Remove NetworkControl (Uninstall Guide)

  • August 4, 2010

NetworkControl is a Trojan that ransoms the proper operation of your computer until you purchase one of their recommended programs. This ransomware is not an actual rogue as it does not install a fake anti-virus program on your computer. Instead this Trojan pretends to be a Firewall, but in reality is just a series of nag screens that block certain computer functions. This Trojan is installed on your computer through two methods. The first method is through fake online anti-malware scanners that state that your computer is infected with a variety of infections. It will then prompt you to download and install a program to protect yourself. The reality is that these online anti-malware scanners are just an advertisement and have absolutely no way of knowing what is running on your computer. The second method is through sites that utilize exploits to automatically install NetworkControl onto your computer without your permission or knowledge.

Regardless of how NetworkControl is installed on your computer, once installed it will create the C:\NetworkControl folder and stores its files there. Then it will configure NC.exe to launch automatically when Windows starts. Once this program is started you will see constant nag alerts stating that someone named Adam1 is making modifications to your computer and asking if you wish to Block or Allow these modifications from hapenning.

  • Fake System Restore alert
  • Fake online anti-malware scanner
  • Fake security warning
  • Remote application blocked alert
  • Fake Remote logon request alert
  • Fake Remote query alert
  • Fake Remote software install alert
  • Unable to find firewall alert
  • NetworkControl Solution Center

While NetworkControl is running it will display a message and terminate programs that you attempt to run. It does this to protect itself from being removed as well as to make your computer unusable. The text of the alert you will see when a program is terminated is:

System Notification
Running applications blocked by the administrator Adam1.

Network Control will also display a constant stream of nag screens that attempt to make you think that an Administrator on your computer named Adam1 is making modifications to Windows. The text of some of these alerts are:

System Restore
Critical System Notification
Remote administrator Adam1 has changed some system files of Windows OS.
Checking will take several minutes.
Please do not turn off the computer - it can lead to system crash.

Remote login request
Don't allow access unless you clearly understand what you are doing.
Your computer received a remote login request by user: "Adam1" from the IP <ip address>.
Deny or Allow

Remote query of terminating application
Don't allow access unless you clearly understand what you are doing.
Your computer has received a remote query from IP <ip address> of terminating application.
Allow access or Deny Access

Remote software installation
Don't allow access unless you clearly understand what you are doing.
Your computer has received a request from the IP <ip address> to install Zeus software.
Block Installation or Allow installation

Unable to find installed software
System was unable to find installed firewall software.

When you acknowledge these alerts it will state that there is no firewall software on your computer and then open a Solution Center where they attempt to have you purchase a program. The programs listed in this Solution Center are Advanced Net Firewall, Shield EC, Personal Network Protect, IP Blockator, and Network Defender. It is unsure if any of these programs are actually real, but it is a fact that all of the alerts are fake and should be ignored.

As you can see, NetworkControl was created solely to make your computer unusable so that you will then be scared into purchasing one of the programs it is trying to sell. You should definitely not purchase any of the programs it promotes, and if you have, you should contact your credit card company and dispute the charges stating that the program is a virus and a scam. To remove NetworkControl and any related malware, please follow the steps in the removal guide below.

Self Help Guide

This guide contains advanced information, but has been written in such a way so that anyone can follow it. Please ensure your data is backed up before proceeding.

If you are uncomfortable making changes to your computer or following these steps, do not worry! Instead you can get free one-on-one help by asking in the forums.
  1. Print out these instructions as we may need to close every window that is open later in the fix.

  2. It is possible that the infection you are trying to remove will not allow you to download files on the infected computer. If this is the case, then you will need to download the files requested in this guide on another computer and then transfer them to the infected computer. You can transfer the files via a CD/DVD, external drive, or USB flash drive.

  3. Before we can do anything we must first end the processes that belong to NetworkControl so that it does not interfere with the cleaning procedure. To do this, please download RKill to your desktop from the following link.

    RKill Download Link - (Download page will open in a new tab or browser window.)

    When at the download page, click on the Download Now button labeled iExplore.exe download link. When you are prompted where to save it, please save it on your desktop.

  4. Once it is downloaded, double-click on the iExplore.exe icon in order to automatically attempt to stop any processes associated with NetworkControl and other Rogue programs. Please be patient while the program looks for various malware programs and ends them. When it has finished, the black window will automatically close and you can continue with the next step. If you get a message that RKill is an infection, do not be concerned. This message is just a fake warning given by NetworkControl when it terminates programs that may potentially remove it. If you run into these infections warnings that close RKill, a trick is to leave the warning on the screen and then run RKill again. By not closing the warning, this typically will allow you to bypass the malware trying to protect itself so that rkill can terminate NetworkControl . So, please try running RKill until the malware is no longer running. You will then be able to proceed with the rest of the guide. If you continue having problems running RKill, you can download the other renamed versions of RKill from the rkill download page. All of the files are renamed copies of RKill, which you can try instead. Please note that the download page will open in a new browser window or tab.

    Do not reboot your computer after running RKill as the malware programs will start again.


  5. At this point you should download Malwarebytes Anti-Malware, or MBAM, to scan your computer for any any infections or adware that may be present. Please download Malwarebytes from the following location and save it to your desktop:

    Malwarebytes Anti-Malware Download Link (Download page will open in a new window)

  6. Once downloaded, close all programs and Windows on your computer, including this one.

  7. Double-click on the icon on your desktop named mb3-setup-1878.1878-3.0.6.1469.exe. This will start the installation of MBAM onto your computer.

  8. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure you leave Launch Malwarebytes Anti-Malware checked. Then click on the Finish button. If MalwareBytes prompts you to reboot, please do not do so.

  9. MBAM will now start and you will be at the main screen as shown below.



    Malwarebytes Anti-Malware


    Please click on the Scan Now button to start the scan. If there is an update available for Malwarebytes it will automatically download and install it before performing the scan.

  10. MBAM will now start scanning your computer for malware. This process can take quite a while, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.



    Malwarebytes Anti-Malware


  11. When MBAM is finished scanning it will display a screen that displays any malware that it has detected. Please note that the infections found may be different than what is shown in the image below due to the guide being updated for newer versions of MBAM.


    MalwareBytes Scan Results


    You should now click on the Remove Selected button to remove all the seleted malware. MBAM will now delete all of the files and registry keys and add them to the programs quarantine. When removing the files, MBAM may require a reboot in order to remove some of them. If it displays a message stating that it needs to reboot, please allow it to do so. Once your computer has rebooted, and you are logged in, please continue with the rest of the steps.

  12. You can now exit the MBAM program.

  13. As many rogues and other malware are installed through vulnerabilities found in out-dated and insecure programs, it is strongly suggested that you use Secunia PSI to scan for vulnerable programs on your computer. A tutorial on how to use Secunia PSI to scan for vulnerable programs can be found here:

    How to detect vulnerable and out-dated programs using Secunia Personal Software Inspector

 

Your computer should now be free of the Network Control program. If your current anti-virus solution let this infection through, you may want to consider purchasing the PRO version of Malwarebytes Anti-Malware to protect against these types of threats in the future.

View Associated NetworkControl Files

c:\NetworkControl\ c:\NetworkControl\checker.exe c:\NetworkControl\list c:\NetworkControl\nc.exe c:\NetworkControl\tmp.dll c:\NetworkControl\tpm.dll c:\WINDOWS\Fonts\segoeui.ttf %UserProfile%\Local Settings\Temp\abc %UserProfile%\Local Settings\Temp\i.bat

File Location Notes:

%UserProfile% refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> for Windows 2000/XP, C:\Users\<Current User> for Windows Vista/7/8, and c:\winnt\profiles\<Current User> for Windows NT.

View Associated NetworkControl Registry Information

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnonBadCertRecving" = "0" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnPostRedirect" = "0" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "NetworkControl"

This is a self-help guide. Use at your own risk.

BleepingComputer.com can not be held responsible for problems that may occur by using this information. If you would like help with any of these fixes, you can ask for malware removal assistance in our Virus,Trojan,Spyware, and Malware Removal Logs forum.

If you have any questions about this self-help guide then please post those questions in our Am I infected? What do I do? and someone will help you.

search guides

Login

Remember Me
Sign in anonymously