W97M.Downloader Trojan Horse Removal

This article can help you to remove W97M.Downloader Virus. The step by step removal works for every version of Microsoft Windows.

If your computer is infected with W97M.Downloader, you are in some serious trouble. This parasite is a nasty Trojan horse. W97M.Downloader’s main task is to download and install malware on your PC. The virus is a breach in your security wall. Hackers can use it to access your computer remotely. Unfortunately, this virus has numerous malicious abilities. Trojan horses were originally used to spy on their victims. W97M.Downloader is not an exception. This parasite knows what programs you have installed on your machine, your IP addresses, PC configuration, etc. However, it may also install spyware on your device. And thus, provide its owners with even more information about you. Unfortunately, this complex virus gives its owners unquestionable control over your machine. When you attempt to remove it, you may face difficulties. Upon installation, W97M.Downloader infects your entire system. It creates copies of itself and hides them well. It also adds its own entries in your system registry. This means that the virus will load together with your system. It has no user interface, so you cannot see it. The Trojan runs in the background. You may be able to some of its processes in your Task Manager. Be advised, however. Such sophisticated viruses are experts at covering their tracks. You are lucky to know that W97M.Downloader is present on your computer. Now you can take action against it. To delete the virus manually, you must remove all corrupted files. You must also delete its entries from your system registry. These tasks may be a bit tricky. If you make a mistake and delete essential for your system files, you will end up with the Blue Screen of Death. Therefore, we recommend you to use a trustworthy anti-virus program. Run a full system scan and let the program clean your device.

How did I get infected with?

W97M.Downloader travels the web via spam email attachments. The crooks write on behalf of an unknown organization. They attach a corrupted MS Word file to their emails. The virus is usually present as an invoice or job application. When you open the files, a malicious macro code executes. It downloads the virus from a remote server. To prevent future infections, adopt better security habits. Before you open a message from a stranger, check the sender’s contacts. Simply enter the questionable email address into some search engine. If it was used for shady business, someone might have complained online. This method is not to be trusted blindly. New email addresses are created every second. If you a part of the first spam email wave, there may not be evidence online. So, double-check the sender. If you receive a letter from a company, go to their official website. Compare the emails listed there with the one you have received a message from. If they don’t match, delete the pretender immediately. Also, keep an eye for suspicious signs. Reliable companies will use your real name to address you. Thus, if you receive a letter starting with “Dear Customer,” or “Dear Friend,” proceed with caution. Other virus distribution methods include torrents, malvertising, and fake software updates. The key to a secure and infection-free computer is caution.

Why is this dangerous?

Trojans are feared for a reason. They are highly distinctive and can be deadly. W97M.Downloader is not an exception. This parasite sneaks into your computer unnoticed and wreaks havoc. Unfortunately, we cannot tell you what will happen with your computer. This virus affects its victims in a different manner. It all depends on what the hackers need at the moment. Thus, if they need a cyber-currency miner, they will program the Trojan to turn your device into one. They may also turn your PC into a part of a Botnet. In some states, being part of illegal Botnet is a reason enough for legal actions to be taken against you. There are numerous possibilities. One thing is known for sure, you will not like the outcome. The W97M.Downloader Trojan is a serious threat to you and your security. The hackers behind it are criminals. Can you imagine what may happen if the virus provide them with sensitive information about you? Do not use your infected computer for online banking. Use a trustworthy anti-virus app and remove the W97M.Downloader Trojan ASAP! The sooner you clean your machine, the better!

Manual W97M.Downloader Removal Instructions

The W97M.Downloader infection is specifically designed to make money to its creators one way or another. The specialists from various antivirus companies like Bitdefender, Kaspersky, Norton, Avast, ESET, etc. advise that there is no harmless virus.

If you perform exactly the steps below you should be able to remove the W97M.Downloader infection. Please, follow the procedures in the exact order. Please, consider to print this guide or have another computer at your disposal. You will NOT need any USB sticks or CDs.

WARNING! Stopping the wrong file or deleting the wrong registry key may damage your system irreversibly.
If you are feeling not technical enough just use Spyhunter Professional Malware Removal Tool to deal with the problem!
>>Download SpyHunter – a Professional Remover.

Please, keep in mind that SpyHunter’s scanner tool is free. To remove the W97M.Downloader infection, you need to purchase its full version.

STEP 1: Track down W97M.Downloader related processes in the computer memory

STEP 2: Locate W97M.Downloader startup location

STEP 3: Delete W97M.Downloader traces from Chrome, Firefox and Internet Explorer

STEP 4: Undo the damage done by the virus

STEP 1: Track down W97M.Downloader related processes in the computer memory

• Open your Task Manager by pressing CTRL+SHIFT+ESC keys simultaneously
• Carefully review all processes and stop the suspicious ones.

• Write down the file location for later reference.

Step 2: Locate W97M.Downloader startup location

Reveal Hidden Files

• Open any folder
• Click on “Organize” button
  
• Choose “Folder and Search Options”
• Select the “View” tab
• Select “Show hidden files and folders” option
• Uncheck “Hide protected operating system files”
• Click “Apply” and “OK” button

Clean W97M.Downloader virus from the windows registry

• Once the operating system loads press simultaneously the Windows Logo Button and the R key.

• A dialog box should open. Type “Regedit”

• WARNING! be very careful when editing the Microsoft Windows Registry as this may render the system broken.

Depending on your OS (x86 or x64) navigate to:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

• and delete the display Name: [RANDOM]

• Then open your explorer and navigate to: %appdata% folder and delete the malicious executable.

Clean your HOSTS file to avoid unwanted browser redirection

Navigate to %windir%/system32/Drivers/etc/host

If you are hacked, there will be foreign IPs addresses connected to you at the bottom. Take a look below:

Step 4: Undo the possible damage done by W97M.Downloader

This particular Virus may alter your DNS settings.

Attention! this can break your internet connection. Before you change your DNS settings to use Google Public DNS for W97M.Downloader, be sure to write down the current server addresses on a piece of paper.

To fix the damage done by the virus you need to do the following.

• Click the Windows Start button to open the Start Menu, type control panel in the search box and select Control Panel in the results displayed above.
• go to Network and Internet
• then Network and Sharing Center
• then Change Adapter Settings
• Right-click on your active internet connection and click properties. Under the Networking tab, find Internet Protocol Version 4 (TCP/IPv4). Left click on it and then click on properties. Both options should be automatic! By default it should be set to “Obtain an IP address automatically” and the second one to “Obtain DNS server address automatically!” If they are not just change them, however if you are part of a domain network you should contact your Domain Administrator to set these settings, otherwise the internet connection will break!!!

 

• Check your scheduled tasks to make sure the virus will not download itself again.

How to Permanently Remove W97M.Downloader Virus (automatic) Removal Guide

Please, have in mind that once you are infected with a single virus, it compromises your whole system or network and let all doors wide open for many other infections. To make sure manual removal is successful, we recommend to use a free scanner of any professional antimalware program to identify possible virus leftovers or temporary files.