{"id":84695,"date":"2018-08-10T16:13:59","date_gmt":"2018-08-10T13:13:59","guid":{"rendered":"http:\/\/greatis.com\/blog\/how-to\/remove-itranslator-virus.htm"},"modified":"2018-08-10T16:13:59","modified_gmt":"2018-08-10T13:13:59","slug":"remove-itranslator-virus","status":"publish","type":"post","link":"https:\/\/greatis.com\/blog\/how-to\/remove-itranslator-virus.htm","title":{"rendered":"&quot;ITRANSLATOR&quot; How to remove VIRUS FOREVER? Manual Removal Guide"},"content":{"rendered":"<div class=\"wpInsert wpInsertInPostMy wpInsertAbove\" style=\"padding: 0px;\"><\/div><p><!-- !$*\nName=ITRANSLATOR\nAlias=Trojan ( 004046cf1 )\nType=1\nTemplate=malware\\0.tml\nTags=Trojan ( 004046cf1 ), ITRANSLATOR\nURL=remove-itranslator-virus\nMD5=A800439A00C76EF9E7EE901BB676641A\nSize=744968\nVirusTotal=42\/67\nFilePath=%WINDIR%ITRANSLATOR\n[INFO]\nAutostart registry keys:\nHKLMSoftwareMicrosoftitranslator\nHKLMSystemCurrentControlSetServicesiTranslatorSvc\nHKLMSoftwareMicrosoftitranslatorGuid: \"P005\nHKLMSystemCurrentControlSetServicesiTranslatorSvcType: 0x00000001\nHKLMSystemCurrentControlSetServicesiTranslatorSvcStart: 0x00000001\nHKLMSystemCurrentControlSetServicesiTranslatorSvcErrorControl: 0x00000001\nHKLMSYSTEMCURRENTCONTROLSETSERVICESITRANSLATORSVCIMAGEPATH: \"??%WINDIR%ITRANSLATOR\nHKLMSystemCurrentControlSetServicesiTranslatorSvcDisplayName: \"iTranslatorSvc\nHKLMSystemCurrentControlSetServicesiTranslatorSvcGuid: \"P005\nHKLMSystemCurrentControlSetServicesiTranslatorSvcMachineCode: \"BFEBFBFF000306787E864921\nRelated Files:\n%COMMON APPDATA%DECRYPT_INFORMATION.HTML\n%COMMON APPDATA%DP45977C.LFL[UNLOCKMEPLEASE@COCK.LI ].HRM\n%COMMON APPDATA%ITRANSLATORITRANSLATOR.DLL\n%COMMON APPDATA%ITRANSLATORWINTRANS.EXE\n%SYSTEMDRIVE%TOOLSWINOBJAFTER_VIRUS.BAT[UNLOCKMEPLEASE@COCK.LI ].HRM\n\n*$! --><\/p>\n<h2>What is ITRANSLATOR?<\/h2>\n<div class=\"intro\">\nITRANSLATOR is considered as malicious program (malware).<br \/>\n<br \/>ITRANSLATOR detected as <b>Trojan ( 004046cf1 )<\/b>.<br \/>\nITRANSLATOR actively resists detection and employs a number of techniques to ensure that you cannot remove ITRANSLATOR from infected computers.\n<\/div>\n<div class=\"space\">&nbsp;<\/div>\n<div class=\"techinfo\/p><div class=\"wpInsert wpInsertInPostMy wpInsertMiddle\"><\/div><h2>Technical Information:<\/h2>\n<ul>\n<li> Full path on a computer= %WINDIR%\\ITRANSLATOR\n<li> VirusTotal Testing Results= <span class=\"vt_result\">42\/67<\/span>\n<li> MD5= <a href=\"http:\/\/virustotal.com\/search\/?query=A800439A00C76EF9E7EE901BB676641A\" target=_blank class=\"vt-button\">A800439A00C76EF9E7EE901BB676641A<\/a>\n<\/ul>\n<p>\n<\/div>\n<h2>How ITRANSLATOR got on your computer?<\/h2>\n<p>Phishing is the most common way for malware to infect computers.<br \/>\nIt could be a fake email message that appears to be originated from Microsoft Customer Service, eBay, PayPal, Amazon, or even your bank or insurance company.<br \/>\nFake emails that appear to come from the police, the FBI and other government entities were also reported.<\/p>\n<p>ITRANSLATOR could also infect your computer by exploiting a security vulnerability of your Web browser or one of its plugins.<br \/>\nIf this is the case, ITRANSLATOR would be injected into a Web page, and could get to your PC when you visited a malicious or hacked Web site.<\/p>\n<p>ITRANSLATOR can be distributed with legitimate software that is repackaged by the scammers.<br \/>\nIt could be downloaded from warez Web sites or download archives.<\/p>\n<h2>How do you know you have ITRANSLATOR on my computer?<\/h2>\n<p>ITRANSLATOR works in background. It does not appear as a window, does not have a shortcut.<br \/>\nITRANSLATOR hides its existence from your eyes.<br \/>\n<a name=\"remove\"><\/a><\/p>\n<h2>You have 2 ways to remove ITRANSLATOR:<\/h2>\n<p><img loading=\"lazy\" class=\"alignnone wp-image-66789 size-full\" src=\"https:\/\/greatis.com\/blog\/img\/2ways.png\" alt=\"You have 2 ways\" width=\"192\" height=\"192\" \/><br \/>\n<span class=\"sidebar\"><br \/>\n<a href=\"#autoremoval\"><img loading=\"lazy\" class=\"alignnone size-full wp-image-66791\" src=\"https:\/\/greatis.com\/blog\/img\/automatically.png\" alt=\"Remove it automatically\" width=\"48\" height=\"48\" \/>1. Remove Automatically.<\/a><br \/>\n<a href=\"#manualremoval\"><img loading=\"lazy\" class=\"alignnone size-full wp-image-66790\" src=\"https:\/\/greatis.com\/blog\/img\/manually.png\" alt=\"Remove it manually\" width=\"48\" height=\"48\" \/>2. Remove Manually.<\/a><br \/>\n<\/span><\/p>\n<h3>Why I recommend you to use an automatic way?<\/h3>\n<ol>\n<li>You know only one virus name: &quot;ITRANSLATOR&quot;, but usually <strong>you have infected by a bunch of viruses<\/strong>.<br \/>\nThe UnHackMe program <strong>detects this threat and all others<\/strong>.<\/li>\n<li>UnHackMe is <strong>quite fast<\/strong>! You need only 5 minutes to check your PC.<\/li>\n<li>UnHackMe uses the special features to<strong> remove hard in removal viruses<\/strong>. If you remove a virus manually, it can prevent deleting using a self-protecting module. If you even delete the virus, it may recreate himself by a stealthy module.<\/li>\n<li>UnHackMe is <strong>small and compatible<\/strong> with any antivirus.<\/li>\n<li>UnHackMe is <strong>fully free<\/strong> for 30-days!<\/li>\n<\/ol>\n<p><a name=\"autoremoval\"><\/a><\/p>\n<h3>Here&rsquo;s how to remove ITRANSLATOR virus automatically:<\/h3>\n<p><b><u><a href=\"#step1\">STEP 1: Install UnHackMe (1 minute)<\/a><\/u><\/b><\/p>\n<p><b><u><a href=\"#step2\">STEP 2: Scan for malware using UnHackMe (1 minute)<\/a><\/u><\/b><\/p>\n<p><b><u><a href=\"#step3\">STEP 3: Remove ITRANSLATOR virus (3 minutes)<\/a><\/u><\/b><\/p>\n<p>\nSo it was much easier to fix such problem automatically, wasn&apos;t it?<br \/>\nThat is why I strongly advise you to use <span style=\"text-decoration: underline;\"><a href=\"https:\/\/greatis.com\/unhackme\/download.htm?pk_campaign=blog&amp;pk_kwd=end\">UnHackMe<\/a><\/span> for remove ITRANSLATOR redirect or other unwanted software.<\/p>\n<p><a name=\"manualremoval\"><\/a><\/p>\n<h3>How to remove ITRANSLATOR manually:<\/h3>\n<p>STEP 1: Check all shortcuts of your browsers on your desktop, taskbar and in the Start menu. Right click on your shortcut and change it&apos;s properties.<\/p>\n<div style=\"position: relative; background: url(&apos;https:\/\/s3.amazonaws.com\/greatis\/shortcut.png&apos;); width: 360px; height: 200px;\">\n<div style=\"position: absolute; bottom: 22px; left: 160px; width: 200px; color: #f63b14; font-size: 10px;\">http:\/\/&#8230;<\/div>\n<\/div>\n<p>You can see <strong>ITRANSLATOR<\/strong> or another web site at the end of shortcut target (command line). Remove it and save changes.<\/p>\n<p>In addition, check this command line for fake browser&apos;s trick.<br \/>\nFor example, if a shortcut points to Google Chrome, it must have the path:<br \/>\n<strong> C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe<\/strong>.<br \/>\nFake browser may be: &#8230;\\Appdata\\Roaming\\HPReyos\\ReyosStarter3.exe.<br \/>\nAlso the file name may be: &#8220;chromium.exe&#8221; instead of chrome.exe.<\/p>\n<p>STEP 2: Investigate the list of installed programs and uninstall all unknown recently installed programs.<\/p>\n<p><img src=\"https:\/\/info.greatis.com\/wp-content\/uploads\/2016\/11\/installed-programs.png\" alt=\"check installed programs to uninstall\" \/><\/p>\n<p>STEP 3: Open Task Manager and close all processes, related to <strong>ITRANSLATOR<\/strong> in their description. Discover the directories where such processes start. Search for random or strange file names.<\/p>\n<div style=\"width: 501px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" src=\"https:\/\/greatis.com\/blog\/img\/remove-virus-proceses.png\" alt=\"Remove ITRANSLATOR virus from running processes \" width=\"491\" height=\"532\" \/><p class=\"wp-caption-text\">Remove ITRANSLATOR virus from running processes<\/p><\/div>\n<p>STEP 4: Inspect the Windows services. Press Win+R, type in: services.msc and press OK.<\/p>\n<div style=\"width: 436px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" src=\"https:\/\/greatis.com\/blog\/img\/remove-virus-from-services.png\" alt=\"Remove ITRANSLATOR virus from Windows services\" width=\"426\" height=\"233\" \/><p class=\"wp-caption-text\">Remove ITRANSLATOR virus from Windows services<\/p><\/div>\n<p>Disable the services with random names or contains <strong>ITRANSLATOR<\/strong> in it&apos;s name or description.<\/p>\n<p>STEP 5: After that press Win+R, type in: taskschd.msc and press OK to open Windows Task Scheduler.<br \/>\n<img class=\"responsive-img\" src=\"https:\/\/info.greatis.com\/wp-content\/uploads\/2016\/11\/run-scheduler.png\" alt=\"Remove ITRANSLATOR from scheduled task list.\" \/><\/p>\n<p>Delete any task related to <strong>ITRANSLATOR<\/strong>. Disable unknown tasks with random names.<\/p>\n<p>STEP 6: Clear the Windows registry from <strong>ITRANSLATOR<\/strong> virus.<br \/>\nPress Win+R, type in: regedit.exe and press OK.<\/p>\n<div style=\"width: 436px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" src=\"https:\/\/greatis.com\/blog\/img\/remove-virus-from-registry.png\" alt=\"Remove ITRANSLATOR virus from Windows registry\" width=\"426\" height=\"233\" \/><p class=\"wp-caption-text\">Remove ITRANSLATOR virus from Windows registry<\/p><\/div>\n<p>Find and delete all keys\/values contains<strong> ITRANSLATOR<\/strong>.<\/p>\n<p>STEP 7: <a href=\"https:\/\/greatis.com\/blog\/how-to\/remove-virus-google-chrome.htm\">Remove ITRANSLATOR from <span style=\"text-decoration: underline;\">Google Chrome<\/span><\/a>.<br \/>\n<a href=\"https:\/\/greatis.com\/blog\/wp-content\/uploads\/2016\/10\/remove-virus-chrome-extensions.png\"><img loading=\"lazy\" class=\"size-full wp-image-63175\" src=\"https:\/\/greatis.com\/blog\/wp-content\/uploads\/2016\/10\/remove-virus-chrome-extensions.png\" alt=\"Remove ITRANSLATOR Virus from Chrome Extensions\" width=\"790\" height=\"531\" srcset=\"https:\/\/greatis.com\/blog\/wp-content\/uploads\/2016\/10\/remove-virus-chrome-extensions.png 790w, https:\/\/greatis.com\/blog\/wp-content\/uploads\/2016\/10\/remove-virus-chrome-extensions-300x201.png 300w\" sizes=\"(max-width: 790px) 100vw, 790px\" \/><\/a><\/p>\n<p>STEP 8: <a href=\"https:\/\/greatis.com\/blog\/howto\/remove-virus-internet-explorer.htm\">Remove ITRANSLATOR from <span style=\"text-decoration: underline;\">Internet Explorer<\/span><\/a>.<\/p>\n<div id=\"attachment_63185\" style=\"width: 452px\" class=\"wp-caption alignnone\"><a href=\"https:\/\/greatis.com\/blog\/wp-content\/uploads\/2016\/10\/set-internet-explorer-homepage.png\"><img aria-describedby=\"caption-attachment-63185\" loading=\"lazy\" class=\"size-full wp-image-63185\" src=\"https:\/\/greatis.com\/blog\/wp-content\/uploads\/2016\/10\/set-internet-explorer-homepage.png\" alt=\"Set Internet Explorer Homepage\" width=\"442\" height=\"567\" srcset=\"https:\/\/greatis.com\/blog\/wp-content\/uploads\/2016\/10\/set-internet-explorer-homepage.png 442w, https:\/\/greatis.com\/blog\/wp-content\/uploads\/2016\/10\/set-internet-explorer-homepage-233x300.png 233w\" sizes=\"(max-width: 442px) 100vw, 442px\" \/><\/a><p id=\"caption-attachment-63185\" class=\"wp-caption-text\">Set Internet Explorer Homepage<\/p><\/div>\n<p>STEP 9: <a href=\"https:\/\/greatis.com\/blog\/howto\/remove-virus-from-mozilla-firefox.htm\">Remove ITRANSLATOR from <span style=\"text-decoration: underline;\">Mozilla Firefox<\/span><\/a>.<\/p>\n<div id=\"attachment_63022\" style=\"width: 543px\" class=\"wp-caption alignnone\"><a href=\"https:\/\/greatis.com\/blog\/wp-content\/uploads\/2016\/10\/set-firefox-home-page.png\"><img aria-describedby=\"caption-attachment-63022\" loading=\"lazy\" class=\"size-full wp-image-63022\" src=\"https:\/\/greatis.com\/blog\/wp-content\/uploads\/2016\/10\/set-firefox-home-page.png\" alt=\"Change Firefox Home Page\" width=\"533\" height=\"377\" srcset=\"https:\/\/greatis.com\/blog\/wp-content\/uploads\/2016\/10\/set-firefox-home-page.png 533w, https:\/\/greatis.com\/blog\/wp-content\/uploads\/2016\/10\/set-firefox-home-page-300x212.png 300w\" sizes=\"(max-width: 533px) 100vw, 533px\" \/><\/a><p id=\"caption-attachment-63022\" class=\"wp-caption-text\">Change Firefox Home Page<\/p><\/div>\n<p>STEP 10: And at the end, clear your basket, temporal files, browser&apos;s cache.<\/p>\n<p>But if you miss any of these steps and only one part of virus remains &#8211; it will come back again immediately or after reboot.<\/p>\n<div class=\"wpInsert wpInsertInPostMy wpInsertBelow\" style=\"padding: 0px;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>Use this free guide to remove ITRANSLATOR from your system and from browsers: Chrome, Mozilla Firefox, Internet Explorer, and Microsoft Edge. The only one way to get rid of ITRANSLATOR that I found is here!<br \/>\n   <br \/><a style=\"color: #42A2CE\" href=\"https:\/\/greatis.com\/blog\/how-to\/remove-itranslator-virus.htm\"><u>More&#8230;<\/u><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[51029],"tags":[90211],"_links":{"self":[{"href":"https:\/\/greatis.com\/blog\/wp-json\/wp\/v2\/posts\/84695"}],"collection":[{"href":"https:\/\/greatis.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/greatis.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/greatis.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/greatis.com\/blog\/wp-json\/wp\/v2\/comments?post=84695"}],"version-history":[{"count":0,"href":"https:\/\/greatis.com\/blog\/wp-json\/wp\/v2\/posts\/84695\/revisions"}],"wp:attachment":[{"href":"https:\/\/greatis.com\/blog\/wp-json\/wp\/v2\/media?parent=84695"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/greatis.com\/blog\/wp-json\/wp\/v2\/categories?post=84695"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/greatis.com\/blog\/wp-json\/wp\/v2\/tags?post=84695"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}