Winspyware protect removal tool

[ironman99011]

 Unfortunately, my computer is infected with winspyware protect and has been getting worse for two days. I run McAfee and it does not find it nor did it prevent the infection.
 I am not savy enough to manually remove the infection, therefore my question is: is there a tool that is trustworthy and novice user friendly as shareware or purchase that I can download to rid my system of this pest.

 Thanks

[Carbon Dudeoxide]

If you mean Antivirus when you said 'tool', there is Avira and AVG Free.

As for removal, I would look here.
http://www.computerhope.com/forum/index.php/topic,46313.0.html
If you post the three logs there, one of our Malware Specialists will help give you a clean bill of health. 

[Google]

Unfortunately, my computer is infected with winspyware protect and has been getting worse for two days. I run McAfee and it does not find it nor did it prevent the infection.
 I am not savy enough to manually remove the infection, therefore my question is: is there a tool that is trustworthy and novice user friendly as shareware or purchase that I can download to rid my system of this pest.

 Thanks

Me and evilfantasy have been working on my computer that ha the exect same problem. Ask him....or look at my thread...
http://www.computerhope.com/forum/index.php/topic,62412.60.html

[Carbon Dudeoxide]

Ask him....or look at my thread...

Following another topic in the Computer Virus and Spyware Section can be very dangerous because, although the problem may seem the same, it could in fact be very different.

[ironman99011]

 Thanks, I am at work now, I will read further when I get home tonight and see if I can generate the proper information.

[Google]

Use malwarebytes scanner and scan your full computer the fix everything. That solved most of the problem. evilfantasy is just helping me clear my pc of everything else supicious as well as that stupid annoying virus...

http://www.computerhope.com/forum/index.php/topic,46313.0.html

(scroll down to step four)

[ironman99011]

 1 last question before I get home and start. Do you recommend that I run a scan of my system again with McAfee before I proceed any further. Just trying to clarify this one point........

  Thanks

[evilfantasy]

If you have already ran a scan then you don't need to run another. Just use the tools in the removal steps and post the logs.

[ironman99011]

 Thanks very much, I will proceed with the instructions when I get home then.

[ironman99011]

evilfantasy, I have not yet had the time to work on my computer, I very much appreciate the help and the instructions. I will run the tools and post the logs for review and advise as soon as possible.

[ironman99011]

 Here is my 1st log from SUPERAntiSpyware, I am about to continue on with the MBAM stage.
 Hope this helps you with my issues.

 Thanks

[recovering disk space -- attachment deleted by admin]

[ironman99011]

 Results of MBAM scan...

[recovering disk space -- attachment deleted by admin]

[ironman99011]

Final log file from Hijack This, waiting on review and any further directions.

[recovering disk space -- attachment deleted by admin]

[ironman99011]

attached are the log files generated per the malware removal instructions. I posted them in another thread, although each was on a different post. I was not sure if it would be easier to review with all 3 together.
 I am awaiting review and any additional instruction or advise.
 
 Additionally, here are 3 programs listed on add/remove programs I am not familiar with and need advise on possible removal: iWin Games; Otto and Urge.

 Thank you very much

[recovering disk space -- attachment deleted by admin]

[ironman99011]

 One additional question if I may. Is there a possible conflict between the SUPERAntiSpyware program and McAfee if both are still installed, if so, what is the proper method to resolve the issue.

 Again, thanks very much. It is amazing what is done through the help given here.

[evilfantasy]

Open HijackThis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

O4 - HKCU\..\Run: [s9201] "C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\wspwprtct.exe" /autorun
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

Important: Close all open windows except for HijackThis and then click Fix checked.

Once completed, exit HijackThis.

----------

Now download The Avenger by Swandog46 and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your Desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
  
• Copy everything in the Code box below, and paste it into the Input script here window:

Code: [Select]

Comment:

Files to delete:
C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\wspwprtct.exe
Folders to delete:
C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect

Note: the above instructions were created specifically for this user. If you are not this user, DO NOT follow these directions as they could damage the workings of your system

• Now click the Execute button.
  
• Click Yes to the prompt to confirm you want to execute.
  
• Click Yes to the "Reboot now?" question that will appear when Avenger finishes running.
  
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will pop-up for you to view when you login after reboot.

.

• Add the Avenger log in your next post.

----------
You have Viewpoint installed.

Viewpoint Media Player/Manager/Toolbar is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad".

More information:

• ViewMgr.exe - Useless
  
• Viewpoint To Track Browsing, Serve Ads
  
• Viewpoint to Plunge Into Adware

It is suggested to remove the program now.
Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following programs if present.

• Viewpoint
  
• Viewpoint Manager
  
• Viewpoint Media Player
  
• Viewpoint Toolbar
  
• Viewpoint Experience Technology

.
----------

Do you know why iWinGamesInstaller is running as a service?

How is everything now?

[evilfantasy]

SUPERAntiSpyware program and McAfee will not conflict at all.

I'm merging this topic with the other one.

[ironman99011]

 The Avenger log is attached. I do not know why iWinGamesInstaller is running as a service, as far as I am concerned we can get rid of it.
 I am having a few new problems though, we (wife and I) cannot sign on to other sites that require a login and password ie; Yahoo mail account, online banking ect. I am getting a message that states "The browser you are using refuses to sign in (cookies rejected). The settings in the tools on IE - internet options - privacy are at medium where they were before.
 Additionally, when I reboot I am getting several application errors, do not know the significance but I will list:
qttask.exe
sprtcmd.exe
Reader_sl.exe
SSUPDATE.EXE
 All these errors state the same message - instruction at "0.00000000" referenced at memory "0.00000000". The memory could not be read.

 My system as a whole appears to be running much faster though. When I began the operations I had to restart several times just to connect to the internet. If you can help me resolve these last few issues it will be greatly appreciated.

[recovering disk space -- attachment deleted by admin]

[ironman99011]

 Please delete the posts in the other threads. I had an afterthought this am when I woke up about not being complete with the removal and a very possible connection.
 I will follow this thread only and will be as patient as it takes, thank you both for reminding me.

 

[ironman99011]

 Sorry, forgot to add to post. When I ran HijackThis, the 2 entries listed in relation to WinSpywareProtect and Viewpoint Manager were present. I checked them and then clicked FIx Checked.
 In add/remove programs I found Viewpoint Manager and Viewpoint Media Player and removed them.

[evilfantasy]

Download ATF Cleaner by Atribune to your Desktop.

Alternate download link

Note: Vista users must use Run As Administrator

• Under Main: Select Files to Delete choose: Select All.
  
• Click the Empty Selected button.
  
• If you use Firefox browser click Firefox at the top and choose: Select All
  
• Click the Empty Selected button.
  If you would like to keep your saved passwords click No at the prompt.
  
• If you use Opera browser click Opera at the top and choose: Select All
  
• Click the Empty Selected button.
  If you would like to keep your saved passwords click No at the prompt.
  
• Click Exit on the Main menu to close the program.

.
Important: Restart the computer before continuing.

Note that your system will run slower for a reboot or two after having used this tool so don't panic.

----------

Download Deckard's System Scanner (DSS) to your Desktop.
Note: You must be logged onto an account with administrator privileges.
Vista users Right click DSS and Run as Administrator.

• Close all applications and windows.
  
• Double-click on dss.exe to run it, and follow the prompts.
  
• When the scan is complete, two text files will open.
• main.txt <- this one will be maximized
  
• extra.txt <- this one will be minimized
• Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and extra.txt in your reply.

[ironman99011]

 Log files of Deckard's System Scanner attached, waiting for further instructions.

[recovering disk space -- attachment deleted by admin]

[evilfantasy]

Go to Add or Remove Programs and uninstall:

- iWin Games (remove only)
- WildTangent Web Driver

----------

Open HijackThis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

Important: Close all open windows except for HijackThis and then click Fix checked.

Once completed, exit HijackThis and restart the computer.

----------

• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
  
• Copy everything in the Code box below, and paste it into the Input script here window:

Code: [Select]

Comment:

Files to delete:
C:\WINDOWS\system32\byromj.dll


Note: the above instructions were created specifically for this user. If you are not this user, DO NOT follow these directions as they could damage the workings of your system

• Now click the Execute button.
  
• Click Yes to the prompt to confirm you want to execute.
  
• Click Yes to the "Reboot now?" question that will appear when Avenger finishes running.
  
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will pop-up for you to view when you login after reboot.

.

• Add the Avenger log in your next post.

----------

Update your Mozilla Firefox Browser
Recently there have been vulnerabilities detected in older versions of Mozilla Firefox.
It is strongly suggested that you update to the current version.
Mozilla Firefox 2.0.0.16
You can update it by clicking Help > Check for updates...

----------

Run CCleaner.

----------

Run the Kaspersky Online Scanner

In Microsoft Windows Vista, you must open the Web browser using the Run as Administrator command. From the Desktop right click the icon and choose Run as Administrator.

• Click on SCAN NOW
  
• Click Accept.
  
• The program will then begin downloading the latest definition files.
• Once the files have been downloaded locate the Scan Settings and have it scan My Computer.
  
• The scan will take a while, so be patient and let it finish.

When the scan is done, in the Scan is complete window, any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.

To obtain the report:
Click on: Save Report As

• Next, in the Save as prompt, Save in area, select: Desktop.
  
• In the File name area use KScan, or something similar.
  
• In Save as type: click the drop arrow and select: Text file [*.txt]
  
• Then, click: Save

Copy and paste the Kaspersky Online Scanner Report in your next reply.

----------

Let me know how everything is now.

[ironman99011]

Latest Avenger logfile attached, setting up to run the Kaspersky Online Scanner now.

[recovering disk space -- attachment deleted by admin]

[ironman99011]

 Disclaimer on Kaspersky site states to turn off any antivirus program installed in order for the scan to run successfully. I have McAfee Security Center running and do not know how to turn iy off, no exit program option available in the window...
 Should I run the online scan as is ?

[evilfantasy]

Navigate to the system tray on the bottom right hand corner and look for the M sign.

    * right-click it -> chose "Exit."
    * a popup will warn that protection will now be disabled. Click on "Yes" to disable the Antivirus guard.

You succesfully disabled the McAfee Guard.

[ironman99011]

 No Exit option available, when I right click on the M icon in the system tray, these options are all that come up:

Open security Center
Updates
Scan
Quick Links
Change settings
Verify Subscription
Upgrade center
Customer Support

 I find it odd that there is not an exit program option available here. When I open the security center, there is an M icon in the upper left corner in the FILE position, when I click on it, the options are move, minimize and close only

[evilfantasy]

Go ahead and run Kaspersky. It shouldn't give you any problems.

[ironman99011]

 Logfile from Kaspersky Online Scan attached.

[recovering disk space -- attachment deleted by admin]

[evilfantasy]

No malware.

What all problems remain?

[ironman99011]

 None that I am aware of, machine has only been used sparsley today, mainly per instructions. We are able to log onto mail accounts and online banking as before.
 I thank you very much for your knowledge, patience and especially your help.

[evilfantasy]

Final steps to help secure everything and some advice.

Download OTMoveIt2 by OldTimer OTMoveIt2.exe and place it on your desktop. (unless you already have it installed)

1. Double click OTMoveIt2.exe to launch it.
Vista users right click and choose Run As Administrator
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)
5. Once complete exit out of OTMoveIt2

----------

Set a New Restore Point to prevent possible reinfection from an old one
Setting a new restore point AFTER cleaning your system will enable your computer to roll-back to a clean working state if needed.

• Go to Start > Programs > Accessories > System Tools and click System Restore
  
• Choose the radio button marked Create a Restore Point on the first screen then click Next Give the Restore Point a name then click Create.
  
• The new restore point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Next go to Start > Run and type Cleanmgr
  
• Click OK
  
• Click the More Options Tab.
  
• Click Clean Up in the System Restore section to remove all previous restore points except the newly created clean one.

You can find instructions on how to enable and re-enable system restore here:

Windows XP System Restore Guide or Windows Vista System Restore Guide
.
----------

Use the Secunia Software Inspector to check for out of date software.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

.
----------

Important: You Need to Update Windows and Internet Explorer regularly to protect your computer from the malware and other security threats that are on the Internet. Go to Microsoft Windows Update and get all critical updates.

If you are running any Microsoft Office version go to the Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.

----------

Please keep these programs up-to-date and run them whenever you suspect a problem. A number of programs have resident protection and it is a good idea to run the resident protection of one of each type of program to maintain protection. However, it is important to run only one resident program of each type since they can conflict and become less effective. That means only one antivirus, firewall and scanning anti-spyware program at a time. Passive protectors, like SpywareBlaster can be run with any of them.

Here are some great FREE tools to help you keep from getting infected again. These tools use little or no resources so won't slow down your PC.

Concerned about Browser Security? Consider using Mozilla Firefox 3.0 with Adblock Plus and NoScript

To prevent unknown applications from being installed on your computer install WinPatrol 2008
* Using Winpatrol to protect your computer from malicious software

I suggest using SiteAdvisor. SiteAdvisor rates sites on business practices and spam. Safety ratings from McAfee SiteAdvisor are based on automated safety tests of Web sites.

SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

Use only trusted security software like the programs listed on this page. Trusted security tools & resources

[ironman99011]

 I have created a new restore point, I will continue with the remainder of your advise.......tomorrow, bedtime now.
 I do however wish to take a moment and thank you for your knowledge, patience and especially your help in this issue. I would have sat and watched my system get corrupted beyond repair on my own. Therefore I am left with nothing but thanks to you and the other specialists who administer this site, great job.....

[evilfantasy]

I'm glad everything worked out and thank you for hanging in there

Let us know if anything else comes up.

Safe surfing.............