Trojan.Win32.LinkReplacer Removal Process
December 13, 2007 – 5:36 pmTrojan.Win32.LinkReplacer is a new rogue anti-spyware program, which is a form of fake malicious software engineered by Internet hackers. It is a variant of Trojan.Win32 or Trojan.Win32.agent.akk. “Your browser was infected by Trojan.Win32.LinkReplacer” error message might appears in your screen.
Trojan.Win32.LinkReplacer is not a virus by itself, but it is a fake anti-spyware program. Do NOT purchase Trojan.Win32.LinkReplacer under any circumstances since it is a fake anti-spyware software.
The following process will help you remove it from your system easily and safely.
Trojan.Win32.LinkReplacer Manual Removal Process:
1. Click on the Start Menu button, then click on the Control Panel option, and then Double-click on the Add or Remove Programs icon.
2. Locate Trojan.Win32.LinkReplacer and double-click on it to uninstall Trojan.Win32.LinkReplacer. Follow the screen step-by-step screen instructions to complete uninstallation of Trojan.Win32.LinkReplacer. Do not worry about this if you cannot find it in Add/Remove window. Simply skip to #5.
3. Restart the computer.
4. When it has completed uninstalling you can close Add or Remove Programs and your Control Panel.
5. Close all programs.
6. Search and delete the following infected entries in registry. If you do not know how to edit registry, click here to read more.
bcf3a381bbe26d9c1ec24bac8b18f567
8266c79a434aed795a5f3f7abb0aff0d
696ce23305a35bb118afc42d58845791
2982068d063848ddb0b8029750411a84
fe6e6a62a572e84e9eaee12eb3ee8a2b
7df5417b22988d88e8080a44392ade95
cbdc7b3033e82c2065a1b48061b2ca01
6d3c4dbecf4aaf1ae826a0a7edde5951
e05997f932f826f0271cf32d00bbd3be
c18c3b4771120703624baaf835feecd8
9ceecf911241c9890541167edf53739f
40613dee6ad5fec910606c25b25262fd
3ba096caa45ab117721e725079cc53a1
bb5be1c92c299a1c6bcfe67655b0a0c7
9a9f57899a28547b04fc2da3700c95cf
7a329404de21925daacbbbee093ff6dc
7d4b39e4cab018496e2fe9bf9c3234b2
69c9be662f7f284aae171adeb136cb24
1bc5752bd72f44f004d9f061dd7f9e00
1057a2dcd13130963be0a51c41dc4d1c
396955766b2e512bc3545a24bc485dbe
5f9523529ce2cac480acbda2b8bf4e1e
7. Stop Trojan.Win32.LinkReplacer process. If you do not know how to stop a running process, click here to read more.
8. Find and delete the following infected files from your system.
mlljh.dll
ibpmxtbv.dll
ljjhedc.dll
cabvie.dll
windivx.dll
ddayv.dll
vkcxxfvi.dll
ssqpo.dll
tdlRMS.dll
lcxmehhg.dll
hdbxuqje.dll
mljge.dll
ddcbyvt.dll
advrepkon.dll
ddccd.dll
sgqddvym.dll
pofwjina.dll
bkfgnqhm.dll
orkbobob.dll
tuvttrr.dll
cpwvehup.dll
enhtb.dll
stream32a.dll
vipextqtr.dll
ecxwp.dll
gebca.dll
ddcdedd.dll
advpac.dll
If you do not know how to find it or having difficulties locating the file, click here to read more.
9. Rename the files that you found above to “foundbadfile1.dll” and “foundbadfile2.dll” (if you can not rename this file, then try to restart your computer in safe mode then try to rename this file.) If you don’t know how to start the computer in safe mode, click here to read more.
10. Go to C:\Program Files\ folder and delete the “IE Defender” folder (if you can’t delete it, reboot your computer to safe mode then delete the folder. Do not worry about it if you can’t find this folder.)
11. Click here to bookmark this page (you will need to comeback to this page after reboot)
(If you are using Firefox click on Ctrl+D on your keyboard to bookmark this page)
12. Restart your computer
13. Go to your computer and delete the “foundbadfile1.dll” and “foundbadfile2.dll” file
14. You have just removed Trojan.Win32.LinkReplacer from your computer manually.
Remove Trojan.Win32.LinkReplacer with SmithfraudFix:
SmithfraudFix is a free tool that S!Ri created to remove fake anti-spyware programs. It can be risky so we cannot guarantee the result. Please use it with reservations. We would never recommend to purchase anything unless it’s necessary. That’s why we produce this free removal process.
1. Download SmithfraudFix tool and save it to your desktop.
2. Restart your computer and boot into Safe Mode. If you don’t know how to start the computer in safe mode, click here to read more.
3. Double-click on the SmithfraudFix.exe icon then follow the screen instructions. Option #2 should be selected in this case.
4. When you are prompted with “Do you want to clean the registry ?”, simply answer “Y”.
5. Reboot.
6. You should have removed Trojan.Win32.LinkReplacer from your computer. Sometimes it might take more than once to work properly. If SmithfraudFix removal tool does not work, which is in no-guarantee due to the nature of spyware, please refer to the manual removal steps above or purchase a legitimate removal tool if necessary.
(Disclaimers: These instructions are free and not guaranteed to work. Please use it at your own risks. We are not responsible for any damages.)
8 Responses to “Trojan.Win32.LinkReplacer Removal Process”
before you spend all this time doing this see if you have msvideo.dll in your windows file. if you do restart in safe mode and delete it and this will all go away. DO NOT DELETE MSVIDEO.DLL IN THE SYSTEM32 FILE AS THIS IS THE ORIGONAL AND NOT INFECTED. good luck
By jeremy on Dec 14, 2007
can norton or mcaffee find these things as a threat? or does it get bypassed
i ran a nortons scan of whole comp and nothing
havent ran mcaffee yet..hopin that will work
if not ill have to find the fuckin .dll file
is there any easier way? than the shit listed above?
By aaron on Dec 14, 2007
Worked. I never clicked “OK” when it said to download….but the popup continued everytime you opened an browser or surfed. I knew it happened the night before….so did a file search for “msvideo”. It came up with three choices but only one with yesterday’s date…and without the /SYSTEM attached with it……deleted it and jeremy was correct….problem went away. Thanks…do this first if you did not get fooled and download the bogus software as the popup tells you to.
By bob on Dec 14, 2007
Alright,
My computer is infected and there has to be an easier way then what you have here. I go and I can’t find the file…anywhere. Someone give me some insite in to how to do this.
By Mike on Dec 14, 2007
Jeremy’s right…everyone just do what he says.
By Rick on Dec 15, 2007
I followed Jeremy’s directions, but how do I know its gone?
By Tony on Dec 15, 2007
i went to where jeremy said to go and it kept telling me i couldn’t delete it b/c it was open in another program. how do i find this program??
By courtney on Dec 15, 2007
Thanks Jeremy
Your steps worked just fine. After booting the system in safe mode and removing the file, then rebooting in normal mode cleared the problem.
By Bob on Dec 17, 2007