locked
zwsafedotspace.exe what is that and how to remove it RRS feed

  • Question

  • Dear all!

    I have check my pC and also other PC and see there are have services running with name zwsafedotspace.exe i think this is a virus.

    When this exe running i can not safe eject my extenal HDD/ USB until i use UNLOCKER to unblock it

    Is there any method i can remove zesafedotspace.exe?

    Thanks and best regards


    Quynh Nguyen disscuss

    Monday, May 15, 2017 8:57 AM

All replies

  • Hi,

    Please refer to the article: zwSafedotSpace.exe
    http://www.herdprotect.com/zwsafedotspace.exe-060087fe96dd9545b6922e498255b31d7cd9d7c7.aspx

    It reads "zwsafedotspace.exe" is a malware and is located in "C:\Windows\System32" folder.
    (1) stop the service "zwsafedotspace.exe"
    (2) delete the file in "C:\Windows\System32" folder.
    (3) if you can find it in "Programs and features", uninstall it.
    _____________________
    Ashidacchi
    Tuesday, May 16, 2017 2:04 AM
  • Dear Ashidacchi

    I could not found any services  "zwsafedotspace.exe" to stop it

    Only found the "zwsafedotspace.exe" located in system32 folder and can not remove/ delete it

    Are there any other solution?

    Thanks


    Quynh Nguyen disscuss

    Tuesday, May 16, 2017 7:27 AM
  • Hi,

    (1) Are there any programs related to "zwsafedotspace" in Programs & Features?  The name may not be "zwsafedotspace", it may be Zavaware or something like that . 

    (2) Can you see something like zwsafedotspace in [Startup]? and can't you disable it?
    [Ctrl]+[Shift]+[Esc] > [Startup]

    (3) As far as the screenshot you've inserted, I suppose some folder exists which includes "zwsafedotspace.exe" and other files (e.g. ""zwsafedot???.dll"). Can you delete the folder, even if you sign-in with administrator privilege? 

    (4) Have a third party antivirus software been installed in your PC?  Can it scan and remove it?
    ___________
    Ashidacchi

    • Edited by Ashidacchi Tuesday, May 16, 2017 7:53 AM
    Tuesday, May 16, 2017 7:52 AM
  • Dear Ashidacchi!

    1. Can not find any program ralated to it in Program& feature

    2. I can found the startup entry in [Startup] and once i disabled it, i will auto create new startup entry. Please check below picture for more detail

    3. The zwsafedotspace.exe and both .dll are located in system32, not in other their own folder and can not delete with administrator privilege

    4. i have only MSE ( Microsoft essential) installed, updated and scanned it without notify and remove.


    Quynh Nguyen disscuss

    Tuesday, May 16, 2017 8:08 AM
  • Hi Quynh Nguyen,

    Thank you for checking.
    I'd ask you more:

    1. what is your Windows version? (I forgot to ask at first)

    2. check if startup exist in the below folder (if exists, delete it):
        C:\Users\<your account>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup    .... Windows 7, 8.1, and 10
    3. [Registry]
        run regedit.exe
        locate [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\run]
        If you find something like "zwsafedotspace", delete entry
          

    3. I strongly recommend you to install some third party AntiVisus software, beside with MSE.
    ______________
    Ashidacchi
    • Edited by Ashidacchi Tuesday, May 16, 2017 9:11 AM
    Tuesday, May 16, 2017 9:10 AM
  • Dear Ashidacchi!

    1. My system is Windows 7 pro x64 SP1

    2. only my program available in C:\Users\<your account>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

    3. Registry editor also can not found it

    4. did you have some recommend about third party antivirus?

    Thanks and best regards


    Quynh Nguyen disscuss

    Tuesday, May 16, 2017 9:24 AM
  • Hi Quynh Nguyen,

    Thank you checking.
    4. my recommendation: ESET (https://www.eset.com/)
        cf. ESET Internet Security does about WannaCrypt
             Do not open suspicious emails, large numbers of threats being distributed by "WannaCryptor" ransomware
    http://support.eset.com/alert6442/

    # Please remember: I don't work for Microsoft or ESET, but only a self-employed software developer.

    It's high time to dinner and drinking in Japan, so I cannot make an reply today.
    ____________
    Ashidacchi
    Tuesday, May 16, 2017 9:40 AM
  • Dear Ashidacchi!

    Thanks for you reply, have a good dinner with your friend/ family.

    I will consider about ESET. Thanks for your recommended

    !!


    Quynh Nguyen disscuss

    Wednesday, May 17, 2017 12:35 AM