How to Remove SecureWarrior | Secure Warrior Removal Guide
Proving once again that it takes little creativity to put out rogue antivirus applications, the same group that was behind secure fighter (securefighter removal guide) have renamed their software again and one of the more recent versions is called securewarrior. Read on for a guide to the removal of securewarrior.
Like it’s predecessors, securewarrior claims to have found security problems with your computer. It further claims to be able to fix those problems if you purchase their software. All of their claims are false and it is a scam as so many of these rogue antivirus applications are. I suggest that you first attempt installing malwarebytes antimalware (see the virus removal toolkit page). Update and run a full scan with that to attempt removal. Unfortunately, many of todays rogue applications have running processes that prevent such tools from running which is why you may need to follow the below information for a manual removal. Other things that may enable you to successfully remove this type of pest with malwarebytes are booting into safe mode or simply killing off the running processes associated with the bug and then attempting a scan. If you are unable to install malwarebytes on your system you may be able to rename the installer and try again. Many of these rogues are getting better and better at evading legitimate security software.
You will want to block the following web sites that are related to securewarrior…
securewarrior.com
scannerscan.com/online
The following processes related to securewarrior can be found and killed off using the task manager, kill off the processes to start the removal of securewarrior:
0urw56p0.exe
249069orm57cz.exe
SecureWarrior.exe
uninstall.exe
(It’s worth noting that two of these are likely randomized and you should use the above as a pattern and the information below to help you find the filenames as they appear on your system.)
The following dll names are randomized, but similar dlls should be unregistered and deleted from your system:
25059zorm4d9.dll
109559dwarz959.dll
The following files and their folders should be removed:
%win%\1025worm59bz.bin
%win%\10562spy9z1.cpl
%win%\109559dwarz959.dll
%win%\system32\2485z5p920a.cpl
%win%\system32\249069orm57cz.exe
%win%\system32\25059zorm4d9.dll
%progfiles%\SecureWarrior Software
%progfiles%\SecureWarrior Software\SecureWarrior
%progfiles%\SecureWarrior Software\SecureWarrior\SecureWarrior.exe
%progfiles%\SecureWarrior Software\SecureWarrior\uninstall.exe
%Docs%\All Users\Desktop\SecureWarrior.lnk
%Docs%\All Users\Start Menu\Programs\SecureWarrior
%Docs%\All Users\Start Menu\Programs\SecureWarrior\1 SecureWarrior.lnk
%Docs%\All Users\Start Menu\Programs\SecureWarrior\2 Homepage.lnk
%Docs%\All Users\Start Menu\Programs\SecureWarrior\3 Uninstall.lnk
%Tmp%\0urw56p0.exe
Some of the above file names are randomized and you should use the above patterns to help you find the names as they appear on your system. It is likely that this rogue application installs via trojan horse activity and so if you are getting warnings related to securewarrior, but cannot find it on your system you likely have other infections.
After a manual removal of Securewarrior I suggest an update and full scan of your system using a trusted tool such as malwarebytes antimalware.