HLDRRR.EXE - Remove Spyware Virus (wintems.exe, srosa.sys)

HLDRRR.EXE It is known to most anti-virus as spyware or Trojan-Downloader.Win32.Bagle.snBut escaped time and still get rid of anti-virus widely known as Norton si Avira.
A few days ago I had a wonderful experience with this executable - virus. If you encounter on your PC must be sure that You virused computer and you need a seriously.

Where does hldrrr.exe.

This executable on your PC comes most often when downloads and installs a Internet toolbar Explorer, to access and warnStrange programs installed on Infected sites or open executable files coming through e-mail / spam ca attachment. It is known as the virus without minimum experience in computers, which installs any program open pop-up and do not know to beware of misleading advertisements and emails.

Along with executable hldrrr.exe longer appear in the system and the following: wintems.exe, srosa.sys Additionally folders "down" and "downld".

Kaspersky Anti-Virus Report

Trojan software : Trojan-Downloader.Win32.Bagle.sn / Trojan.Tooso.R
: C: WINDOWSsystem32drivershldrrr.exe
threat level: High

In my case, hldrrr.exe appeared in folder "%System% WINDOWSsystem32drivers"But this executable can be found in other folders of system32 or in the root folder of the system.

Remove Virus File - hldrrr.exe

1. If anti-virus has detected this virus but cannot delete it, follow the scan report and see exactly where the hldrrr.exe file is located. Open Task Manager (Ctrl+Shift+ Esc), go to the tab Processes and give kill hldrrr.exe process.

2. open Command Prompt and give the commands: (after each order press Enter)

cd C: WINDOWSsystem32drivers (to get to the folder)

del hldrrr.exe

del down

del downld

Other files that accompany hldrrr.exe, wintems.exe si srosa.sys are located in "system32".

cd .. (To get to your "parent" of the current folder.)

del wintems.exe

del srosa.sys

3. After I deleted malware files we need to clean the registry ().

Open registry editor and go to:


Plus do click on the folder and search software FirstRRRun. Right-click and Delete.

Go to the following registry key to delete the "drvsyskit"

HKEY_CURRENT_USER> Software> Microsoft>Windows> CurrentVersion> Run

In the list on the right look for and delete "drvsyskit".

4. Restart the computer.

Normally after the above operations should get rid of this virus, but to make sure that there are other malware on your computer is recommended good to scan your computer.

*I found this virus on an operating system protected by Avira AntiVir Personal. The detailed virus report and devirusation was done with Kaspersky Anti Virus 2010.

HLDRRR.EXE - Remove Spyware Virus (wintems.exe, srosa.sys)

About the author

Stealth LP

Founder and editor Stealth SettingsIn 2006 date.
Experience on Linux operating systems (especially CentOS), Mac OS X, Windows XP> Windows 10 and WordPress (CMS).

Leave a Comment