Malwareteks: Forums / Inactive Malware Threads / [INACTIVE] Virus Protect Pro not in your guide

Forums

Malwareteks :: Forums :: Malware Support :: Inactive Malware Threads		<< Previous thread \| Next thread >>
[INACTIVE] Virus Protect Pro not in your guide


Moderators: ShadowPuterDude, Greg, D3m3nt3d, Brandon, Vmarm, peterparker, siljaline, jholland1964, TurcoLoco, Windsor, JeanInMontana, KZ, RatHat, Jason Amison, MrCharlie	This thread is now closed

Author

Post

stormtrooper67

Tue Jul 10 2007, 04:30PM

Registered Member #82

Joined: Tue Jul 10 2007, 04:05PM
Posts: 2
Thanked 0 times in 0 posts

theres this adware program i somehow got and im not sure how to get rid of it all. its called virus protect pro and it seems to do similar things to what you guys have described about other adware programs. it starts a "scan" and names random files that it deems as threats then tells you to buy the full version so those "threats" can be removed immediately. it also embeds an icon in the toolbar in the shape of a shield like most spyware programs and it flashes between a red "X" and a blue "?". upon start up that icon is the first to appear and it gives an alert that looks like a windows alert and it tells you your computer is infected and you must install an up-to-date spyware solution. if the icon is clicked either by the left or right mouse button, it opens internet explorer and takes you to the virus protect pro website. so it cannot be closed, not only that but the icon will minimize games programs that take up the whole screen type things, and it gets extremely irritating. i downloaded Ad-Aware and it seems to have gotten rid of Virus Protect Pro but that toolbar icon that came with it is still there, however, it is no longer interrupting all my programs but its still there and i'd feel better if it was gone with VPP just on the off chance the program could still reconstruct itself. if you guys could help me make sure i completely get rid of it that would be great

. and just pointing out, McAfee, Windows Defender, and Spybot Search and Destroy could not find this adware program.

ShadowPuterDude

Tue Jul 10 2007, 05:33PM

...the Shadow knows

Registered Member #1

Joined: Thu Apr 27 2006, 04:52PM
Location: Northern NY
Posts: 217
Thanked 10 times in 10 posts

I have not added a guide for VirusProtectPro. The removal procedures are much the same for all the Rogues.

Download to your Desktop:
ISeeYouXP
HijackThis
RougeRemover by MalwareBytes
SmitFraudFix by S!Ri

Double-click HijackThis_1991.exe this will install HijackThis to C:\Program Files\HJT and create a Desktop Shortcut.Extract the contents of ISeeYouXP.zip to the root directory of drive C:\. This will create a folder named ISeeYouXP in the root directory of Drive C.

IMPORTANT NOTE: Vista Users
UAC must be turned off to run this script.
Turning Off/On UAC in Vista
1. Open the Control Panel.
2. Under User Account and Family settings click on the "Add or remove user account".
3. Click on your user account.
4. Under the user account click on the "Go to the main User Account page" link.
5. Under "Make changes to your user account" click on the "Change security settings" link.
6. In the "Turn on User Account Control (UAC) to make your computer more secure" click to unselect the "Use User Account Control (UAC) to help protect your computer". Click on the "OK" button.
7. You will be prompted to reboot your computer. Do so.
In order to re-enable UAC just select the above checkbox and reboot.

( Do not attempt to run ISeeYouXP from inside the ZIP file or by using Winzip. ISeeYouXP will not work properly. )

Unzip RogueRemover, and run the installer. Start RogueRemover and select Scan. The program will walk you through the remaining steps.

Double-click smitfraudfix.exe

Select option #1 - Search by typing 1 and press Enter

This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed.

Note: process.exe ( which is used by SmitFraudFIx ) is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a “RiskTool”; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between “good” and “malicious” use of such programs, therefore they may alert the user. The below is a link to what process.exe is.

http://www.beyondlogic.org/consulting/processutil/processutil.htm

IMPORTANT: Do NOT run any other options until you are asked to do so! RENAME THE FIRST LOG NOW BEFORE CONTINUING OR YOU WILL OVERWRITE IT!!! And then immediately continue on to the below steps.

STEP 2: READ ALL OF THESE INSTRUCTIONS FIRST BEFORE DOING ANYTHING.

Print out or copy these instructions to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below.

Reboot your computer into Safe Mode.

Open the SmitfraudFix Folder of your Desktop, then double-click smitfraudfix.cmd file to start the tool.

Select option #2 - Clean by typing 2 and press Enter.

Wait for the tool to complete and disk cleanup to finish.

You will be prompted : “Registry cleaning - Do you want to clean the registry ?” answer Yes by typing Y and hit Enter.

The tool will also check if wininet.dll is infected. If it is infected and a clean version is found, you will be prompted to replace the infected wininet.dll with the clean file. Answer Yes to the question “Replace infected file ?” by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. BUT Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed.

STEP 3: READ ALL OF THESE INSTRUCTIONS FIRST BEFORE DOING ANYTHING.

Clean out your Temporary Internet files.

Proceed like this:
Quit Internet Explorer, all browsers and quit any instances of Windows Explorer.

For Internet Explorer 7

Click Start, click Control Panel, and then double-click Internet Options.
On the General tab, click Delete… under Browsing History.
Next to Temporary Internet Files, click Delete files, and then click OK.
Next to Cookies, click Delete cookies, and then click OK.
Next to History, click Delete history, and then click OK.
Click the Close button.
Click OK.

For Internet Explorer 4.x - 6.x

Click Start, click Control Panel, and then double-click Internet Options.
On the General tab, click Delete Files under Temporary Internet Files.
In the Delete Files dialog box, tick the Delete all offline content check box, and then click OK.
On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
Click OK.

For Netscape 4.x and Up

Click Edit from the Netscape menubar.
Click Preferences… from the Edit menu.
Expand the Advanced menu by clicking the triangle sign.
Click Cache.
Click both the Clear Memory Cache and the Clear Disk Cache buttons.

For Mozilla 1.x and Up

Click Edit from the Mozilla menubar.
Click Preferences… from the Edit menu.
Expand the Advanced menu by clicking the plus sign.
Click Cache.
Click the Clear Cache button.

For Opera

Click File from the Opera menubar.
Click Preferences… from the File menu.
Click the History and Cache menu.
Click the two Clear buttons next to Typed in addresses and Visited addresses (history) and click the Empty now button to clear the Disk cache.
Click Ok to close the Preferences menu.

Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.

STEP 4: READ ALL OF THESE INSTRUCTIONS FIRST BEFORE DOING ANYTHING.

Open the SmitfraudFix Folder of your Desktop, then double-click smitfraudfix.cmd file to start the tool.

Select option #3 - Delete Trusted zone by typing 3 and press Enter.

Answer Yes to the question “ Restore Trusted Zone ?” by typing Y and hit Enter.

Note: if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.

Post the following logs:
ISeeYouXP
HijackThis
Rapport.txt

Copy and Paste the logs into your reply. Normally I would have you attach the logs, but the File Attachment feature of the forums currently is not functioning.

"Only those who fail greatly can ever achieve greatly" - Robert F. Kennedy
Microsoft Most Valuable Professional - Consumer Security (2007-2008)
Member - Alliance of Security Analysis Professionals - Since 2006
Linux Registered User # 363218

stormtrooper67

Tue Jul 10 2007, 06:20PM

Registered Member #82

Joined: Tue Jul 10 2007, 04:05PM
Posts: 2
Thanked 0 times in 0 posts

ok now before i do all this i have one last question. is it possible that a scanning tool could remove the Adware, or do these need to be removed manually? i restarted my computer after running Ad-Aware and that toolbar icon that came with Virus Protect Pro was just gone, Ad-Aware did remove a file it called Virus Protect Pro but the toolbar icon was there which lead me to believe it wasnt completely destroyed, but now that the icon is gone along with fake windows alerts that lead you to go buy the software, it doesn't seem like i have it anymore.

ShadowPuterDude

Tue Jul 10 2007, 07:15PM

...the Shadow knows

Registered Member #1

Joined: Thu Apr 27 2006, 04:52PM
Location: Northern NY
Posts: 217
Thanked 10 times in 10 posts

It's possible that Ad-Aware removed VirusProtect Pro, but it is very unlikely that it removed the underlying infection. Mainly Zlob and Smitfraud.C.

Manual removal of this type of infection is always successful.

[ Edited Tue Jul 10 2007, 07:16PM ]


Jump: Back to top