Home > Malware > Good Memory Adware Removal Instructions

Good Memory Adware Removal Instructions

Posted on 17 Januari 2011 by c0decstuff

Good Memory is a rogue application. A rogue application tries to trick you by displaying false positive/misleading scan results report, which says that your computer has a problem, or infected with viruses or trojan, but you will not be able to fix it before you purchase.

Variants of the rogue defragmenter:

* Fast Disk
* Disk OK
* My Disk
* Memory Fixer
* HDD Fix
* Scanner
* HDD Low
* Disk Repair
* Defragmenter
* HDD Tools
* Smart HDD
* HDD Rescue
* HDD Plus
* HDD Diagnostic
* Hard Drive Diagnostic
* Disk Doctor
* Win Defragmenter
* WinDefrag
* WinHDD
* CheckDisk
* Ultra Defragger
* Quick Defragmenter
* Smart Defragmenter
* HDD Defragmenter
* System Defragmenter

Create new files:

* %AllUsersProfile%\Application Data\~%random%
* %AllUsersProfile%\Application Data\~%random%r
* %AllUsersProfile%\Application Data\%random%
* %AllUsersProfile%\Application Data\%random%.exe
* %AllUsersProfile%\Application Data\%random%.dll
* %AllUsersProfile%\Application Data\%random%.exe
* %UserProfile%\Desktop\Good Memory.lnk
* %UserProfile%\Local Settings\Temp\tmp2.tmp
* %UserProfile%\Start Menu\Programs\Good Memory\
* %UserProfile%\Start Menu\Programs\Good Memory\Good Memory.lnk
* %UserProfile%\Start Menu\Programs\Good Memory\Uninstall Good Memory.lnk

Create/modify registry entries:

* HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\
Use FormSuggest: “Yes”

* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations\
LowRiskFileTypes:”.zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;
.mpeg;.mov;.mp3;.m3u;.wav;.scr;”

* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments\
SaveZoneInformation: 0×00000001

* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
%random%: “%AllUsersProfile%\Application Data\%random%.exe”
%random%: “%AllUsersProfile%\Application Data\%random%.exe”

* HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download\
CheckExeSignatures: “no”

How to remove the infection of Good Memory (Adware.Win32.GoodMemory)?

To delete this malware infection, please download and install Emsisoft Anti-Malware. Run a full scan on all drives and move all detected items to the quarantine.
Related Posts:

* My Disk Adware Removal Instructions
* Fast Disk Adware Removal Instructions
* Disk OK Adware Removal Instructions
* HDD Fix Adware Removal Instructions
* Memory Fixer Adware Removal Instructions

Full story: Emsisoft New Malware Blog

Screenshots: