Posts Tagged ‘removal’

System Security 2009 fake virus program removal guide

Monday, July 27th, 2009



Remove System Security 2009 fake rogue spyware
System Security, also known as System Security 2009, (Fake anti virus program / Rogue spyware) is another deadly counterfeit antispyware application that developed to invade our Internet life. (Do not confuse System Security, which is fake softeware, to AE Software Technologies’ System Security 2009 which indeed a legit software). Presumably, System Security is a new verion of Winweb Security, with different name but same destruction. Just like most fake antispywares, System Security simulates the Windows system security alert interface, then issues misleading and exaggerated results to distract and scare the internet users.

System Security 2009 usually installed itself onto your PC without your permission, through Vundo Trojan, Virus or fake software. System Security will display fake system alerts or fake security alerts to trick user to buy the paid version of System Security, in order to remove the potential and reported problems. Not only does it cause your machine to slow down dramatically, it would also put your privacy and data in risk.

And Once installed, Security 2009 will be set to start automatically when Windows starts. Once started, the program will scan your computer and list a variety of infections, which cannot be removed unless you first purchase the program. These infections, though, are actually legitimate programs that could cause problems with the proper operation of your computer if deleted. While running, Security 2009 will also display fake security alerts in your Windows taskbar. These security alerts will contain messages stating that Security 2009 detected malware or an attack on your system and that you should register the software to protect yourself. These fake alerts and the false positives found in the scan are just a tactic to scare you into purchasing the software.



Manual System Security Removal Instructions:

Stop System Security Processes:
SystemSecurity.exe
05643921.exe
install.exe

Find and Delete these System Security Files:
systemsecurity.exe
SystemSecurity.lnk
SystemSecurity on the Web.lnk
Uninstall SystemSecurity.lnk
%desktopdirectory%\system security.lnk
%desktopdirectory%\ws\config.udb
%desktopdirectory%\ws\init.udb
%desktopdirectory%\ws\languages\english.lng
%desktopdirectory%\ws\languages\german.lng
%desktopdirectory%\ws\languages\spanish.lng
%desktopdirectory%\ws\systemsecurity.exe
%programs%\system security\system security.lnk
%desktopdirectory%\ws\systemsecurity.exe
05643921.exe
install.exe
%desktopdirectory%\system security 2009.lnk
%programs%\system security\system security 2009 support.lnk
%programs%\system security\system security 2009.lnk

Remove System Security Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run systemsecurity
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\systemsecurity2009
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\systemsecurity2009 displayicon
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\systemsecurity2009 displayname
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\systemsecurity2009 shortcutpath
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\systemsecurity2009 uninstallstring
=======================
Note: Manual removal guide can be confusing if you are a newbie. In that case, manual removal is not recommended. use an auto removal tool instead.
To automatically remove spywares,
use one of these great removal tools

Super Anti Spyware

Malware Bytes anti-malware (mbam.exe)

Spyware Doctor

=======================

Win Blue Soft Spyware popup removal

Monday, July 27th, 2009



Remove WiniBlueSoft rogue spyware
WiniBlueSoft removal should not be executed through Add / Remove Programs of Windows Start menu, since that will be a signal for WiniBlueSoft, which is rather a crushware, to start its destructive activities. At the same time, removal of WiniBlueSoft through Add / Remove Programs is unlikely to remove pop-ups and repeating scan which are normally the reason why users seek to get rid of WiniBlueSoft. WiniBlueSoft is a fake security application distributed with trojans and through websites pretending to be online scanners, as well as through more moderate websites that seem to be WiniBlueSoft homepage. Distribution of WiniBlueSoft is to be understood as installation of its trial version that frightens and tricks users as hackers expect some of them pay for registration after such a treatment. If infected, remove WiniBlueSoft instead of donating the hackers fund and stimulating the development of other misleading tools.



WiniBlueSoft manual removal instructions:

Delete WiniBlueSoft files:
always_skip.xml
data.bin
License.txt
main_config.xml
uninstall.exe
WiniBlueSoft.exe
c:Homepage.lnk
c:Uninstall.lnk
c:WiniBlueSoft.lnk
102959roz2b45.ocx
10325virusz955.ocx
10355h9eat227z2.cpl
111znot-a-v5rus998.dll
115z1vi9us3e85.ocx
11797tzoj595.dll
1197addwaze16915.ocx
127b95ief305z.ocx
12946sz5mbot79c.dll
129cvir1z58.dll
12bbszy5ar91941.dll
13323w95mz1b.ocx
135zvir1929.cpl
1393z5or9df.ocx
13951spzmb9t5a2.exe
14041hackt5zl99.exe
19199hackt5zl7a1.bin
19524spyze9.exe
19544spy6fbz.ocx
19945hzcktool65b.dll
19991not-a-v5rzs1c9.exe
19z43hacktoo965f.exe
1a59dow9lozder1735.ocx
1b20z9a5se2186.bin

Delete WiniBlueSoft registry entries:
HKEY_CURRENT_USER\Software\WiniBlueSoft
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Uninstall\WiniBlueSoft
HKEY_LOCAL_MACHINE\SOFTWARE\WiniBlueSoft
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Run “setup2.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Run “WiniBlueSoft”
=======================
Note: Manual removal guide can be confusing if you are a newbie. In that case, manual removal is not recommended. use an auto removal tool instead.
To automatically remove spywares,
use one of these great removal tools

Super Anti Spyware

Malware Bytes anti-malware (mbam.exe)

Spyware Doctor

=======================

Virtumonde spyware removal guide

Monday, July 27th, 2009



VirtuMonde.
Below are step by step instructions to remove VirtuMonde from your computer.
Note: This process is difficult and is not recommend unless you are an expert in this field. The manual process is also dangerous as the removal process requires you to access and edit sensitive files in the registry of your machine and run the risk of totally destroying your computer.
An important point to remember when removing VirtuMonde is to delete all parts of the VirtuMonde code. This is a must as VirtuMonde will rebuild itself and will result in further spreading of the spyware parasite.

Visit our tools page for some very good programs to remove VirtuMonde or any other spyware that your machine may have simply picked up. Download Super Anti Spyware (FREE).

VirtuMonde Description

VirtuMonde is adware that may monitor your web browsing and display targeted advertisements.

VirtuMonde Removal Instructions

Before you can delete files, you must first stop all the VirtuMonde processes that are running in memory.
Do this by ending all processes from the Task Manager.
Press CTRL+ALT+DELETE to open the Windows Task Manager. If you see multiple
“tabs,” click on the “Processes” tab. For each process that you would like
to kill, find the process name in the list, click it to select it, and click
the “End Process” button.

Step 2 :
Delete registry values Instructions:
Open the Windows Registry Editor by clicking on the Windows “Start” button,
clicking “Run,” and typing “regedit” into the box in the Window that appears. Click “OK”.
Once the Registry Editor is open, navigate through the registry tree to the
location of the key that you wish to delete. When you find the key or
value to be deleted, click on it to highlight it and press the “DELETE” key.

Unregister DLL Instructions:
To un-register a DLL file, first locate the file on your hard drive.
Open a command prompt window by clicking on the Windows “Start” button,
clicking “Run,” and typing “cmd” into the box in the Window that appears. Click “OK.”
Next type “regsvr32 /u ” and press the “ENTER” key.
For example, to un-register a file called “myDll.dll” which is located in
the “C:\windows\system32″ folder, your would type
“regsvr32 /u C:\windows\system32\myDll.dll” and press the “ENTER” key.

Delete File Entries:
lspak.dll
rulesak.dll
=======================
Note: Manual removal guide can be confusing if you are a newbie. In that case, manual removal is not recommended. use an auto removal tool instead.
To automatically remove spywares,
use one of these great removal tools

Super Anti Spyware

Malware Bytes anti-malware (mbam.exe)

Spyware Doctor

=======================

Spyware Protect 2009 removal guide

Monday, July 27th, 2009



Spyware Protector 2009 is another scam, fake anti-spyware application. Like many similar rogue programs, SpywareProtector 2009 is designed to steal money from users. It uses scare tactics and other similar methods to trick user and make him believe that his computer is seriously infected.
Spyware Protector 2009 comes to the computer with a help of trojans or other similar viruses. Also it can be downloaded and installed from scammers’ website, but this is less common case. Once SpywareProtector2009 enters the system, it starts computer scan automatically and produces many pop-up windows with fake information about system’s security problems, errors and other infections. In such a situation cyber-thieves recommend to use their counterfeit product called Spyware Protector 2009. It should also be noted that it is paid.
It is essential that you remove Spyware Protection 2009 and all of it’s files from your computer before you make the big mistake of spending your money on this ineffective program. Because Spyware Protection 2009 does not remove parasites or protect your computer in anyway, it should not be purchased or even installed for that matter. It is recommended that you use a good spyware detection tool to identify the Spyware Protection 2009 program on your system so it may be removed safely.

Related files: SpywareProtector2009.exe

Spyware Protector 2009 properties:
• Changes browser settings
• Shows commercial adverts
• Connects itself to the internet
• Stays resident in background

Auto removal of SpywareProtector 2009 using software: Download Super anti spyware(FREE) to remove SpywareProtector 2009

Spyware Protector 2009 manual removal:
Step 1 : Use Windows File Search Tool to Find Spyware Protection 2009 Path
Go to Start > Search > All Files or Folders.
In the “All or part of the the file name” section, type in “Spyware Protection 2009″ file name(s).
To get better results, select “Look in: Local Hard Drives” or “Look in: My Computer” and then click “Search” button.
When Windows finishes your search, hover over the “In Folder” of “Spyware Protection 2009″, highlight the file and copy/paste the path into the address bar. Save the file’s path on your clipboard because you’ll need the file path to delete Spyware Protection 2009 in the following manual removal steps.

Step 2 : Use Windows Task Manager to Remove Spyware Protection 2009 Processes
To open the Windows Task Manager, use the combination of CTRL+ALT+DEL or CTRL+SHIFT+ESC.
Click on the “Image Name” button to search for “Spyware Protection 2009″ process by name.
Select the “Spyware Protection 2009″ process and click on the “End Process” button to kill it.
Remove the “Spyware Protection 2009″ processes files:
seeukluba.exe
skaaanret.exe
aazalirt.exe
ronitfst.exe


Step 3 : Use Registry Editor to Remove Spyware Protection 2009 Registry Values
To open the Registry Editor, go to Start > Run > type regedit and then press the “OK” button.
Locate and delete the entry or entries whose data value (in the rightmost column) is the spyware file(s) detected earlier.
To delete “Spyware Protection 2009″ value, right-click on it and select the “Delete” option.
Locate and delete “Spyware Protection 2009″ registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “sysguardn”
HKEY_CURRENT_USER\Software\AvScan

Step 4 : Detect and Delete Other Spyware Protection 2009 Files
To open the Windows Command Prompt, go to Start > Run > type cmd and then press the “OK” button.
Type in “dir /A name_of_the_folder” (for example, C:\Spyware-folder), which will display the folder’s content even the hidden files.
To change directory, type in “cd name_of_the_folder”.
Once you have the file you’re looking for type in “del name_of_the_file”.
To delete a file in folder, type in “del name_of_the_file”.
To delete the entire folder, type in “rmdir /S name_of_the_folder”.
Select the “Spyware Protection 2009″ process and click on the “End Process” button to kill it.
Remove the “Spyware Protection 2009″ processes files:
Uninstall Spyware Protection 2009.lnk
Spyware Protection 2009.lnk
seeukluba.exe
skaaanret.exe
aazalirt.exe
ronitfst.exe
=======================
Note: Manual removal guide can be confusing if you are a newbie. In that case, manual removal is not recommended. use an auto removal tool instead.
To automatically remove spywares,
use one of these great removal tools

Super Anti Spyware

Malware Bytes anti-malware (mbam.exe)

Spyware Doctor

=======================