The PWS:Win32/Lmir.UA is a dangerous Trojan horse application that invades the windows based computers secretly, and perform several unwanted activities within the system. This malicious Trojan is specifically designed to steal the personal confidential information of the targeted users. This information may include the passwords, browsing history, bank account credentials, and credit card details. The PWS:Win32/Lmir.UA blocks the firewall, and download malicious script to perform its harmful activities. Besides the above mentioned tasks, this dangerous Trojan can also used by the cyber crooks to redirect the web searching efforts of the users towards unknown website for generating the traffic on the affiliate websites and earn income through pay per click programs. This virus is also capable of displaying the pop-up ads on the screens of the infected machine, and disturb the normal routine tasks. The PWS:Win32/Lmir.UA makes the system super slow by eating most of the system resources, and also affect the efficiency of the computer. This malicious application consists of the different components and each component performs different tasks.
The Manual Removal of PWS:Win32/Lmir.UA
Once the presence of the PWS:Win32/Lmir.UA is confirmed in your system, you have to delete this Trojan infection as quickly as possible either by using any automatic removal tool, or by following the steps of the manual removal method. The manual removal is only recommended for the experienced users and consists of the following set of instructions:-
Change the Mode of Operation from Normal to Safe Mode
You need to restart the system in order to terminate the normal mode, and hit the F8 key repeatedly to access the boot options menu when the system is restarted. Once you can see the boot options on the screen, you have to select the safe mode option from the list and press the enter key to access the computer in the safe mode.
End the Malicious Processes
Open the windows task manager by holding the Ctrl+Alt+Delete keys together, and select the Processes tab in the task manager window. Here you can see a list of running processes from which you need to remove the following malicious processes associated with the PWS:Win32/Lmir.UA infection and close the task manager:-
- %AppData%\[RANDOM CHARACTERS]\[RANDOM CHARACTERS].exe
Remove the Associated Data
Open the system files folder, and remove the following suspicious files that are associated with the PWS:Win32/Lmir.UA with the help of the Delete key:-
Reverse the Modification in the Windows Registry
The manual removal process is only completed when you clean the windows registry. You have to access the registry editor by executing the Regedit command through Run option available in the Start menu. Delete the following suspicious entries from the windows registry by using the registry editor:-
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\PWS:Win32/Lmir.UA\DisplayIcon %AppData%\[RANDOM CHARACTERS]\[RANDOM CHARACTERS].exe,0
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\PWS:Win32/Lmir.UA\UninstallString “%AppData%[RANDOM CHARACTERS][RANDOM CHARACTERS].exe” -u
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\[RANDOM CHARACTERS] %AppData%\[RANDOM CHARACTERS]\[RANDOM CHARACTERS].exe
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\PWS:Win32/Lmir.UA\ShortcutPath “%AppData%\[RANDOM CHARACTERS]\[RANDOM CHARACTERS].exe” -u
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\PWS:Win32/Lmir.UA\DisplayName PWS:Win32/Lmir.UA
Close the registry editor and restart the computer in the normal mode to see the effect of changes you have made recently. Run a complete system scan through your existing antivirus software.