Spyware and Malware Removal Guides

How to remove Ultra Antivir2009 (Removal Guide)

Wed, 31 Dec 1969 19:00:00 EST

How to remove Ultra Antivir2009 (Removal Guide)

What this programs does:

Ultra Antivir2009 is a clone of the rogue anti-spyware programs
named Virus
Doctor and Virus
Alarm . This program is malvertised, which means to be advertised and promoted
via the use of malware. When infected with certain Trojans, they will automatically
download and install Ultra Antivir2009 onto your computer. The installer will
also create harmless files that are intended to be detected as infections by
Ultra Antivir. Once installed, the program will be configured to run automatically
and then start scanning your system. When the program has finished scanning,
it will state that your computer is infected with a variety of different malware
and will not remove these files until you have purchased the program. The files
it states are infections, though, are actually the harmless files it created
on your computer in the first place.

Ultra Antivir2009 Screen shot
For more screen shots of this infection click on the image above.
There are a total of 7 images you can view.

While the program is running you will also be bombarded with numerous nag screens
and security warnings. These warnings include threats of attack to your computer,
your computer sending data to a remote machine, and viruses deleting your files.
Regardless of what these screens state, they should all be ignored as they are
only being used to scare you into purchasing the program. These nag screens,
though, can be quite annoying as they will stay on top of any running applications
and will not go away until you dismiss them.

If you are infected with Ultra Antivir2009, then please use the following guide
to remove it and any associated malware for free.

Threat Classification:

Information on Rogue Programs

Advanced information:

View Ultra Antivir2009 files.

View Ultra Antivir2009 Registry Information.

Tools Needed for this fix:

Malwarebytes' Anti-Malware

Symptoms that may be in a HijackThis Log:

O4 - HKCU\..\Run: [Ultra Antivir2009] "C:\Documents and Settings\All Users\Application Data\7c69f0c\UA2009.exe" /s /d

Guide Updates:

03-26-09 - Initial guide creation.

Automated Removal Instructions for Ultra Antivir2009 using Malwarebytes' Anti-Malware:

Print out these instructions as we will need to close every window that
is open later in the fix.

Download Malwarebytes' Anti-Malware, or MBAM, from the following location
and save it to your desktop:

Malwarebytes' Anti-Malware Download Link

Once downloaded, close all programs and Windows on your computer, including
this one.

Double-click on the icon on your desktop named Download_mbam-setup.exe.
This will start the installation of MBAM onto your computer.

When the installation begins, keep following the prompts in order to continue
with the installation process. Do not make any changes to default settings
and when the program has finished installing, make sure you leave both the
Update Malwarebytes' Anti-Malware and Launch
Malwarebytes' Anti-Malware checked. Then click on the Finish
button.

MBAM will now automatically start and you will see a message stating that
you should update the program before performing a scan. As MBAM will automatically
update itself after the install, you can press the OK button
to close that box and you will now be at the main program as shown below.

On the Scanner tab, make sure the the Perform
quick scan option is selected and then click on the Scan
button to start scanning your computer for Ultra Antivir2009 related
files.

MBAM will now start scanning your computer for malware. This process can
take quite a while, so we suggest you go and do something else and periodically
check on the status of the scan. When MBAM is scanning it will look like the
image below.

When the scan is finished a message box will appear as shown in the image
below.

You should click on the OK button to close the message box and continue with
the UltraAntivir2009 removal process.

You will now be back at the main Scanner screen. At this point you should
click on the Show Results button.

A screen displaying all the malware that the program found will be shown
as seen in the image below. Please note that the infections found may be different than what is shown in the image.

You should now click on the Remove Selected button to remove
all the listed malware. MBAM will now delete all of the files and registry
keys and add them to the programs quarantine. When removing the files, MBAM
may require a reboot in order to remove some of them. If it displays a message
stating that it needs to reboot, please allow it to do so. Once your computer
has rebooted, and you are logged in, please continue with the rest of the
steps.

When MBAM has finished removing the malware, it will open the scan log and
display it in Notepad. Review the log as desired, and then close the Notepad
window.

You can now exit the MBAM program.

Your computer should now be free of the UltraAntivir2009 program. If your current anti-virus solution let this infection through, you may want to consider purchasing the PRO version of Malwarebytes' Anti-Malware to protect against these types of threats in the future.

If you are still having problems with your computer after completing these instructions, then please follow the steps outlined in the topic linked below:

Preparation Guide For Use Before Posting A Hijackthis Log

Associated Ultra Antivir2009 Files:

c:\WINDOWS\std.drv

c:\WINDOWS\$hf_mig$\KB947864-IE7\update\kernel32.tmp

c:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\delfile.sys

c:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\CLSV.dll

c:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\energy.exe

c:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\CLSV.dll

c:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\ANTIGEN.sys

c:\WINDOWS\ime\exec.dll

c:\WINDOWS\ime\snl2w.drv

c:\WINDOWS\Installer\$PatchCache$\Managed\D6461317C3DC4F04799BDCE9E42626FE\2.0.50727\ANTIGEN.sys

c:\WINDOWS\Installer\$PatchCache$\Managed\D6461317C3DC4F04799BDCE9E42626FE\2.0.50727\energy.exe

c:\WINDOWS\ServicePackFiles\i386\ppal.dll

c:\WINDOWS\ServicePackFiles\i386\ppal.tmp

c:\WINDOWS\ServicePackFiles\i386\SICKBOY.exe

c:\WINDOWS\ServicePackFiles\i386\snl2w.drv

c:\WINDOWS\system32\tjd.exe

c:\Documents and Settings\All Users\Application Data\7c69f0c

c:\Documents and Settings\All Users\Application Data\7c69f0c\UA2009.exe

c:\Documents and Settings\All Users\Application Data\7c69f0c\SystemStore

c:\Documents and Settings\All Users\Application Data\7c69f0c\SystemStore\vd952342.bd

c:\Documents and Settings\All Users\Application Data\SystemStore

c:\Documents and Settings\All Users\Application Data\SystemStore\uavir.cfg

%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Ultra Antivir2009.lnk

%UserProfile%\Application Data\Ultra Antivir2009

%UserProfile%\Application Data\Ultra Antivir2009\Instructions.ini

%UserProfile%\Desktop\Ultra Antivir2009.lnk

%UserProfile%\Start Menu\Ultra Antivir2009.lnk

%UserProfile%\Start Menu\Programs\Ultra Antivir2009.lnk

Associated Ultra Antivir2009 Windows Registry Information:

HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}

HKEY_CLASSES_ROOT\CLSID\{425882B0-B0BF-11CE-B59F-00AA006CB37D}

HKEY_CLASSES_ROOT\UA2009.DocHostUIHandler

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "4800156103"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Ultra Antivir2009"

This is a self-help guide. Use at your own risk.

If you have any questions about this self-help guide then please post those questions in our AntiVirus, Firewall and Privacy Products and Protection Methods forum and someone will help you.

SpyFighter Removal Guide

Wed, 31 Dec 1969 19:00:00 EST

SpyFighter Removal Guide

What this programs does:

SpyFighter is a rogue anti-spyware program that displays fake
infections in order to trick you into purchasing the software. This program
is advertised through the use of Trojans that display fake security alerts on
your computer. These alerts will state that your computer is infected or under
attack and that you should click on the alert to get protection. Once you click
on the alert, the Trojan will automatically download and install SpyFighter
without your permission. Once the program is installed it will be configured
to start automatically when you login to Windows. Once started it will scan
your computer and list a variety of infections that cannot be removed unless
you purchase the program. These infections, though, are all fake and are only
being shown to scare you into purchasing the program.

SpyFighter screen shot
For more screen shots of this infection click on the image above.
There are a total of 2 images you can view.

While SpyFighter is running you will continue to see nag screens and security
alerts stating that your computer is under attack. These nag screens can get
quite annoying as they will pop-up over your running applications and cannot
be closed without going through a series of "are you sure?" type screens.
Another byproduct of this program being installed is that your computer will
begin to operate slower. This is because the program is always running in the
background while using resources that legitimate programs could better use.

If you are infected with SpyFighter, then please use the guide below in order
to remove this malware and the Trojans that installed it.

Threat Classification:

Information on Rogue Programs

Advanced information:

View SpyFighter files.

View SpyFighter Registry Information.

Entries for this program found in the Add or Remove Programs control panel:

SpyFighter

Tools Needed for this fix:

Malwarebytes' Anti-Malware

Symptoms that may be in a HijackThis Log:

O4 - HKLM\..\Run: [SpyFighter] C:\Program Files\SpyFighter\SpyFighter.exe

Guide Updates:

03-21-09 - Initial guide creation.

Automated Removal Instructions for SpyFighter using Malwarebytes' Anti-Malware:

Print out these instructions as we will need to close every window that
is open later in the fix.

Download Malwarebytes' Anti-Malware, or MBAM, from the following location
and save it to your desktop:

Malwarebytes' Anti-Malware Download Link

Once downloaded, close all programs and Windows on your computer, including
this one.

Double-click on the icon on your desktop named Download_mbam-setup.exe.
This will start the installation of MBAM onto your computer.

When the installation begins, keep following the prompts in order to continue
with the installation process. Do not make any changes to default settings
and when the program has finished installing, make sure you leave both the
Update Malwarebytes' Anti-Malware and Launch
Malwarebytes' Anti-Malware checked. Then click on the Finish
button.

MBAM will now automatically start and you will see a message stating that
you should update the program before performing a scan. As MBAM will automatically
update itself after the install, you can press the OK button
to close that box and you will now be at the main program as shown below.

On the Scanner tab, make sure the the Perform
quick scan option is selected and then click on the Scan
button to start scanning your computer for SpyFighter related
files.

MBAM will now start scanning your computer for malware. This process can
take quite a while, so we suggest you go and do something else and periodically
check on the status of the scan. When MBAM is scanning it will look like the
image below.

When the scan is finished a message box will appear as shown in the image
below.

You should click on the OK button to close the message box and continue with
the Spy Fighter removal process.

You will now be back at the main Scanner screen. At this point you should
click on the Show Results button.

A screen displaying all the malware that the program found will be shown
as seen in the image below. Please note that the infections found may be different than what is shown in the image.

You should now click on the Remove Selected button to remove
all the listed malware. MBAM will now delete all of the files and registry
keys and add them to the programs quarantine. When removing the files, MBAM
may require a reboot in order to remove some of them. If it displays a message
stating that it needs to reboot, please allow it to do so. Once your computer
has rebooted, and you are logged in, please continue with the rest of the
steps.

When MBAM has finished removing the malware, it will open the scan log and
display it in Notepad. Review the log as desired, and then close the Notepad
window.

You can now exit the MBAM program.

Your computer should now be free of the Spy Fighter program. If your current anti-virus solution let this infection through, you may want to consider purchasing the PRO version of Malwarebytes' Anti-Malware to protect against these types of threats in the future.

If you are still having problems with your computer after completing these instructions, then please follow the steps outlined in the topic linked below:

Preparation Guide For Use Before Posting A Hijackthis Log

Associated SpyFighter Files:

%UserProfile%\Desktop\SpyFighter.lnk

%UserProfile%\Start Menu\Programs\SpyFighter

%UserProfile%\Start Menu\Programs\SpyFighter\SpyFighter.lnk

%UserProfile%\Start Menu\Programs\SpyFighter\SpyFighterScan.lnk

%UserProfile%\Start Menu\Programs\SpyFighter\Uninstall.lnk

c:\Program Files\SpyFighter

c:\Program Files\SpyFighter\SpyFighter.exe

c:\Program Files\SpyFighter\uninstall.exe

c:\Documents and Settings\All Users\Application Data\SpyFighter

Associated SpyFighter Windows Registry Information:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyFighter

HKEY_LOCAL_MACHINE\SOFTWARE\SpyFighter

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "SpyFighter"

This is a self-help guide. Use at your own risk.

If you have any questions about this self-help guide then please post those questions in our AntiVirus, Firewall and Privacy Products and Protection Methods forum and someone will help you.

Remove Renus 2008

Wed, 31 Dec 1969 19:00:00 EST

Remove Renus 2008

�

What this programs does:

Renus 2008 is a clone of the rogue anti-spyware programs called
Antivirus
XP Pro and AntiSpyware
3000. Like its predecessors, this rogue is installed and advertised through
the use of Trojans. These Trojans will display nag screens stating that you
are infected until you click on them. Once you click on the alert, it automatically
downloads and installs Renus 2008 onto your computer.

�

Renus 2008 screen shot
For more screen shots of this infection click on the image above.
There are a total of 3 images you can view.

�

When Renus is installed, it will be set to start every time you login to Windows.
Once running, it will scan your computer and list a variety of infections that
cannot be removed unless you purchase the program. These infections, though,
are actually hard
coded into the program so that regardless of how many times you run the
program it will always display the same infections. In fact, regardless of how
infected your computer is, Renus 2008 is incapable of detecting any infections
on your computer other than the false ones hard coded into the program. The
infections it states it detects are always:

C:\WINDOWS\EasyAV.exe as W32/Zafi-B

C:\WINDOWS\Config\PWS-LegMir.dll as Packed.Win32.NSAnti.r

C:\Program Files\Britney Spears blowjob.jpg.exe as W32/Netsky-P

C:\WINDOWS\system32\idd78f.tmp.exe as Porn-Dialer.Win32.IDialer.k

C:\WINDOWS\system32\drivers\ip6fw.sys as Troj/Pushdo-Gen

C:\WINDOWS\system32\WarezP2P_DLC.exe as Packed.Win32.PolyCrypt.d

C:\WINDOWS\system32\r2qfkspe.exe as W32/Strati-Gen

C:\WINDOWS\lsass.exe as W32/MyDoom-N

C:\WINDOWS\system32\scanregw.exe as W32/Nyxem-D

C:\WINDOWS\system32\Winzip.exe as Mal/Iframe-E

This rogue will also display alerts from your Windows taskbar stating that
your computer has infections and is at risk. he current text of this alert is:

Your Computer might be at Risk!

Viruses have been detected!

Possible:

- Unauthorized access to your files, documents.

- Stealing from your banking accounts.

- Reading you private correspondence.

- Spam-mailing from your PC.

Highly recommended to destroy them immediately.

Please disregard anything this program tells you. Instead use the removal guide
below in order to remove this infection for free.

�

Threat Classification:

Information on Rogue Programs

�

Advanced information:

View Renus 2008 files.

View Renus 2008 Registry Information.

�

Tools Needed for this fix:

Malwarebytes' Anti-Malware

�

Symptoms that may be in a HijackThis Log:

O4 - HKCU\..\Run: [renus2008.exe] %DownloadedLocation%\renus.exe

�

Guide Updates:

03-18-09 - Initial guide creation.

�

Automated Removal Instructions for Renus 2008 using Malwarebytes' Anti-Malware:

�

Print out these instructions as we will need to close every window that
is open later in the fix.

Download Malwarebytes' Anti-Malware, or MBAM, from the following location
and save it to your desktop:

Malwarebytes' Anti-Malware Download Link

Once downloaded, close all programs and Windows on your computer, including
this one.

Double-click on the icon on your desktop named Download_mbam-setup.exe.
This will start the installation of MBAM onto your computer.

When the installation begins, keep following the prompts in order to continue
with the installation process. Do not make any changes to default settings
and when the program has finished installing, make sure you leave both the
Update Malwarebytes' Anti-Malware and Launch
Malwarebytes' Anti-Malware checked. Then click on the Finish
button.

MBAM will now automatically start and you will see a message stating that
you should update the program before performing a scan. As MBAM will automatically
update itself after the install, you can press the OK button
to close that box and you will now be at the main program as shown below.

On the Scanner tab, make sure the the Perform
quick scan option is selected and then click on the Scan
button to start scanning your computer for Renus 2008 related
files.

MBAM will now start scanning your computer for malware. This process can
take quite a while, so we suggest you go and do something else and periodically
check on the status of the scan. When MBAM is scanning it will look like the
image below.

When the scan is finished a message box will appear as shown in the image
below.

You should click on the OK button to close the message box and continue with
the Renus2008 removal process.

You will now be back at the main Scanner screen. At this point you should
click on the Show Results button.

A screen displaying all the malware that the program found will be shown
as seen in the image below. Please note that the infections found may be different than what is shown in the image.

You should now click on the Remove Selected button to remove
all the listed malware. MBAM will now delete all of the files and registry
keys and add them to the programs quarantine. When removing the files, MBAM
may require a reboot in order to remove some of them. If it displays a message
stating that it needs to reboot, please allow it to do so. Once your computer
has rebooted, and you are logged in, please continue with the rest of the
steps.

When MBAM has finished removing the malware, it will open the scan log and
display it in Notepad. Review the log as desired, and then close the Notepad
window.

You can now exit the MBAM program.

Your computer should now be free of the Renus2008 program. If your current anti-virus solution let this infection through, you may want to consider purchasing the PRO version of Malwarebytes' Anti-Malware to protect against these types of threats in the future.

If you are still having problems with your computer after completing these instructions, then please follow the steps outlined in the topic linked below:

Preparation Guide For Use Before Posting A Hijackthis Log

�

Associated Renus 2008 Files:

%DownloadedLocation%\renus.exe

%DownloadedLocation%\Plugins

%DownloadedLocation%\Plugins\B21L51aE1xcE231P.cfg

�

Associated Renus 2008 Windows Registry Information:

HKEY_CURRENT_USER\Software\renus2008

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "renus2008.exe"

�

This is a self-help guide. Use at your own risk.

If you have any questions about this self-help guide then please post those questions in our AntiVirus, Firewall and Privacy Products and Protection Methods forum and someone will help you.

How to remove Virus Melt (Uninstall Guide)

Wed, 31 Dec 1969 19:00:00 EST

How to remove Virus Melt (Uninstall Guide)

What this programs does:

Virus Melt is a clone of the rogue anti-spyware programs
called Virus
Doctor. Just like Virus Doctor, Virus Melt uses false online advertising,
fake scan alerts, and false security alerts on your computer in order to coerce
you into buying their program. This variant does introduce a change by installing
fake malware files onto your computer. These malware files are used to impersonate
real malware infections, but are in reality harmless files. They are only
being installed in order for the program to be able to falsely detect them
as infections.

Virus Melt screen shot
For more screen shots of this infection click on the image above.
There are a total of 13 images you can view.

Once installed, an entry to the Windows Registry will be made that causes
Virus Melt to start automatically when you logon to Windows. Once running,
it will perform a scan and list a variety of infections that can't be removed
until you purchase the program. The infections found, though, are actually
the files that were installed by the program in the first place and are all
fake. While the program is running you will also be bombarded with numerous
alerts and and pop-ups stating that your computer is infected, that your computer
is sending out private data to remote computers, and that you need to register
the program to fix all of these issues. These screens are called nag screens
and are only being shown to scare you into thinking you are infected and hopefully
you purchase the program. Please disregard these messages and instead use
the removal guide below to remove Virus Melt for free.

Threat Classification:

Information on Rogue Programs

Advanced information:

View Virus Melt files.

View Virus Melt Registry Information.

Tools Needed for this fix:

Malwarebytes' Anti-Malware

Symptoms that may be in a HijackThis Log:

O4 - HKCU\..\Run: [Virus Melt] "%UserProfile%\Desktop\ReleaseXP.exe"
/s

Guide Updates:

03-02-09 - Initial guide creation.

Automated Removal Instructions for Virus Melt using Malwarebytes' Anti-Malware:

Print out these instructions as we will need to close every window that
is open later in the fix.

Download Malwarebytes' Anti-Malware, or MBAM, from the following location
and save it to your desktop:

Malwarebytes' Anti-Malware Download Link

Once downloaded, close all programs and Windows on your computer, including
this one.

Double-click on the icon on your desktop named Download_mbam-setup.exe.
This will start the installation of MBAM onto your computer.

When the installation begins, keep following the prompts in order to continue
with the installation process. Do not make any changes to default settings
and when the program has finished installing, make sure you leave both the
Update Malwarebytes' Anti-Malware and Launch
Malwarebytes' Anti-Malware checked. Then click on the Finish
button.

MBAM will now automatically start and you will see a message stating that
you should update the program before performing a scan. As MBAM will automatically
update itself after the install, you can press the OK button
to close that box and you will now be at the main program as shown below.

On the Scanner tab, make sure the the Perform
quick scan option is selected and then click on the Scan
button to start scanning your computer for Virus Melt related
files.

MBAM will now start scanning your computer for malware. This process can
take quite a while, so we suggest you go and do something else and periodically
check on the status of the scan. When MBAM is scanning it will look like the
image below.

When the scan is finished a message box will appear as shown in the image
below.

You should click on the OK button to close the message box and continue with
the Virus Melt 2009 removal process.

You will now be back at the main Scanner screen. At this point you should
click on the Show Results button.

A screen displaying all the malware that the program found will be shown
as seen in the image below. Please note that the infections found may be different than what is shown in the image.

You should now click on the Remove Selected button to remove
all the listed malware. MBAM will now delete all of the files and registry
keys and add them to the programs quarantine. When removing the files, MBAM
may require a reboot in order to remove some of them. If it displays a message
stating that it needs to reboot, please allow it to do so. Once your computer
has rebooted, and you are logged in, please continue with the rest of the
steps.

When MBAM has finished removing the malware, it will open the scan log and
display it in Notepad. Review the log as desired, and then close the Notepad
window.

You can now exit the MBAM program.

Your computer should now be free of the VirusMelt program.
If your current anti-virus solution let this infection through, you may want
to consider purchasing
the PRO version of Malwarebytes' Anti-Malware to protect against these
types of threats in the future.

If you are still having problems with your computer after completing these instructions, then please follow the steps outlined in the topic linked below:

Preparation Guide For Use Before Posting A Hijackthis Log

Associated Virus Melt Files:

c:\Documents and Settings\All Users\Application Data\7c69f0c

c:\Documents and Settings\All Users\Application Data\7c69f0c\VMelt.exe

c:\Documents and Settings\All Users\Application Data\7c69f0c\System Data

c:\Documents and Settings\All Users\Application Data\7c69f0c\System Data\vd952342.bd

c:\Documents and Settings\All Users\Application Data\System Data

c:\Documents and Settings\All Users\Application Data\System Data\mscfg.ini

c:\WINDOWS\$NtServicePackUninstall$\SICKBOY.exe

c:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\ANTIGEN.sys

c:\WINDOWS\ie7\delfile.sys

c:\WINDOWS\ie7\sld.exe

c:\WINDOWS\inf\sld.sys

c:\WINDOWS\Installer\$PatchCache$\Managed\D6461317C3DC4F04799BDCE9E42626FE\2.0.50727\exec.dll

c:\WINDOWS\Installer\$PatchCache$\Managed\D6461317C3DC4F04799BDCE9E42626FE\2.0.50727\SM.exe

c:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Common\gid.dll

c:\WINDOWS\Prefetch\fix.drv

c:\WINDOWS\system32\mui\0009\snl2w.sys

c:\WINDOWS\system32\mui\0401\fix.drv

c:\WINDOWS\system32\mui\0401\PE.sys

%UserProfile%\Application Data\Virus Melt

%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Virus
Melt.lnk

%UserProfile%\Application Data\Virus Melt\Instructions.ini

%UserProfile%\Application Data\Virus Melt\wrkdata.cfg

%UserProfile%\Desktop\Virus Melt.lnk

%UserProfile%\Start Menu\Virus Melt.lnk

%UserProfile%\Start Menu\Programs\Virus Melt.lnk

Associated Virus Melt Windows Registry Information:

HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}

HKEY_CLASSES_ROOT\VMelt.DocHostUIHandler

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User
Agent\Post Platform "URVMLT[]"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Virus
Melt"

This is a self-help guide. Use at your own risk.

If you have any questions about this self-help guide then please post those questions in our AntiVirus, Firewall and Privacy Products and Protection Methods forum and someone will help you.

How To Remove Xp Cleaner (removal Instructions)

Wed, 31 Dec 1969 19:00:00 EST

How to remove XPCleaner (Removal Instructions)

What this programs does:

XPCleaner advertises itself as program that protects your privacy
by scanning your computer for risks and alerting you to them. The problem with
this program is that when it scans your computer it will display false and exaggerated
security risks and will only remove these so-called risks if you first purchase
XPCleaner. This method of displaying exaggerated or false results, and then requiring
you to purchase the program before you can fix anything, is a scam and places
this program into the category of rogue security programs.

A screenshot of XPCleaner can be found below.

XPCleaner Screenshot

This guide will walk you through removing the XPCleaner program and malware that may typically be installed with it.

Tools Needed for this fix:

Malwarebytes'
Anti-Malware

Symptoms in a HijackThis Log:

O4 - HKCU\..\Run: [XP Cleaner] C:\Program Files\XP Cleaner\xpc.exe

Guide Updates:

02/18/08 - Initial guide creation.

Automated Removal Instructions
for XPCleaner:

Print out these instructions as we will need to close every window that
is open later in the fix.

Download Malwarebytes' Anti-Malware, or MBAM, from the following location
and save it to your desktop:

Malwarebytes'
Anti-Malware Download Link

Once downloaded, close all programs and Windows on your computer, including
this one.

Double-click on the icon on your desktop named Download_mbam-setup.exe.
This will start the installation of MBAM onto your computer.

When the installation begins, keep following the prompts in order to continue
with the installation process. Do not make any changes to default settings
and when the program has finished installing, make sure you leave both the
Update Malwarebytes' Anti-Malware and Launch
Malwarebytes' Anti-Malware checked. Then click on the Finish
button.

MBAM will now automatically start and you will see a message stating that
you should update the program before performing a scan. As MBAM will automatically
update itself after the install, you can press the OK button
to close that box and you will now be at the main program as shown below.

On the Scanner tab, make sure the the Perform
quick scan option is selected and then click on the Scan
button to start scanning your computer for XPCleaner related
files.

MBAM will now start scanning your computer for malware. This process can
take quite a while, so we suggest you go and do something else and periodically
check on the status of the scan. When MBAM is scanning it will look like the
image below.

When the scan is finished a message box will appear as shown in the image
below.

You should click on the OK button to close the message box and continue with
the XPCleaner removal process.

You will now be back at the main Scanner screen. At this point you should
click on the Show Results button.

A screen displaying all the malware that the program found will be shown
as seen in the image below.

You should now click on the Remove Selected button to remove
all the listed malware. MBAM will now delete all of the files and registry
keys and add them to the programs quarantine.

When MBAM has finished removing the malware, it will open the scan log and
display it in Notepad. Review the log as desired, and then close the Notepad
window.

You can now exit the MBAM program.

Your computer should now be free of the XPCleaner
program. If your current anti-virus solution let this infection through, you may
want to consider purchasing
the PRO version of Malwarebytes' Anti-Malware to protect against these types of threats in the future.

If you are still having problems with your computer after completing these instructions,
then please follow the steps outlined in the topic linked below:

Preparation
Guide For Use Before Posting A Hijackthis Log

This is a self-help guide. Use at your own risk.

BleepingComputer.com can not be held responsible for problems that may occur
by using this information. If you would like help with any of these fixes, you
can post a HijackThis log in our HijackThis
Logs and Analysis forum.

If you have any questions about this self-help guide then please post those questions
in our AntiVirus,
Firewall and Privacy Products and Protection Methods forum and someone will help you.

How To Remove Spyburner (removal Instructions)

Wed, 31 Dec 1969 19:00:00 EST

How to remove SpyBurner (Removal Instructions)

What this programs does:

SpyBurner is a program classified as a rogue anti-spyware
program. Rogue anti-spyware programs are ones that are installed or advertised via malware, use deceptive advertising, or use false positives in the scan results to convince a user to purchase the commercial version of the software. These programs also typically will not allow you to remove anything it finds without first paying to register the program. SpyBurner is classified as one of these programs as it is advertised through the use of malware and Trojans that display fake security alerts on your Windows taskbar.

A screenshot of SpyBurner can be found below.

SpyBurner Screenshot

This guide will walk you through removing the SpyBurner program and malware that may typically be installed with it.

Tools Needed for this fix:

Malwarebytes'
Anti-Malware

Symptoms in a HijackThis Log:

O4 - HKLM\..\Run: [SpyBurner] "C:\Program Files\SpyBurner\SpyBurner.exe"

O4 - HKLM\..\Run: [SMSERIALWORKSTARTER] "C:\WINDOWS\comsysobj.exe"

O4 - HKLM\..\Run: [SMSERIALWORKERSTART] "C:\WINDOWS\shellexcon.exe"

O4 - HKLM\..\Run: [SMSERIALSTARTER] "C:\WINDOWS\win32st.exe"

O4 - HKLM\..\Run: [SMSERIALWORKERSTARTER] "C:\WINDOWS\winstrse.exe"

Add/Remove Programs control panel entry:

SpyBurner 1.2.25

Guide Updates:

02/16/08 - Initial guide creation.

Automated Removal Instructions
for SpyBurner:

Print out these instructions as we will need to close every window that
is open later in the fix.

Download Malwarebytes' Anti-Malware, or MBAM, from the following location
and save it to your desktop:

Malwarebytes'
Anti-Malware Download Link

Once downloaded, close all programs and Windows on your computer, including
this one.

Double-click on the icon on your desktop named Download_mbam-setup.exe.
This will start the installation of MBAM onto your computer.

When the installation begins, keep following the prompts in order to continue
with the installation process. Do not make any changes to default settings
and when the program has finished installing, make sure you leave both the
Update Malwarebytes' Anti-Malware and Launch
Malwarebytes' Anti-Malware checked. Then click on the Finish
button.

MBAM will now automatically start and you will see a message stating that
you should update the program before performing a scan. As MBAM will automatically
update itself after the install, you can press the OK button
to close that box and you will now be at the main program as shown below.

On the Scanner tab, make sure the the Perform
quick scan option is selected and then click on the Scan
button to start scanning your computer for SpyBurner related
files.

MBAM will now start scanning your computer for malware. This process can
take quite a while, so we suggest you go and do something else and periodically
check on the status of the scan. When MBAM is scanning it will look like the
image below.

When the scan is finished a message box will appear as shown in the image
below.

You should click on the OK button to close the message box and continue with
the SpyBurner removal process.

You will now be back at the main Scanner screen. At this point you should
click on the Show Results button.

A screen displaying all the malware that the program found will be shown
as seen in the image below. Please note that the results shown in the image
below will be different depending on the infection you are removing.

You should now click on the Remove Selected button to remove
all the listed malware. MBAM will now delete all of the files and registry
keys and add them to the programs quarantine.

When MBAM has finished removing the malware, it will open the scan log and
display it in Notepad. Review the log as desired, and then close the Notepad
window.

You can now exit the MBAM program.

Your computer should now be free of the SpyBurner
program. If your current anti-virus solution let this infection through, you may
want to consider purchasing
the PRO version of Malwarebytes' Anti-Malware to protect against these types of threats in the future.

If you are still having problems with your computer after completing these instructions,
then please follow the steps outlined in the topic linked below:

Preparation
Guide For Use Before Posting A Hijackthis Log

This is a self-help guide. Use at your own risk.

How To Use Sdfix

Wed, 31 Dec 1969 19:00:00 EST

How to use SDFix

Credits: AndyManchesta for SDFix

What this program does:

SDFix is a program written by AndyManchesta that can remove many different types of Trojans and Worms. You have most likely reached this page when researching a program in our Startup Database and it directed you here to learn how to remove it. If you follow the instructions below, SDFix will remove the known Trojans and Worms found on your computer. For a complete list of Trojans and Worms that SDFix knows how to remove you should read the SDFix Changelog. It is important to note that you must be logged in as an Administrator and in safe mode in order for SDFix to work properly.

Common problems/messages and how to fix them:

Error Message:

The command prompt has been disabled by your administrator.

Press any key to continue . . .

How to fix:

Click on the Start menu, then Run, and then copy and paste the following line into the Run field:

%systemdrive%\SDFix\apps\swreg IMPORT %systemdrive%\SDFix\apps\Enable_Command_Prompt.reg

Press OK then run SDFix again

Problem:

If the Command Prompt window flashes on then off again on XP or Windows 2000

How to fix:

Click on the Start menu, then Run, and then copy and paste the following line into the Run field:

%systemroot%\system32\cmd.exe /K %systemdrive%\SDFix\apps\FixPath.exe

Then click OK, then type Y and press Enter when prompted, Reboot and start SDFix again

Problem:

If SDFix still doesn't run check the %comspec% variable

How to fix:

Click on the Start button then right-click on My Computer and select properties. Then click on the Advanced tab and then click on the Environment Variables. Under System Variables, make sure that the ComSpec variable points to %SystemRoot%\system32\cmd.exe

Problem:

Need to restore your registry after running SDFix

How to fix:

SDFix uses ERUNT to create a registry backup. This backup can be restored by clicking on Start, then Run and typing:

%SystemRoot%\ERUNT\SDFix\ERDNT.EXE

Then press the OK button.

Tools needed for this fix:

SDFix

Revision History:

02/15/08 - Created the guide

SDFix Instructions:

Please print these instructions as they will be needed later when Internet
access is not available.

Logon to your computer with an account that has Administrator privileges.

Download SDFix.exe from the following link and save it to your desktop:

SDFix
Download Link

Confirm that the file SDFix.exe now resides on your
desktop, but do not double-click on the icon as of yet. We will use it in
later steps. The icon will look like the one below:

Now, double-click on the SDFix icon that should now be residing on your
desktop. If a Open File - Security Warning box opens, click
on the Run button.

A window will now open showing SDFix being extracted into the C:\SDFix folder.
Once the installation program has finished extracting SDFix, it will open
a Notepad with further instructions as shown below.

Next, please reboot your computer into Safe
Mode by doing the following:
1. Restart your computer
2. After hearing your computer beep once during startup, but before the
  Windows icon appears, press F8.
3. Instead of Windows loading as normal, a menu should appear
4. Select the first option, to run Windows in Safe
  Mode.
5. When you are at the logon prompt, log in as the same user that you had
  performed the previous steps as.

When your computer has started in safe mode,
and you see the desktop, close all open Windows.

Click on the Start button, click on the Run
menu option, and type the following into the Open: field:

C:\SDFix\RunThis.bat

Then press the OK button.

The SDFix window will open, as shown below, containing some brief info and
a disclaimer on the use of the tool.

If you want to continue, please press the Y key on your keyboard
and then press enter. Otherwise, you can press the N key
to exit the program.

SDFix will now start scanning your computer for known infections as seen
in the image below.

This process can take a while, so you may want to do something else and periodically
check back on the status of SDFix. As the scanning process continues you will
continue to see new messages on the screen as shown in the figure below.

When the scanning process has finished you will see a new screen stating
that you need to restart your computer in order to continue.

At this point you should press any key on your computer's keyboard in order
to restart the computer.

After your computer reboots SDFix will automatically start and perform a
last check.

You will now be presented with a screen stating that SDFix has finished.

At this point you should press any key on your computer's keyboard in order
to continue to your desktop.

When you are back at your Windows desktop, the SDFix log will automatically
be opened in notepad.

Review the log as necessary to see what was removed and then close the Notepad
window.

Now that SDFix has finished running, any Worms or Trojans that it knows how to remove should have been deleted from your computer.

If after attempting these instructions you still have an infection,
then it is advised that you post your HijackThis log so one of our experts can
help you remove it. Instructions on how
to post a HijackThis log can be found here:

Preparation
Guide For Use Before Posting A Hijackthis Log

This is a self-help guide. Use at your own risk.

BleepingComputer.com can not be held responsible for problems that may occur
by using this information. If you would like help with any of these fixes, you
can post a HijackThis log in our HijackThis
Logs and Analysis forum.

If you have any questions about this self-help guide then please post those
questions in our AntiVirus,
Firewall and Privacy Products and Protection Methods forum and someone
will help you.

How To Remove Systemdefender (removal Instructions)

Wed, 31 Dec 1969 19:00:00 EST

How to remove SystemDefender (Removal Instructions)

What this programs does:

SystemDefender is a rogue security
program that is advertised and installed by the Vundo Trojan and other malware. The Vundo infection is typically installed by visiting or downloading executables from certain crack or pornographic web sites. Once these infections are installed, the computer will be bombarded with popups and fake security alerts stating that you are infected or have security risks. If you click on these popups you will then be presented with variety of rogue anti-spyware programs, including SystemDefender, which state that you are infected and that you should install their products. Remember, that these are all scams and ads delivered by the infections and should be ignored.

When infected you will also see an alert icon, which looks like the following , in your Windows taskbar. This icon will periodically display fake security alerts and warnings. The title of the first alert is Windows antivirus and contains the following text, including their misspellings:

Windows has detected spyware infection!

It is recomended to use special antispyware tools to prevent data loss. Windows will now download and install the most up-to-date antispyware for you

Click here to protect your computer from spyware!

and title of the second alert is Windows Security Alert and contains the following text, including their misspellings:

Warning! Potential Spyware Operation!

Your computer is making unauthorized copies of your system and Internet files. Run full scan now to prevent any unathorised access to your files! Click here to download spyware remover ...

A screenshot of SystemDefender and the fake security alerts can be found below.

SystemDefender Screenshot

SystemDefender Fake Taskbar Security Alerts #1

SystemDefender Fake Taskbar Security Alerts #2

This guide will walk you through removing the SystemDefender program and malware that may typically be installed with it.

Tools Needed for this fix:

Malwarebytes' Anti-Malware Download

Symptoms in a HijackThis Log:

O4 - HKLM\..\Run: [SystemDefender] "C:\Program Files\SystemDefender\SystemDefender.exe" hide

Add/Remove Programs control panel entry:

SystemDefender

Guide Updates:

02/15/08 - Initial guide creation.

Automated Removal Instructions
for SystemDefender:

Print out these instructions as we will need to close every window that
is open later in the fix.

Download Malwarebytes' Anti-Malware, or MBAM, from the following location
and save it to your desktop:

Malwarebytes'
Anti-Malware Download Link

Once downloaded, close all programs and Windows on your computer, including
this one.

Double-click on the icon on your desktop named Download_mbam-setup.exe.
This will start the installation of MBAM onto your computer.

When the installation begins, keep following the prompts in order to continue
with the installation process. Do not make any changes to default settings
and when the program has finished installing, make sure you leave both the
Update Malwarebytes' Anti-Malware and Launch
Malwarebytes' Anti-Malware checked. Then click on the Finish
button.

MBAM will now automatically start and you will see a message stating that
you should update the program before performing a scan. As MBAM will automatically
update itself after the install, you can press the OK button
to close that box and you will now be at the main program as shown below.

On the Scanner tab, make sure the the Perform
quick scan option is selected and then click on the Scan
button to start scanning your computer for SystemDefender
related files.

MBAM will now start scanning your computer for malware. This process can
take quite a while, so we suggest you go and do something else and periodically
check on the status of the scan. When MBAM is scanning it will look like the
image below.

When the scan is finished a message box will appear as shown in the image
below.

You should click on the OK button to close the message box and continue with
the SystemDefender removal process.

You will now be back at the main Scanner screen. At this point you should
click on the Show Results button.

A screen displaying all the malware that the program found will be shown
as seen in the image below. Please note that the results shown in the image
below will be different depending on the infection you are removing.

You should now click on the Remove Selected button to remove
all the listed malware. MBAM will now delete all of the files and registry
keys and add them to the programs quarantine.

When MBAM has finished removing the malware, it will open the scan log and
display it in Notepad. Review the log as desired, and then close the Notepad
window.

You can now exit the MBAM program.

Your computer should now be free of the SystemDefender
program. If your current anti-virus solution let this infection through, you may
want to consider purchasing
the PRO version of Malwarebytes' Anti-Malware for it's real-time protection.

If you are still having problems with your computer after completing these instructions,
then please follow the steps outlined in the topic linked below:

Preparation
Guide For Use Before Posting A Hijackthis Log

This is a self-help guide. Use at your own risk.

How To Remove Winreanimator (removal Instructions)

Wed, 31 Dec 1969 19:00:00 EST

How to remove WinReanimator (Removal Instructions)

What this programs does:

WinReanimator is a rogue security
program that is advertised and installed by the Vundo Trojan and other malware. The Vundo infection is typically installed by visiting or downloading executables from certain pornographic or crack sites. Once installed, the infections will bombard the infected computer with popups and fake security alerts stating that your computer is infected or has security risks. When you click on these popups you will be presented with variety of rogue anti-spyware programs, including WinReanimator, stating that you are infected and that you should install their products. Remember, that these are all scams and ads delivered by the infections and should be ignored.

Another byproduct of these infections is an alert icon () that appears in your Windows taskbar that periodically displays fake security alerts and warnings. The title of these alerts are Windows antivirus and they contain the following text:

Windows has detected spyware infection!

It is recomended to use special antispyware tools to prevent data loss. Windows will now download and install the most up-to-date antispyware for you

Click here to protect your computer from spyware!

A screenshot of WinReanimator and the fake security alerts can be found below.

WinReanimator Screenshot

WinReanimator Fake Taskbar Security Alerts

This guide will walk you through removing the WinReanimator program and malware that may typically be installed with it.

Tools Needed for this fix:

Malwarebytes' Anti-Malware download

Symptoms in a HijackThis Log:

O4 - HKLM\..\Run: [WinReanimator] "C:\Program Files\WinReanimator\WinReanimator.exe" /hide

Add/Remove Programs control panel entry:

This program does not include an entry in Add or Remove Programs.

Guide Updates:

02/15/08 - Initial guide creation.

Automated Removal Instructions
for WinReanimator:

Print out these instructions as we will need to close every window that
is open later in the fix.

Download Malwarebytes' Anti-Malware, or MBAM, from the following location
and save it to your desktop:

Malwarebytes'
Anti-Malware Download Link

Once downloaded, close all programs and Windows on your computer, including
this one.

Double-click on the icon on your desktop named Download_mbam-setup.exe.
This will start the installation of MBAM onto your computer.

When the installation begins, keep following the prompts in order to continue
with the installation process. Do not make any changes to default settings
and when the program has finished installing, make sure you leave both the
Update Malwarebytes' Anti-Malware and Launch
Malwarebytes' Anti-Malware checked. Then click on the Finish
button.

MBAM will now automatically start and you will see a message stating that
you should update the program before performing a scan. As MBAM will automatically
update itself after the install, you can press the OK button
to close that box and you will now be at the main program as shown below.

On the Scanner tab, make sure the the Perform
quick scan option is selected and then click on the Scan
button to start scanning your computer for WinReanimator
related files.

MBAM will now start scanning your computer for malware. This process can
take quite a while, so we suggest you go and do something else and periodically
check on the status of the scan. When MBAM is scanning it will look like the
image below.

When the scan is finished a message box will appear as shown in the image
below.

You should click on the OK button to close the message box and continue with
the WinReanimator removal process.

You will now be back at the main Scanner screen. At this point you should
click on the Show Results button.

A screen displaying all the malware that the program found will be shown
as seen in the image below. Please note that the results shown in the image
below will be different depending on the infection you are removing.

You should now click on the Remove Selected button to remove
all the listed malware. MBAM will now delete all of the files and registry
keys and add them to the programs quarantine.

When MBAM has finished removing the malware, it will open the scan log and
display it in Notepad. Review the log as desired, and then close the Notepad
window.

You can now exit the MBAM program.

Your computer should now be free of the WinReanimator
program. If your current anti-virus solution let this infection through, you may
want to consider purchasing
the PRO version of Malwarebytes' Anti-Malware to prevent these types of infections in the future.

If you are still having problems with your computer after completing these instructions,
then please follow the steps outlined in the topic linked below:

Preparation
Guide For Use Before Posting A Hijackthis Log

This is a self-help guide. Use at your own risk.

How To Remove Antispykit (removal Instructions)

Wed, 31 Dec 1969 19:00:00 EST

How to remove AntiSpyKit (Removal Instructions)

What this programs does:

AntiSpyKit is a rogue
anti-spyware program that with the use of aggressive advertising and false
scan results tries to scare you into purchasing the commercial version. When AntiSpyKit
is first run it will scan your computer and detect a variety of infections on
your computer. The only way to remove these infections, though, is to first purchase
the program. In reality these supposed infections are either non-existent or legitimate
Windows entries and are only being detected in order to scare you into purchasing
the software, which you should not do.

A screen shot of AntiSpyKit can be found below.

AntiSpyKit Screen shot

This guide will walk you through removing the AntiSpyKit program and malware that may typically be installed with it.

Tools Needed for this fix:

Malwarebytes'
Anti-Malware Download

Symptoms in a HijackThis Log:

O4 - HKLM\..\Run: [AntiSpyKit 5.2] "C:\Program Files\AntiSpyKit 5.2\AntiSpyKit
5.2.exe" /h

O4 - HKLM\..\Run: [AntiSpyKit 5.3] "C:\Program Files\AntiSpyKit 5.3\AntiSpyKit 5.3.exe" /h

Add/Remove Programs control panel entry:

AntiSpyKit
5.2

Guide Updates:

02/14/08 - Initial guide creation.

Automated Removal Instructions
for AntiSpyKit:

Print out these instructions as we will need to close every window that
is open later in the fix.

Download Malwarebytes' Anti-Malware, or MBAM, from the following location
and save it to your desktop:

Malwarebytes'
Anti-Malware Download Link

Once downloaded, close all programs and Windows on your computer, including
this one.

Double-click on the icon on your desktop named Download_mbam-setup.exe.
This will start the installation of MBAM onto your computer.

When the installation begins, keep following the prompts in order to continue
with the installation process. Do not make any changes to default settings
and when the program has finished installing, make sure you leave both the
Update Malwarebytes' Anti-Malware and Launch
Malwarebytes' Anti-Malware checked. Then click on the Finish
button.

MBAM will now automatically start and you will see a message stating that
you should update the program before performing a scan. As MBAM will automatically
update itself after the install, you can press the OK button
to close that box and you will now be at the main program as shown below.

On the Scanner tab, make sure the the Perform
quick scan option is selected and then click on the Scan
button to start scanning your computer for AntiSpyKit related
files.

MBAM will now start scanning your computer for malware. This process can
take quite a while, so we suggest you go and do something else and periodically
check on the status of the scan. When MBAM is scanning it will look like the
image below.

When the scan is finished a message box will appear as shown in the image
below.

You should click on the OK button to close the message box and continue with
the AntiSpyKit removal process.

You will now be back at the main Scanner screen. At this point you should
click on the Show Results button.

A screen displaying all the malware that the program found will be shown
as seen in the image below. Please note that the results shown in the image
below will be different depending on the infection you are removing.

You should now click on the Remove Selected button to remove
all the listed malware. MBAM will now delete all of the files and registry
keys and add them to the programs quarantine.

When MBAM has finished removing the malware, it will open the scan log and
display it in Notepad. Review the log as desired, and then close the Notepad
window.

You can now exit the MBAM program.

Your computer should now be free of the AntiSpyKit
program. If your current anti-virus solution let this infection through, you may
want to consider purchasing
the PRO version of Malwarebytes' Anti-Malware for additional protection.

If you are still having problems with your computer after completing these instructions,
then please follow the steps outlined in the topic linked below:

Preparation
Guide For Use Before Posting A Hijackthis Log

This is a self-help guide. Use at your own risk.