Removal tool for System Warrior (SystemWarrior.exe)

System Warrior is another fake Antivirus that install itself on your computer. Once installed, it tries to trick you into buying the full version because the one you have is just a shareware. It shows you fake alert, don’t worry about that; I’m sure the only malware in your system is System Warrior.

To remove this malware

• Download this removal tool
• Extract it
• Launch
• Click on the delete button

This virus will be removed from your system in less than a minute. Restart your computer when it’s finished.

After running the patch, your homepage Internet Explorer becomes search.net-studio.org, done deliberately to erase all traces of then malware, BHOs (Browser Helper Object) are also deleted. You can always restore this setting in Internet Explorer options.

Process

• SystemWarrior.exe
• SystemWarriorSvc.exe
• xxxy.tmp.exe where x is a random charchter and y is a random number.

Files and folders of the malwar

• %CommonDesktop%\SystemWarrior.lnk
• %CommonPrograms%\SystemWarrior\1 SystemWarrior.lnk
• %CommonPrograms%\SystemWarrior\2 Homepage.lnk
• %CommonPrograms%\SystemWarrior\3 Uninstall.lnk
• %ProgramFiles%\SystemWarrior Software\SystemWarrior\xxxY.tmp.exe (where x is a random charchter and y is a random number)
• %ProgramFiles%\SystemWarrior Software\SystemWarrior\SystemWarrior.exe
• %ProgramFiles%\SystemWarrior Software\SystemWarrior\SystemWarriorSvc.exe

• %ProgramFiles%\SystemWarrior Software\SystemWarrior
• %CommonPrograms%\SystemWarrior

Registry keys and values created

• HKEY_CURRENT_USER\Software\SystemWarrior
• HKEY_LOCAL_MACHINE\SOFTWARE\SystemWarrior
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemWarrior
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “xxxy.tmp.exe”
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “SystemWarrior”