Spyware.WALogger - Removal

The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

1. Uninstall the security risk.
2. Delete any values added to the registry.
   

1. To uninstall the security risk
This security risk includes an uninstallation applet. In order to uninstall this security risk, complete the following instructions:

1. Click Start > Settings > Control Panel or Start > Control Panel (this varies with the operating system).
   
   
2. In the Control Panel window, double-click Add/Remove Programs.
   
   Windows Me only: If you do not see the Add/Remove Programs icon, click ...view all Control Panel options.
   
   
3. Click WALI (LITE).
   
   Note: You may need to use the scroll bar to view the whole list.
   
   
4. Click Add/Remove, Change/Remove, or Remove (this varies with the operating system). Follow the prompts.
   
   Note: After running the Add/Remove programs applet, all the files may have been removed. You will want to run a full system scan to ensure that this is the case. However, it is possible that no files will be detected after using Add/Remove programs.
   
   

2. To delete the value from the registry
Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified subkeys only. Read the document: How to make a backup of the Windows registry.

1. Click Start > Run.
2. Type regedit
   
   Then click OK.
   
   Note: If the registry editor fails to open the risk may have modified the registry to prevent access to the registry editor. Security Response has developed a tool to resolve this problem. Download and run this tool, and then continue with the removal.
   
   
3. Navigate to and delete the subkeys:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{68ACC1A8-CFFC-4163-8767-026232DB2697}
   HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{521B4D64-B9D2-4C2F-8460-0EEA6FBFD0F5}
   HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C1E97CB5-5E3A-456C-B3EE-71DB7D986CB1}
   HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{06FFEF32-4765-4123-8C34-2DFE4FB38976}
   HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WALI.cWALIRun
   HKEY_CURRENT_USER\Software\VB and VBA Program Settings\WALI
   
   
4. Navigate to the subkey:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   
   
5. In the right pane, delete the value:
   
   "WSVCS" = "%System%\WALI\SVCS\SERVICES.EXE"
   
   
6. Exit the Registry Editor.

Technical Details