http://www.pcthreat.com/download-sph .
  6. Download the automatic malware detection and removal tool SpyHunter.
  7. Install the application, run a system scan, and delete the detected threats.

Remove from Windows Vista or Windows 7

  1. Restart the PC and wait for the BIOS screen to load.
  2. Immediately start tapping F8 to access the Advanced Boot Options menu.
  3. Using arrow keys on your keyboard choose Safe Mode with Networking and tap Enter.
  4. Go to http://www.pcthreat.com/download-sph and download a malware remover.
  5. Use the application to scan the computer and delete all existing threats.

Remove from Windows 8 or Windows 8.1

  1. Click the Power Options button at the top of the Metro UI start screen.
  2. Press and hold the Shift key and then click Restart to open the Troubleshoot menu.
  3. Select Advanced options and choose Windows Startup Settings.
  4. Reboot your PC in Safe Mode with Networking by selecting the F5 option.
  5. Download a reliable security tool from http://www.pcthreat.com/download-sph .
  6. Delete all computer infections using the tool.
Download Spyware Removal Tool to Remove* Threat Finder
  • Quick & tested solution for Threat Finder removal.
  • 100% Free Scan for Windows
disclaimer

How to manually remove Threat Finder

Files associated with Threat Finder infection:

skype.dat
%APPDATA%\system
wjthvwjb.dss
ubvhynpxh.exe
wahneaqa.exe
00b5d693.exe
jsdhlexdqkllnbcxgai.bfg
iner.exe
install_0_msi.exe
Task Scheduler.exe
00qbipeq.exe
p1.exe
Piranha.exe
%APPDATA%\Task Scheduler
%CommonProgramFiles%
csrsss.exe
audipbrd.exe
acuvzomo.exe
Q3d38543.exe
C87C.exe
2084473.dll
zqmkrehUkpoKfsafsaZg.exe
rool0_pk.exe
setex.exe
sqlncli.exe
msavfit.exe
obvwo.exe
WINDED6.exe
50E1.exe
Updating.exe
Other.res
%WINDIR%\system32
%TEMP%
ctfmon.exe
xctqakcqbeo.dll
aPr0hY9.exe
{097444e7-2d87-ba3c-2efe-9f54812d824a}.exe
MusicCollector.exe
m2PythonLoader.exe
msn.exe
JfCqQ5JC.exe
ACEIEAddOn.dll
securitywindrv.exe
wgsdgsdgdsgsd.exe
uenovfiu.exe
b34btbztdb0vavaw.exe
wpbt0.dll
bzsbkotiu.exe
n.
dyjdl.exe
UpdatePriv.exe
mplayer2.exe
taskhost.exe.exe
%APPDATA%\updates
systemcpl.exe
%SystemDrive%\????????????
%LOCALAPPDATA%\Temp
administration.exe
%WINDIR%\Temp
svchost.exe
bvhylsviw.exe
ssntvs.exe
dqnbdq7.dss
idiokbbrv.exe
videotwisterSA.exe
96dddda4.dll
pYunY8m4VL3qLc.exe
brenasa.exe
87b2cb3916261d5c807bf44262755cb0.exe
%LOCALAPPDATA%\lollipop
xaZYOVJW.exe
Firewallservice.exe
wlsidten.dll
SyncHostps.exe
cf6640a77ed4926a4c6be661ab93def9d13408753dd07e8d02836996a2f247b6.exe
%AppData%
TimeDateMUICallback.exe
hwj3ba6j.dss
msshell.exe
NTServiceManager.exe
rvcbcyks.exe
scvhost.exe
魔法桌面第三方主题破解补丁V1.1.exe
xlqbteeb.exe
crack.exe
secproc_isv.exe
WinSyncMetastore.exe
%UserProfile%
xmlfilter.exe
OmaSG21e.exe
msnmsgrr.exe
puozlkmyj.dll
oygqyunapnp.exe
gcrwcoak.exe
bf8h8d02hf.exe
dtkmujvo.exe
VaultSysUi.exe
3511172082012Build.exe
Nbt.exe
DA0B.exe
wlsidten.exe
ex3b.dll
ieudator.dll
msdtmsrd.exe
UpgradeHelper.exe
questscan.dll
yaiiwockc.dll
pmstcdjwz.exe
comeo.exe
ifgxpers.exe
DLL321.dll
najeoxtt.exe
%ALLUSERSPROFILE%\Application Data
%ALLUSERSPROFILE%

Threat Finder DLL's to remove:

DLL321.dll
puozlkmyj.dll
96dddda4.dll
ieudator.dll
ex3b.dll
2084473.dll
wpbt0.dll
ACEIEAddOn.dll
xctqakcqbeo.dll
wlsidten.dll
questscan.dll
yaiiwockc.dll

Threat Finder processes to kill:

msshell.exe
Nbt.exe
gcrwcoak.exe
bvhylsviw.exe
oygqyunapnp.exe
sqlncli.exe
p1.exe
00b5d693.exe
Updating.exe
rvcbcyks.exe
wgsdgsdgdsgsd.exe
idiokbbrv.exe
securitywindrv.exe
C87C.exe
obvwo.exe
m2PythonLoader.exe
audipbrd.exe
Piranha.exe
pmstcdjwz.exe
Q3d38543.exe
bzsbkotiu.exe
00qbipeq.exe
msdtmsrd.exe
acuvzomo.exe
UpdatePriv.exe
msn.exe
dtkmujvo.exe
UpgradeHelper.exe
JfCqQ5JC.exe
msnmsgrr.exe
50E1.exe
TimeDateMUICallback.exe
xmlfilter.exe
{097444e7-2d87-ba3c-2efe-9f54812d824a}.exe
MusicCollector.exe
msavfit.exe
xaZYOVJW.exe
dyjdl.exe
DA0B.exe
systemcpl.exe
install_0_msi.exe
Firewallservice.exe
mplayer2.exe
NTServiceManager.exe
comeo.exe
brenasa.exe
87b2cb3916261d5c807bf44262755cb0.exe
Task Scheduler.exe
wahneaqa.exe
WINDED6.exe
ssntvs.exe
b34btbztdb0vavaw.exe
ubvhynpxh.exe
svchost.exe
VaultSysUi.exe
uenovfiu.exe
OmaSG21e.exe
rool0_pk.exe
SyncHostps.exe
ctfmon.exe
taskhost.exe.exe
setex.exe
csrsss.exe
3511172082012Build.exe
administration.exe
najeoxtt.exe
aPr0hY9.exe
wlsidten.exe
魔法桌面第三方主题破解补丁V1.1.exe
iner.exe
xlqbteeb.exe
crack.exe
bf8h8d02hf.exe
secproc_isv.exe
scvhost.exe
zqmkrehUkpoKfsafsaZg.exe
ifgxpers.exe
cf6640a77ed4926a4c6be661ab93def9d13408753dd07e8d02836996a2f247b6.exe
pYunY8m4VL3qLc.exe
WinSyncMetastore.exe
videotwisterSA.exe
Disclaimer

Post comment — WE NEED YOUR OPINION!

Comment:
Name:
Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.