How to remove malware 'webporpoise'

I have a really nasty malware infection. The malware is named 'webporpoise'; the name is found in the registry. I could not clense it with malicious software removal tool (MSRT) nor with Defender. One reference I found on the web was warning that there are many URLs on the web put there by the malware authors purporting to automatically remove webporpoise, but instead they make the infection worse. Good warning, but I always go only to Microsoft or TechNet for this kind of problem. Problem is... I do not find any references specifically to webporpoise.

The behavior of the malware is that it makes many common words in any text into hyperlinks and, if your mouse pointer passes over one of these hyperlinks a pop-up is displayed that advertises something. Actually I think it may not be a hyperlink... not exactly. It behaves more like a tool tip. The advertisement opens even with out clicking. A click sends you to an advertisement web page. You cannot even view the web page you are trying to browse unless you keep the mouse pointer well off of the page.

Please tell me someone has solved this removal problem and has a 'how to' write up.

I did try extreme measure using regedit. I had no listing of what to remove; but I have mostly removed it by removing all of the registry keys in which the name 'webporpoise' appears. This initially works but I am obviously missing something; some artifacts of the infection keep coming back.

A CM has moved your Thread from Windows 7 Forums.

They never said where they moved it from, so I am editing this to let posters know that when you say that you scanned with Defender that you should mean Windows Defender, the Anti-Spyware Application, not Windows Defender, the Anti-Virus in Windows 8/8.1.

Continue reading...