Jump to content

Removal instructions for WordWizard


Recommended Posts

  • Staff

What is WordWizard?

The Malwarebytes research team has determined that WordWizard is adware. These adware applications display advertisements not originating from the sites you are browsing.

How do I know if my computer is affected by WordWizard?

You may see this entry in your list of installed programs:

warning4.png

and these warnings during install:

main.png

warning1.png

these Scheduled Tasks:

warning3.png

and this type of pop-ups:

warning2.png

How did WordWizard get on my computer?

Adware applications use different methods for distributing themselves. This particular one was bundled with other software.

How do I remove WordWizard?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.

  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-version.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to the following:
    • Enable free trial of Malwarebytes Anti-Malware Premium
    • Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • If an update is found, you will be prompted to download and install the latest version.
  • Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
  • When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
  • Reboot your computer if prompted.
Is there anything else I need to do to get rid of WordWizard?
  • No, Malwarebytes' Anti-Malware removes WordWizard completely.
How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this adware application.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the WordWizard adware. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

protection1.png

Technical details for experts

You will see these signs in a HijackThis log:

O23 - Service: WordWizard 1.10.0.24 Client Service (wwsvc_1.10.0.24) - WordWizard - C:\Program Files (x86)\WordWizard_1.10.0.24\Service\wwsvc.exe
You may see these signs in FRST logs:

 (WordWizard) C:\Program Files (x86)\WordWizard_1.10.0.24\Service\wwsvc.exe R2 wwsvc_1.10.0.24; C:\Program Files (x86)\WordWizard_1.10.0.24\Service\wwsvc.exe [301656 2015-09-02] (WordWizard) R1 wwfd_vt_1_10_0_24; C:\Windows\System32\drivers\wwfd_vt_1_10_0_24.sys [61312 2015-09-02] (WordWizard) C:\Windows\System32\Tasks\WordWizard Auto Updater 1.10.0.24 Pending Update C:\Windows\System32\Tasks\WordWizard Auto Updater 1.10.0.24 Core C:\Program Files (x86)\WordWizard_1.10.0.24 (WordWizard) C:\Windows\system32\Drivers\wwfd_vt_1_10_0_24.sys (WordWizard) C:\Windows\system32\Drivers\wwfd_vw_1_10_0_24.sysWordWizard 1.10.0.24 (HKLM-x32\...\WordWizard_1.10.0.24) (Version: 1.10.0.24 - WordWizard)Task: {197BE0B2-C05E-48A1-A47B-A13128D52CF9} - System32\Tasks\WordWizard Auto Updater 1.10.0.24 Pending Update => C:\Program Files (x86)\WordWizard_1.10.0.24\Update\WordwizardAutoUpdateClient.exe [2015-09-02] (WordWizard)Task: {97A06131-6540-4D3A-B0CE-99E749D1CC3B} - System32\Tasks\WordWizard Auto Updater 1.10.0.24 Core => C:\Program Files (x86)\WordWizard_1.10.0.24\Update\WordwizardAutoUpdateClient.exe [2015-09-02] (WordWizard)
Alterations made by the installer:

File system details [View: All details] (Selection)---------------------------------------------------    Adds the folder C:\Program Files (x86)\WordWizard_1.10.0.24       Adds the file terms-of-service.rtf"="06/08/2015 23:33, 24161 bytes, A       Adds the file Uninstall.exe"="02/09/2015 22:16, 315616 bytes, A    Adds the folder C:\Program Files (x86)\WordWizard_1.10.0.24\3rd Party Licenses       Adds the file buildcrx-license.txt"="19/05/2014 21:10, 7074 bytes, A       Adds the file Info-ZIP-license.txt"="19/05/2014 21:10, 2944 bytes, A       Adds the file JSON-simple-license.txt"="30/10/2014 02:55, 11558 bytes, A       Adds the file nsJSON-license.txt"="19/05/2014 21:10, 809 bytes, A       Adds the file Nustache-license.txt"="30/10/2014 02:55, 1079 bytes, A       Adds the file TaskScheduler-license.txt"="30/10/2014 02:55, 0 bytes, A       Adds the file UAC-license.txt"="19/05/2014 21:10, 956 bytes, A    Adds the folder C:\Program Files (x86)\WordWizard_1.10.0.24\Service       Adds the file wwsvc.exe"="02/09/2015 22:16, 301656 bytes, A    Adds the folder C:\Program Files (x86)\WordWizard_1.10.0.24\Update       Adds the file Microsoft.Win32.TaskScheduler.dll"="30/10/2014 02:55, 185856 bytes, A       Adds the file Nustache.Core.dll"="30/10/2014 02:55, 28672 bytes, A       Adds the file WordwizardAutoUpdateClient.exe"="02/09/2015 22:16, 66136 bytes, A       Adds the file WordwizardAutoUpdateClient.exe.config"="30/10/2014 02:55, 256 bytes, A    In the existing folder C:\Windows\System32\drivers       Adds the file wwfd_vt_1_10_0_24.sys"="02/09/2015 22:16, 61312 bytes, A       Adds the file wwfd_vw_1_10_0_24.sys"="02/09/2015 22:16, 57728 bytes, A    In the existing folder C:\Windows\System32\Tasks       Adds the file WordWizard Auto Updater 1.10.0.24 Core"="18/09/2015 14:14, 4170 bytes, A       Adds the file WordWizard Auto Updater 1.10.0.24 Pending Update"="18/09/2015 14:14, 4180 bytes, ARegistry details [View: All details] (Selection)------------------------------------------------    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\WordwizardAutoUpdateClient_RASAPI32]       "ConsoleTracingMask"="REG_DWORD", -65536       "EnableConsoleTracing"="REG_DWORD", 0       "EnableFileTracing"="REG_DWORD", 0       "FileDirectory"="REG_EXPAND_SZ, "%windir%\tracing"       "FileTracingMask"="REG_DWORD", -65536       "MaxFileSize"="REG_DWORD", 1048576    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\WordwizardAutoUpdateClient_RASMANCS]       "ConsoleTracingMask"="REG_DWORD", -65536       "EnableConsoleTracing"="REG_DWORD", 0       "EnableFileTracing"="REG_DWORD", 0       "FileDirectory"="REG_EXPAND_SZ, "%windir%\tracing"       "FileTracingMask"="REG_DWORD", -65536       "MaxFileSize"="REG_DWORD", 1048576    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WordWizard_1.10.0.24]       "DisplayIcon"="REG_SZ", "C:\Program Files (x86)\WordWizard_1.10.0.24\Uninstall.exe"       "DisplayName"="REG_SZ", "WordWizard 1.10.0.24"       "DisplayVersion"="REG_SZ", "1.10.0.24"       "NoModify"="REG_DWORD", 1       "NoRepair"="REG_DWORD", 1       "Publisher"="REG_SZ", "WordWizard"       "UninstallString"="REG_SZ", "C:\Program Files (x86)\WordWizard_1.10.0.24\Uninstall.exe"       "URLInfoAbout"="REG_SZ", "http://www.wordwizardapp.com"    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\WordWizard_1.10.0.24]       "cr-at"="REG_SZ", ""       "cr-pid"="REG_SZ", ""       "cr-ver"="REG_SZ", "45.0.2454.85"       "dbsr"="REG_SZ", "firefox"       "features"="REG_SZ", "0x01000000"       "ff-at"="REG_SZ", ""       "ff-pid"="REG_SZ", ""       "ff-ver"="REG_SZ", "38.0.5 (x86 en-GB)"       "hid"="REG_SZ", "1FB0C54E-C74D-AB91-A3A6-1983589F206E"       "ie-at"="REG_SZ", ""       "ie-pid"="REG_SZ", ""       "ie-ver"="REG_SZ", "11.0.9600.18015"       "iid"="REG_SZ", "00000000-0000-0000-0000-000000000000"       "itm"="REG_SZ", "2015-09-18T12:14:14Z"       "nf-at"="REG_SZ", "03EDA5E6-13F2-2DFD-5E75-33AF90CFDB8F"       "nf-pid"="REG_SZ", "64540F4D-0532-44AC-85ED-8FAF7DF3E910"       "nid"="REG_SZ", "7D5BAFA9-43AD-43BF-9BAE-D2823A38F2CB"       "osn"="REG_SZ", "Windows 7 Ultimate"       "ost"="REG_SZ", "x64"       "osv"="REG_SZ", "6.1.7601"       "user_sid"="REG_SZ", "S-1-5-21-612512518-1730918975-1677248042-1002"       "ver"="REG_SZ", "1.10.0.24"    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wwfd_vt_1_10_0_24]       "DisplayName"="REG_SZ", "wwfd_vt_1_10_0_24"       "ErrorControl"="REG_DWORD", 1       "Group"="REG_SZ", "PNP_TDI"       "ImagePath"="REG_EXPAND_SZ, "system32\drivers\wwfd_vt_1_10_0_24.sys"       "Start"="REG_DWORD", 1       "Tag"="REG_DWORD", 10       "Type"="REG_DWORD", 1       "WOW64"="REG_DWORD", 1    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wwfd_vt_1_10_0_24\Enum]       "0"="REG_SZ", "Root\LEGACY_WWFD_VT_1_10_0_24\0000"       "Count"="REG_DWORD", 1       "NextInstance"="REG_DWORD", 1    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wwsvc_1.10.0.24]       "Description"="REG_SZ", "This service enables WordWizard 1.10.0.24 on HTTP websites"       "DisplayName"="REG_SZ", "WordWizard 1.10.0.24 Client Service"       "ErrorControl"="REG_DWORD", 1       "ImagePath"="REG_EXPAND_SZ, ""C:\Program Files (x86)\WordWizard_1.10.0.24\Service\wwsvc.exe""       "ObjectName"="REG_SZ", "LocalSystem"       "Start"="REG_DWORD", 2       "Type"="REG_DWORD", 16       "WOW64"="REG_DWORD", 1
Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 18/09/2015Scan Time: 14:22Logfile: mbamWordWizard.txtAdministrator: YesVersion: 2.1.8.1057Malware Database: v2015.09.18.04Rootkit Database: v2015.08.16.01License: PremiumMalware Protection: DisabledMalicious Website Protection: EnabledSelf-protection: DisabledOS: Windows 7 Service Pack 1CPU: x64File System: NTFSUser: {username}Scan Type: Threat ScanResult: CompletedObjects Scanned: 333234Time Elapsed: 4 min, 37 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: EnabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 1PUP.Optional.Vitruvian, C:\Program Files (x86)\WordWizard_1.10.0.24\Service\wwsvc.exe, 2288, Delete-on-Reboot, [1b415ed34942f640b80d756b778a09f7]Modules: 0(No malicious items detected)Registry Keys: 6PUP.Optional.Vitruvian, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\wwsvc_1.10.0.24, Quarantined, [1b415ed34942f640b80d756b778a09f7], PUP.Optional.Vitruvian, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WordWizard_1.10.0.24, Quarantined, [382446ebd2b93303f8cdedf3a65bbc44], PUP.Optional.Vitruvian, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WordWizard Auto Updater 1.10.0.24 Core, Delete-on-Reboot, [ea72949d7516d4624308a629eb194db3], PUP.Optional.Vitruvian, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WordWizard Auto Updater 1.10.0.24 Pending Update, Delete-on-Reboot, [67f5d8598ffc8ea88ac1527d9a6a22de], PUP.Optional.Vitruvian, HKLM\SOFTWARE\WOW6432NODE\WordWizard_1.10.0.24, Quarantined, [72eabc75ff8ca6909ab3fad5986c4eb2], PUP.Optional.Vitruvian, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WWFD_VT_1_10_0_24, Quarantined, [2438949d75162511a00fcff2df252ad6], Registry Values: 2PUP.Optional.Vitruvian, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\wwfd_vt_1_10_0_24|ImagePath, system32\drivers\wwfd_vt_1_10_0_24.sys, Quarantined, [2438949d75162511a00fcff2df252ad6]PUP.Optional.Vitruvian, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\wwsvc_1.10.0.24|ImagePath, "C:\Program Files (x86)\WordWizard_1.10.0.24\Service\wwsvc.exe", Quarantined, [500ce9481972e551f8b85968f80cc937]Registry Data: 0(No malicious items detected)Folders: 4PUP.Optional.Vitruvian, C:\Program Files (x86)\WordWizard_1.10.0.24, Delete-on-Reboot, [3c2044ed206b4ee81dc9cf5d6d96d927], PUP.Optional.Vitruvian, C:\Program Files (x86)\WordWizard_1.10.0.24\3rd Party Licenses, Quarantined, [3c2044ed206b4ee81dc9cf5d6d96d927], PUP.Optional.Vitruvian, C:\Program Files (x86)\WordWizard_1.10.0.24\Service, Delete-on-Reboot, [3c2044ed206b4ee81dc9cf5d6d96d927], PUP.Optional.Vitruvian, C:\Program Files (x86)\WordWizard_1.10.0.24\Update, Quarantined, [3c2044ed206b4ee81dc9cf5d6d96d927], Files: 24PUP.Optional.Vitruvian, C:\WINDOWS\SYSTEM32\drivers\wwfd_vt_1_10_0_24.sys, Delete-on-Reboot, [c1aa2d138070df4eac9b257ea0d96323], PUP.Optional.Vitruvian, C:\WINDOWS\SYSTEM32\drivers\wwfd_vw_1_10_0_24.sys, Delete-on-Reboot, [060073c81bba3a4f9b0f32e8a153d798], PUP.Optional.Vitruvian, C:\Program Files (x86)\WordWizard_1.10.0.24\Service\wwsvc.exe, Delete-on-Reboot, [1b415ed34942f640b80d756b778a09f7], PUP.Optional.Vitruvian, C:\Users\{username}\Desktop\WordWizard.exe, Quarantined, [13494de4c8c30c2a24a14c9454ada65a], PUP.Optional.Vitruvian, C:\Program Files (x86)\WordWizard_1.10.0.24\Uninstall.exe, Quarantined, [382446ebd2b93303f8cdedf3a65bbc44], PUP.Optional.Vitruvian, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-hardwareprofile-v0001, Quarantined, [95c7a889bccf5fd775395c65679dde22], PUP.Optional.Vitruvian, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-install-v0003, Quarantined, [67f59899b3d8f04675395d6404007f81], PUP.Optional.Vitruvian, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-processes-v0002, Quarantined, [7fdd0e238cff49ed535b7e43a361c040], PUP.Optional.Vitruvian, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-scheduledtasks-v0001, Quarantined, [96c61c152c5ff343406e4879ca3ab64a], PUP.Optional.Vitruvian, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-softwareregkeys-v0002, Quarantined, [273586abd7b4bb7b6549655c58ac7789], PUP.Optional.Vitruvian, C:\Windows\System32\Tasks\WordWizard Auto Updater 1.10.0.24 Core, Quarantined, [0755c1708ffcdc5acf793c9330d4db25], PUP.Optional.Vitruvian, C:\Windows\System32\Tasks\WordWizard Auto Updater 1.10.0.24 Pending Update, Quarantined, [cf8dbd74a0eb2b0bd7711eb1c93b8e72], PUP.Optional.Vitruvian, C:\Program Files (x86)\WordWizard_1.10.0.24\terms-of-service.rtf, Quarantined, [3c2044ed206b4ee81dc9cf5d6d96d927], PUP.Optional.Vitruvian, C:\Program Files (x86)\WordWizard_1.10.0.24\3rd Party Licenses\buildcrx-license.txt, Quarantined, [3c2044ed206b4ee81dc9cf5d6d96d927], PUP.Optional.Vitruvian, C:\Program Files (x86)\WordWizard_1.10.0.24\3rd Party Licenses\Info-ZIP-license.txt, Quarantined, [3c2044ed206b4ee81dc9cf5d6d96d927], PUP.Optional.Vitruvian, C:\Program Files (x86)\WordWizard_1.10.0.24\3rd Party Licenses\JSON-simple-license.txt, Quarantined, [3c2044ed206b4ee81dc9cf5d6d96d927], PUP.Optional.Vitruvian, C:\Program Files (x86)\WordWizard_1.10.0.24\3rd Party Licenses\nsJSON-license.txt, Quarantined, [3c2044ed206b4ee81dc9cf5d6d96d927], PUP.Optional.Vitruvian, C:\Program Files (x86)\WordWizard_1.10.0.24\3rd Party Licenses\Nustache-license.txt, Quarantined, [3c2044ed206b4ee81dc9cf5d6d96d927], PUP.Optional.Vitruvian, C:\Program Files (x86)\WordWizard_1.10.0.24\3rd Party Licenses\TaskScheduler-license.txt, Quarantined, [3c2044ed206b4ee81dc9cf5d6d96d927], PUP.Optional.Vitruvian, C:\Program Files (x86)\WordWizard_1.10.0.24\3rd Party Licenses\UAC-license.txt, Quarantined, [3c2044ed206b4ee81dc9cf5d6d96d927], PUP.Optional.Vitruvian, C:\Program Files (x86)\WordWizard_1.10.0.24\Update\Microsoft.Win32.TaskScheduler.dll, Quarantined, [3c2044ed206b4ee81dc9cf5d6d96d927], PUP.Optional.Vitruvian, C:\Program Files (x86)\WordWizard_1.10.0.24\Update\Nustache.Core.dll, Quarantined, [3c2044ed206b4ee81dc9cf5d6d96d927], PUP.Optional.Vitruvian, C:\Program Files (x86)\WordWizard_1.10.0.24\Update\WordwizardAutoUpdateClient.exe, Quarantined, [3c2044ed206b4ee81dc9cf5d6d96d927], PUP.Optional.Vitruvian, C:\Program Files (x86)\WordWizard_1.10.0.24\Update\WordwizardAutoUpdateClient.exe.config, Quarantined, [3c2044ed206b4ee81dc9cf5d6d96d927], Physical Sectors: 0(No malicious items detected)(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.

We use different ways of protecting your computer(s):

  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
Link to post
Share on other sites
  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.