View PC Secure Product
This page is a copy of part of the help file for Special Agent PC Secure.
Special Instructions for Spyware Removal
The Fix-It tool can be started by right Clicking the PC Secure Icon in the system tray and selecting "Start Fix_It Agent"
Your files where placed in the following files in the My Documents folder, Demo.als and EncryptedFiles.als. The password for the EncryptedFiles.als file is: mf2lro8sw03ufvnsq034jfowr18f3cszc20vmw, The password for the Demo.als file is: kw9fjwfielaifuw1u3fw3brue2180w3hfse2
You will need to select a new Screen Saver for your desktop. This Trojan replaced the screen saver entry in the Registry. Right click your desktop and select Properties.
You will need to run a virus scanner to fix all infected files.
This malware is a virus. You may need to manaully replace the file Windows\System32\Kernel32.dll and Wininet.dll by copying the files Windows\System32\oldkrn.tmp to Kernel32.dll and oldwin.tmp to Wininet.dll, using the Recovery Console or MSDOS. PC Secure will make an attempt to replace them but the Kernel32 will need to be replaced manually. These tmp files are copies of the original files.
This worm is known to delete backups of the Windows Registry. It deletes the file in your Windows Repair folder on Windows XP and 2000. If you have a hard drive or System State backup you should restore this files.
This worm overwrites the file c:\Autoexec.bat with batch script that deletes the entire directory tree of drives f, g, h, and i.
Blackmal may have altered some Keys at HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses, it is recommended that you restore the Registry with a backup. It may have also deleted your anti virus software; you will need to reinstall it.
Dupator! is memory resistent. You will need to run a virus scanner to fix all infected files.
Dagonit: For Windows XP, 2000, and 2003 use
the Fix-It tool to replace the file
%Windir%\System32\Winspool.exe. The following services have been
set to automatically start: TelNet, Terminal Services, RPCSS, and
the following Registry Key has been modified: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
the setting that have been altered are:
Replace the files
For Windows 98 and ME replace the file %Windir%\System\Winspool.exe.
delete the Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
Replace the files if they exist:
This Trojan has added several tasks to the Task Scheduler. Remove all tasks you have not set yourself.
Feebs may have created %System%\MS[RANDOM].exe, %System%\MS[RANDOM], %System%\MS[RANDOM]32.DLL. And an entry "MS[RANDOM CHARACTERS]" = "%System%\MS[RANDOM CHARACTERS]32.dll" to the following registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
You need to open the Network setting applet in the Control Panel. Reset your adapter. Clear or change the DNS servers. This Trojan has set them to 22.214.171.124 and 126.96.36.199
After removing the file from the LSP list. be sure to delete the value "PackedCatalogItem" = "%System%\abcedg21.dll" from HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock2\ParametersProtocol_Catalog9\Catalog_Entries\000000[TWO RANDOM DIGITS]
Click here to view the list of files that may have become renamed. To make repairs simply rename any of the files in the list back to the orginal file name.
This virus attempts to infect every .exe file on the computer. You will need to run a virus scanner to kill the virus. You should also replace all .exe files on your computer.
On Windows XP, 2000, and 2003, the file %system%\Lsass.exe should be replaced. This malware has modified this file
You will need to open RegEdit, Go to the Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder. In the right pane right click the entry "List", select Modify and delete the entry MSNetSvc
ProBot Activity Monitor:
Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, the value you want to delete is [8 random characters] = %system Folder%\[8 random characters].exe. Then go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunSerivces, the value you want to delete is [8 random characters] = %system Folder%\[8 random characters].exe. Also go to SYSTEM\CurrentControlSet\Services\[8 random characters] the ImagePath value will point to %System Folder%\drivers\[8 random characters].sys
Upon excution of this malware, it will search the Registry Key HKEY_CLASSES_ROOT\CLSID for the following files: shell32.dll, ole32.dll, oleaut32.dll, fm20.dll, thumbvw.dll, mshtml.dll, sdocvw.dll, browseui.dll
If there is a number of entries in CLSID Key related to the above 8 dll files, the worm creates the same number of dll files in the Windows system folder and replaces all the values in the registry.
It creates the file %System%\[RANDOM].dll and replaces registry entries under HKEY_CLASSES_ROOT\CLSID with the name of the dll file. A backup Registry should be installed.
This file is started with the bootup of Windows. If Windows starts this file before PC Secure can be started it will not be deleted. You will need to use the Recovery Console or MSDOS to manually delete it. It is located in your System32 folder. For Windows ME/9x it is in your System folder.
The file %Windir%\notepad.exe has been replaced by this Ttrojan. Use the Fix-It utility to replace it.
This Trojan may have deleted some of you system files and registry setting. You may need to reinstall Windows or replace the deleted file and registry from a backup. If the current system date is the 2nd, 4th, 17th, 24th, or 31st of the month:
The file Userinit.exe has been changed. This Trojan had copied itself to the file %windir%\System32\Userinit.exe in Windows XP, 2000, and 2003 or %windir%\System\Userinit.exe in Window 98 ME. You need to replace this file as PC Secure has deleted it. You may find the original file in %windir%\System\Userinit.exe in Windows XP, 2000, and 2003 or %windir%\System32\Userinit.exe in Window 98 ME. It may have also modified the original %System%\sfc_os.dll or sfc.dll file and its backup in %Windir%\dllcache in order to disable System File Protection
Open RegEdit and go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root
right-click the LEGACY_SCAGENT subkey, choose Permissions... / Allow / Everyone / Full access.
Then click OK and delete LEGACY_SCAGENT.
You will need to delete the Registry value: [RANDOM NAME] = "rundll32 "[Windir]\Downloaded Program Files\[RANDOM NAME].dll""
at the Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Also delete the file that this value points to. This folder is protected by Windows, in order to delete this file use PC Secure's Fix-It Agent to delete the file. You will need to type in then "Open" window: %Windir%\Downloaded Program Files in order to see the files in this folder.
Shop At Home:
You may need to use the LSPFixIt tool to restore your network connections. If the file LSP.dll is in the windows select it to be removed.
On XP, 2000 and 2003, the file TCPIP.sys may have been altered by the worm. Located in %system%\Drivers and %system%\Dllcache
Note: The worm is able to patch different versions of the TCPIP.SYS file (build 2180,2505, 2631, 2685) by modifying the checksum of the file and changing the number of allowed half-open connections (a security fix introduced by Microsoft Security Bulleting MS05-019).This change alters the normal functioning of TCP/IP protocol and may cause Network problems.
You can view and edit trusted sites using the Remover Agents interface.
Web Event Logger - Troj/Padodor:
When this Trojan installed, it reset your system date to the date of your Windows files to make it hard to detect . It may not have changed it back.
This worm has changed your Registered User name and the name of your computer. Reset the value "RegisteredOwner" at the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion. Reset the value "ComputerName" at the key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName\ActiveComputerName and then reboot.
On Windows XP, 2000, 2003 the file Hal.dll located in your System32 folder. If you get the message "Genes don't contain any record of humain history, you'll NEVER catch me!(Agent Hacker - Bazzi)" you will need to replace hal.dll
This is a virus that will infect any exe, dll, scr file it finds. You should use a virus scanner to disinfect or replace the files it finds.
You will need to replace Scanregw.exe, Internet.exe, Taskmon.exe and Rundll32.exe before rebooting. These files may have been deleted because they contained the Trojan and cannot be cleaned. You can review the Spy Cleaner log to see what files where deleted.
Files rename by Imav.A: