• Downloads
  • Threats
    • Adware
    • Browser Hijacking
    • Rogue Anti Spyware
    • Virus
  • Questions and Answers
  • Recover Encrypted Files
  • Free Malware Removal Tools

My AntiSpyware

Free antispyware software, Online Scanners, Instructions on how to remove spyware and malware.

Menu
  • Downloads
  • Threats
    • Adware
    • Browser Hijacking
    • Rogue Anti Spyware
    • Virus
  • Questions and Answers
  • Recover Encrypted Files
  • Free Malware Removal Tools
Home › Trojan › Tutorials - HowTo › How to remove thefeedwater.com and providefeed.com redirect (Calc.dll trojan)

How to remove thefeedwater.com and providefeed.com redirect (Calc.dll trojan)

Myantispyware team November 9, 2009     2 Comments    

Thefeedwater.com and providefeed.com are a malicious websites. If your browser is redirected to these sites as well as toseeka.com, asterplex.com, webfindengine.com, clickfreesearch.com, then your computer is infected with Calc.dll and ntuser.dll trojans. Once running, the trojan will displays a lot of popups, fake security warnings and offers to install other potentially unwanted software and rogue antispyware applications. However, all of these warnings should be ignored! Use these free instructions below to remove thefeedwater.com and providefeed.com redirect and any associated malware from your computer.

Symptoms in a HijackThis Log

O4 – HKLM\..\Run: [calc] rundll32.exe C:\WINDOWS\system32\calc.dll,_IWMPEvents@0
O4 – HKCU\..\Run: [calc] rundll32.exe C:\DOCUME~1\user\ntuser.dll,_IWMPEvents@0
O4 – Startup: scandisk.dll
O4 – Startup: scandisk.lnk = ?

Use the following instructions to remove thefeedwater.com and providefeed.com redirect

Step 1.
Download Avenger from here and unzip to your desktop.

Run Avenger, copy,then paste the following text in Input script Box:

Registry values to delete:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | calc

Files to delete:
%UserProfile%\Start Menu\Programs\Startup\scandisk.dll
%WinDir%\system32\calc.dll
%UserProfile%\ntuser.dll

You will be asked Are you sure you want to execute the current script?. Click Yes. You will now be asked “First step completed — The Avenger has been successfully set up to run on next boot. Reboot now?”. Click Yes.

Your PC will now be rebooted.

Step 2.
Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.

Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

Once the program has loaded you will see window similar to the one below.

malwarebytes-antimalware1
Malwarebytes Anti-Malware Window

Select Perform Quick Scan, then click Scan, it will start scanning your computer. This procedure can take some time, so please be patient.

When the scan is complete, click OK, then Show Results to view the results. You will see a list of infected items similar as shown below. Note: list of infected items may be different than what is shown in the image below.

Malwarebytes Anti-malware, list of infected items
Malwarebytes Anti-malware, list of infected items

Make sure that everything is checked, and click Remove Selected for start removal process. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.

Note: if you need help with the instructions, then post your questions in our Spyware Removal forum.

Trojan Tutorials - HowTo

Author: Myantispyware team

Myantispyware is an information security website created in 2004. Our content is written in collaboration with Cyber Security specialists, IT experts, under the direction of Patrik Holder and Valeri Tchmych, founders of Myantispyware.com.

2 Comments

  1. Tony Wong
    ― November 12, 2009 - 1:36 am  Reply

    I was hit by this thefeedwater virus. In fact it mutates to a different website today. I tried CyberDefender and it was not able to remove the virus. I even called the tech support and they said no antivirus software can clear this virus but they could manually clear it for me for $200. Although I was convinced that they were telling me the truth, I did not think it was worth $200. I dig into this virus more and I found your instruction. Thanks so much. It works and the virus is now gone.

  2. Eric R
    ― November 25, 2009 - 7:38 pm  Reply

    These three files were causing me all sorts of grief, Firefox crashing, things not working right. I couldn’t find a malware remover that would work and I tried a few, but the files would just keep rising from the dead. These instructions work perfect. Thank you!

Leave a Reply Cancel reply




New Guides

Z-news4.online
How to remove Z-news4.online pop-ups (Virus removal guide)
New Finder redirects
How to uninstall New Finder extension from Chrome, Firefox, IE, Edge
Recruismsch.top
How to remove Recruismsch.top pop-ups (Virus removal guide)
1JG814sgxdDWZTu2jpz5znuq9rFGNZARA6 Bitcoin Email Scam
1JG814sgxdDWZTu2jpz5znuq9rFGNZARA6 Bitcoin Email Scam
Your MAC might be at risk pop-up scam
Your MAC might be at risk pop-up notification (Removal guide)

Follow US

Search

Useful Guides

Tech Support Scam
Remove Tech Support Scam pop-up virus [Microsoft & Apple Scam]
How to remove browser hijacker virus (Chrome, Firefox, IE, Edge)
This setting is enforced by your administrator (Removal guide)
How to reset Internet Explorer settings to default
How to reset Google Chrome settings to default

Recent Posts

How to remove SystemFighter (Uninstall instructions)
How to remove SystemVeteran (Uninstall instructions)
How to remove MaCatte Antivirus 2009 (Uninstall instructions)
How to remove BlockProtector (Uninstall instructions)
How to remove BlockKeeper (Uninstall instructions)

MYANTISPYWARE.COM

  • About Us
  • Contact Us
  • Privacy Policy

NEED A HELP ?

If you're seeing unwanted pop-ups or ads in your web-browser, you might have an adware installed on your computer. Use the following guide to stop pop-up ads and remove malicious software. Or ask for help here.

Links

  • Downloads
  • Instructions
  • Questions and Answers
  • Free Malware Removal Tools
Copyright © 2004 - 2020 My AntiSpyware - Free antispyware programs and Spyware Removal Instructions.