Remove ActMon

ActMon Description

ActMon is a PC monitoring application that tracks user activity, logs all keystrokes, takes screenshots, captures online chat conversations and e-mail messages, records login names, passwords and addresses of visited web sites. Gathered data can be sent to a configurable e-mail address or transferred to a predefined remote host. ActMon is able to hide its running processes. The threat must be manually installed. It automatically runs on every Windows startup.

Remove ActMon

Stop the following ActMon processes:
acmcc.exe
srvprc.exe
wskrnl.exe
wskrnlb.exe

Remove the following ActMon registry keys:
HKEY_LOCAL_MACHINESOFTWAREsrvprc
HKEY_LOCAL_MACHINESOFTWAREwskrnl
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRunsrvprc
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRunwskrnl
HKEY_LOCAL_MACHINESYSTEMControlSet001Serviceswskrnlc
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceswskrnlc
4D36E96B-E325-11CE-BFC1-08002BE10318
HKEY_LOCAL_MACHINESYSTEMControlSet001EnumACPIPNP03034&5289e18&0ControlActiveService=wskrnlc
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumACPIPNP03034&5289e18&0ControlActiveService=wskrnlc
SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorerRunsyswin
SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorerRunwskrnl
syswin
wskrnl

Unregister the following ActMon DLL files:
rbwinx1.dll
wskrnlc.dll
wskrnld.dll
wskrnle.dll
wskrnlb.dll

Delete the following ActMon files:
acmcc.exe
srvprc.exe
wskrnl.exe
wskrnlb.exe
rbwinx1.dll
wskrnlc.dll
wskrnld.dll
wskrnle.dll
wskrnlc.sys
wskrnlb.dll
ActMon_Pro_Computer_Monitoring.lnk
ActMon CM Control Center.lnk
ActMon Computer Monitoring Manual.lnk

Other Spyware

0-9