Kollah Removal Guide

Do you know what Kollah is?

Kollah or Kollah Trojan, is a serious Trojan horse infection that may come from illegal websites or from spam messages. Kollah is a Trojan that is known to be installed without notifying the computer user. What is even more dangerous about Kollah is that it may run in the background going undetected for several days where it may install other malware.

In non-techie terms:
Kollah is basically a backdoor Trojan where it may open up your computer to where it may be hacked by remote users. A remote user or hacker may be able to gain control of a machine infected by Kollah. Theft of your passwords or account information may lead to identity theft if Kollah is not removed.

Aliases: Kollah, Kollah Trojan.

Kollah Automatic Removal Instructions

Kollah Manual Removal Instructions

This manual removal method is for techie computer users. Kollah manual removal may be difficult and time consuming to remove. There's no guarantee that Kollah will be removed completely. So read the Kollah removal steps carefully and good luck.
Before you start: Close all programs and Internet browsers. Also back up your computer in case you make a mistake and your computer stops working.

  1. Uninstall Kollah Program
    Click on Start > Settings > Control Panel > Double-click on Add/Remove Programs. Search for and uninstall Kollah if found.
  2. To stop Kollah processes (view process removal steps)
    Go to Start > Run > type taskmgr. The click the Processes tab and you'll see a list of running processes.
    Search and stop these Kollah processes:
    exel_invoice_nr719200.exe
    ntos.exe
    For each unwanted process, right-click on it and then select "End task".
  3. To Unregister Kollah DLLs (view DLL removal steps)
    Search and unregister these Kollah DLLs:
    audio.dll
    video.dll

    To locate the Kollah DLL path, go to Start > Search > All Files or Folders. Type Kollah and in the Look in: select either My Computer or Local Hard Drives. Click the Search button.
    Once you have the Kollah DLL path, go to Start and then click on Run. In the Run command box, type cmd, and then click on OK.
    To locate the exact DLL path, type cd in order to change the current directory. To display the contents of the directory, use the dir command. To remove the DLL file type regsvr32 /u FILENAME.dll (FILENAME is the name of the file that you want to unregister).
  4. If your homepage has been changed, go to Start > Control Panel > Internet Options > click on the General > click Use Default under Home Page. Add the your desired default homepage, then click Apply > click OK. Open a new web browser to check that you have your desired default homepage.
  5. Remove Kollah Directories.
    To find Kollah directories, go to Start > My Computer > Local Disk (C:) > Program Files > Show the contents of this folder.
    Search and delete the following Kollah directories:
    C:\Windows\SYSTEM\wsnpoem

    Right-click on the Kollah folder and select Delete.
    A message will appear saying 'Are you sure you want to remove the folder Kollah and move all its contents to the Recycle Bin?', click Yes.
    Another message will appear saying 'Renaming, moving or deleting Kollah could make some programs not work. Are you sure you want to do this?', click Yes.
  6. To remove Kollah icons on your Desktop, drag and drop them to the Recycle Bin.

You've completed the Kollah manual removal instructions!
I hope this article has helped you solve your Kollah problems. If you want to contribute to this article, post your comment below.

Disclaimer: This article is for educational purposes. By using this information you agree to be bound by the disclaimer. There's no guarantee that Kollah will be completely removed from your computer. Seek professional help if your computer continues to experience problems.

Tags: .
  • Bob R

    I have gone through the "non-techie" process above, but at the end of step 5, you say to reboot the computer.. is this in safe mode again? Is it using the Smitfraud reboot option? Also, when I get to step 10, my computer says it doesn't recognize "C:\Windows\Temp"...
    I know the trojan is attached to a registry key, and have found no success removing it. Any suggestions?
    Bob

  • Valentino

    Hello Bob,

    Please try rebooting into normal mode.

    Thanks for writing.