How to Get Rid of the Rich Video Codec 1.6

Rich Video Codec 1.6 will likely slow your computer to a crawl.

Rich Video Codec 1.6 is a malicious program that disguises itself as a legitimate video codec. Once you download the program, it opens a security hole, or backdoor, to your computer. This security hole can be used by remote hackers to access your personal information, change your system configurations and download additional malware. Moreover, Rich Video Codec 1.6 will flood your computer with pop-ups telling you that you need to purchase Smitfraud. Fortunately, Rich Video Codec 1.6 can be removed automatically or manually.

Instructions

Automatic Removal

1. Click "Start," "All Programs" and "Windows Defender."

2. Click the down arrow next to Scan and select "Full Scan" from the drop-down menu. Windows Defender scans your entire computer and automatically removes any malicious programs that it detects. The may take anywhere from several minutes to several hours.

3. Restart your computer.

Manual Removal

1. Press "Ctrl," "Shift" and "Escape" to open the Task Manager. End each of the following processes by right-clicking the process and selecting "End Process."

   ttvbonnlq.exe

   videoaccesscodecinstall.exe

   richvideocodec\uninstall.exe

   monhop.exe

   ttvbonnlq.exe

   videoaccesscodecinstall.exe

2. Click "Start," type "cmd" into the search field and press "Enter" to open the Command Prompt. Type the following commands into the Command Prompt. Press "Enter" after each command.

   regsvr32 /u codecbho.dll

   regsvr32 /u viruscleaner.dll

   regsvr32 /u werbetgxd.dll

   regsvr32 /u richvideocodec.dll

   regsvr32 /u pmkret.dll

   regsvr32 /u multiloader.dll

   regsvr32 /u monhop.dll

   regsvr32 /u pmkret.dll

   regsvr32 /u werbetgxd.dll

   regsvr32 /u gormet.dll

   del richvideocodec.ocx

3. Click "Start," type "regedit" into the search field and press "Enter" to open the Registry Editor. Delete the following registry entries from the left pane of the Registry Editor by right-clicking the registry entry and selecting "Delete."

   HKEY_CLASSES_ROOTappid{184abe04-f423-4c41-b20e-8028ef8261ed}

   HKEY_CLASSES_ROOTappid{88265d10-64ea-45af-a84b-93a296e2be91}

   HKEY_CLASSES_ROOTappid{f4406238-983a-4845-9053-f1d0007fd135}

   HKEY_CLASSES_ROOTappidcodecbho.dll

   HKEY_CLASSES_ROOTappidcodecbho.dll appid

   HKEY_CLASSES_ROOTbxloader.loader

   HKEY_CLASSES_ROOTbxloader.loader.1

   HKEY_CLASSES_ROOTbxloader.loader.1clsid

   HKEY_CLASSES_ROOTbxloader.loaderclsid

   HKEY_CLASSES_ROOTbxloader.loadercurver

   HKEY_CLASSES_ROOTclsid{05075a7c-3bda-48a8-b40f-c0f71b039263}

   HKEY_CLASSES_ROOTclsid{098716a9-0310-4cbe-bd64-b790a9761158}

   HKEY_CLASSES_ROOTclsid{098716a9-0310-4cbe-bd64-b790a9761158} appid

   HKEY_CLASSES_ROOTclsid{098716a9-0310-4cbe-bd64-b790a9761158}inprocserver32

   HKEY_CLASSES_ROOTclsid{098716a9-0310-4cbe-bd64-b790a9761158}inprocserver32 threadingmodel

   HKEY_CLASSES_ROOTclsid{098716a9-0310-4cbe-bd64-b790a9761158}progid

   HKEY_CLASSES_ROOTclsid{098716a9-0310-4cbe-bd64-b790a9761158}programmable

   HKEY_CLASSES_ROOTclsid{098716a9-0310-4cbe-bd64-b790a9761158}typelib

   HKEY_CLASSES_ROOTclsid{098716a9-0310-4cbe-bd64-b790a9761158}versionindependentprogid

   HKEY_CLASSES_ROOTclsid{31de3194-c748-48bb-b620-2d0156b5e1ad}

   HKEY_CLASSES_ROOTclsid{382c8a97-bfef-47b5-9770-87c4de651e37}

   HKEY_CLASSES_ROOTclsid{3cfdeaeb-1421-4e49-bc18-9b70d7157fec}

   HKEY_CLASSES_ROOTclsid{3cfdeaeb-1421-4e49-bc18-9b70d7157fec} appid

   HKEY_CLASSES_ROOTclsid{3cfdeaeb-1421-4e49-bc18-9b70d7157fec}inprocserver32

   HKEY_CLASSES_ROOTclsid{3cfdeaeb-1421-4e49-bc18-9b70d7157fec}typelib

   HKEY_CLASSES_ROOTclsid{3cfdeaeb-1421-4e49-bc18-9b70d7157fec}versionindependentprogid

   HKEY_CLASSES_ROOTclsid{4ac96b80-a531-4590-b536-5dddb4d8ba28}

   HKEY_CLASSES_ROOTclsid{4e524163-8d00-46f3-b239-1f42d48c8ed0}

   HKEY_CLASSES_ROOTclsid{4e524163-8d00-46f3-b239-1f42d48c8ed0}inprocserver32

   HKEY_CLASSES_ROOTclsid{4e524163-8d00-46f3-b239-1f42d48c8ed0}inprocserver32 threadingmodel

   HKEY_CLASSES_ROOTclsid{4e524163-8d00-46f3-b239-1f42d48c8ed0}progid

   HKEY_CLASSES_ROOTclsid{4e524163-8d00-46f3-b239-1f42d48c8ed0}typelib

   HKEY_CLASSES_ROOTclsid{4e524163-8d00-46f3-b239-1f42d48c8ed0}versionindependentprogid

   HKEY_CLASSES_ROOTclsid{4f276921-6b61-42bc-abbb-12eadfc02fd3}

   HKEY_CLASSES_ROOTclsid{4f276921-6b61-42bc-abbb-12eadfc02fd3} appid

   HKEY_CLASSES_ROOTclsid{4f276921-6b61-42bc-abbb-12eadfc02fd3}inprocserver32

   HKEY_CLASSES_ROOTclsid{4f276921-6b61-42bc-abbb-12eadfc02fd3}inprocserver32 threadingmodel

   HKEY_CLASSES_ROOTclsid{4f276921-6b61-42bc-abbb-12eadfc02fd3}progid

   HKEY_CLASSES_ROOTclsid{4f276921-6b61-42bc-abbb-12eadfc02fd3}typelib

   HKEY_CLASSES_ROOTclsid{4f276921-6b61-42bc-abbb-12eadfc02fd3}versionindependentprogid

   HKEY_CLASSES_ROOTclsid{5355303a-2042-4c2a-b86a-3c81184d2401}

   HKEY_CLASSES_ROOTclsid{6537eff9-5372-40ca-8a1a-04283fb82e35}

   HKEY_CLASSES_ROOTclsid{8eb24324-3394-4c5f-b69c-744a74797952}

   HKEY_CLASSES_ROOTclsid{8eb24324-3394-4c5f-b69c-744a74797952}inprocserver32

   HKEY_CLASSES_ROOTclsid{b1afaf0d-825a-4844-a7b0-bbbdbad35486}

   HKEY_CLASSES_ROOTclsid{b1be4da0-f221-45f2-9f69-a0506030eaf9}

   HKEY_CLASSES_ROOTclsid{ca786302-0759-4467-a42b-6997341c5fba}

   HKEY_CLASSES_ROOTclsid{ca786302-0759-4467-a42b-6997341c5fba} appid

   HKEY_CLASSES_ROOTclsid{ca786302-0759-4467-a42b-6997341c5fba}inprocserver32

   HKEY_CLASSES_ROOTclsid{ca786302-0759-4467-a42b-6997341c5fba}inprocserver32 threadingmodel

   HKEY_CLASSES_ROOTclsid{ca786302-0759-4467-a42b-6997341c5fba}progid

   HKEY_CLASSES_ROOTclsid{ca786302-0759-4467-a42b-6997341c5fba}programmable

   HKEY_CLASSES_ROOTclsid{ca786302-0759-4467-a42b-6997341c5fba}typelib

   HKEY_CLASSES_ROOTclsid{ca786302-0759-4467-a42b-6997341c5fba}versionindependentprogid

   HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionshellserviceobjectdelayload gormet

   HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionshellserviceobjectdelayload pmkret

   HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallrichvideocodec

   HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallrichvideocodec displayicon

   HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallrichvideocodec displayname

   HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallrichvideocodec uninstallstring

   HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallwebvideo

References

• Faster PC Clean: How to Remove Rich Video Codec Trojan
• Windows: Using Windows Defender