Winspyware protect removal tool

[evilfantasy]

Open HijackThis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

O4 - HKCU\..\Run: [s9201] "C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\wspwprtct.exe" /autorun
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

Important: Close all open windows except for HijackThis and then click Fix checked.

Once completed, exit HijackThis.

----------

Now download The Avenger by Swandog46 and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your Desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
  
• Copy everything in the Code box below, and paste it into the Input script here window:

Code: [Select]

Comment:

Files to delete:
C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\wspwprtct.exe
Folders to delete:
C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect

Note: the above instructions were created specifically for this user. If you are not this user, DO NOT follow these directions as they could damage the workings of your system

• Now click the Execute button.
  
• Click Yes to the prompt to confirm you want to execute.
  
• Click Yes to the "Reboot now?" question that will appear when Avenger finishes running.
  
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will pop-up for you to view when you login after reboot.

.

• Add the Avenger log in your next post.

----------
You have Viewpoint installed.

Viewpoint Media Player/Manager/Toolbar is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad".

More information:

• ViewMgr.exe - Useless
  
• Viewpoint To Track Browsing, Serve Ads
  
• Viewpoint to Plunge Into Adware

It is suggested to remove the program now.
Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following programs if present.

• Viewpoint
  
• Viewpoint Manager
  
• Viewpoint Media Player
  
• Viewpoint Toolbar
  
• Viewpoint Experience Technology

.
----------

Do you know why iWinGamesInstaller is running as a service?

How is everything now?

[evilfantasy]

SUPERAntiSpyware program and McAfee will not conflict at all.

I'm merging this topic with the other one.

[ironman99011]

 The Avenger log is attached. I do not know why iWinGamesInstaller is running as a service, as far as I am concerned we can get rid of it.
 I am having a few new problems though, we (wife and I) cannot sign on to other sites that require a login and password ie; Yahoo mail account, online banking ect. I am getting a message that states "The browser you are using refuses to sign in (cookies rejected). The settings in the tools on IE - internet options - privacy are at medium where they were before.
 Additionally, when I reboot I am getting several application errors, do not know the significance but I will list:
qttask.exe
sprtcmd.exe
Reader_sl.exe
SSUPDATE.EXE
 All these errors state the same message - instruction at "0.00000000" referenced at memory "0.00000000". The memory could not be read.

 My system as a whole appears to be running much faster though. When I began the operations I had to restart several times just to connect to the internet. If you can help me resolve these last few issues it will be greatly appreciated.

[recovering disk space -- attachment deleted by admin]

[ironman99011]

 Please delete the posts in the other threads. I had an afterthought this am when I woke up about not being complete with the removal and a very possible connection.
 I will follow this thread only and will be as patient as it takes, thank you both for reminding me.

 

[ironman99011]

 Sorry, forgot to add to post. When I ran HijackThis, the 2 entries listed in relation to WinSpywareProtect and Viewpoint Manager were present. I checked them and then clicked FIx Checked.
 In add/remove programs I found Viewpoint Manager and Viewpoint Media Player and removed them.

[evilfantasy]

Download ATF Cleaner by Atribune to your Desktop.

Alternate download link

Note: Vista users must use Run As Administrator

• Under Main: Select Files to Delete choose: Select All.
  
• Click the Empty Selected button.
  
• If you use Firefox browser click Firefox at the top and choose: Select All
  
• Click the Empty Selected button.
  If you would like to keep your saved passwords click No at the prompt.
  
• If you use Opera browser click Opera at the top and choose: Select All
  
• Click the Empty Selected button.
  If you would like to keep your saved passwords click No at the prompt.
  
• Click Exit on the Main menu to close the program.

.
Important: Restart the computer before continuing.

Note that your system will run slower for a reboot or two after having used this tool so don't panic.

----------

Download Deckard's System Scanner (DSS) to your Desktop.
Note: You must be logged onto an account with administrator privileges.
Vista users Right click DSS and Run as Administrator.

• Close all applications and windows.
  
• Double-click on dss.exe to run it, and follow the prompts.
  
• When the scan is complete, two text files will open.
• main.txt <- this one will be maximized
  
• extra.txt <- this one will be minimized
• Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and extra.txt in your reply.

[ironman99011]

 Log files of Deckard's System Scanner attached, waiting for further instructions.

[recovering disk space -- attachment deleted by admin]

[evilfantasy]

Go to Add or Remove Programs and uninstall:

- iWin Games (remove only)
- WildTangent Web Driver

----------

Open HijackThis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

Important: Close all open windows except for HijackThis and then click Fix checked.

Once completed, exit HijackThis and restart the computer.

----------

• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
  
• Copy everything in the Code box below, and paste it into the Input script here window:

Code: [Select]

Comment:

Files to delete:
C:\WINDOWS\system32\byromj.dll


Note: the above instructions were created specifically for this user. If you are not this user, DO NOT follow these directions as they could damage the workings of your system

• Now click the Execute button.
  
• Click Yes to the prompt to confirm you want to execute.
  
• Click Yes to the "Reboot now?" question that will appear when Avenger finishes running.
  
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will pop-up for you to view when you login after reboot.

.

• Add the Avenger log in your next post.

----------

Update your Mozilla Firefox Browser
Recently there have been vulnerabilities detected in older versions of Mozilla Firefox.
It is strongly suggested that you update to the current version.
Mozilla Firefox 2.0.0.16
You can update it by clicking Help > Check for updates...

----------

Run CCleaner.

----------

Run the Kaspersky Online Scanner

In Microsoft Windows Vista, you must open the Web browser using the Run as Administrator command. From the Desktop right click the icon and choose Run as Administrator.

• Click on SCAN NOW
  
• Click Accept.
  
• The program will then begin downloading the latest definition files.
• Once the files have been downloaded locate the Scan Settings and have it scan My Computer.
  
• The scan will take a while, so be patient and let it finish.

When the scan is done, in the Scan is complete window, any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.

To obtain the report:
Click on: Save Report As

• Next, in the Save as prompt, Save in area, select: Desktop.
  
• In the File name area use KScan, or something similar.
  
• In Save as type: click the drop arrow and select: Text file [*.txt]
  
• Then, click: Save

Copy and paste the Kaspersky Online Scanner Report in your next reply.

----------

Let me know how everything is now.

[ironman99011]

Latest Avenger logfile attached, setting up to run the Kaspersky Online Scanner now.

[recovering disk space -- attachment deleted by admin]

[ironman99011]

 Disclaimer on Kaspersky site states to turn off any antivirus program installed in order for the scan to run successfully. I have McAfee Security Center running and do not know how to turn iy off, no exit program option available in the window...
 Should I run the online scan as is ?

[evilfantasy]

Navigate to the system tray on the bottom right hand corner and look for the M sign.

    * right-click it -> chose "Exit."
    * a popup will warn that protection will now be disabled. Click on "Yes" to disable the Antivirus guard.

You succesfully disabled the McAfee Guard.

[ironman99011]

 No Exit option available, when I right click on the M icon in the system tray, these options are all that come up:

Open security Center
Updates
Scan
Quick Links
Change settings
Verify Subscription
Upgrade center
Customer Support

 I find it odd that there is not an exit program option available here. When I open the security center, there is an M icon in the upper left corner in the FILE position, when I click on it, the options are move, minimize and close only

[evilfantasy]

Go ahead and run Kaspersky. It shouldn't give you any problems.

[ironman99011]

 Logfile from Kaspersky Online Scan attached.

[recovering disk space -- attachment deleted by admin]

[evilfantasy]

No malware.

What all problems remain?