Spyware Protect 2009 | ||||||||
| ||||||||
|
Danger level: 
9
9
Type: Rogue Anti-Spyware
Common infection symptoms:
Other mutations known as:
- Connects to the internet without permision
- Shows commercial adverts
- Slow internet connection
- System crashes
- Annoying pop-up's
- Slow Computer
Infection Video
How to manually remove Spyware Protect 2009
Files associated with Spyware Protect 2009 infection:
sysguardn.exe
free_scan.exe
ntos.exe
load[1].exe
usp10.dll
Omahonafazeq.dll
new23[1].exe
gr[2].exe
adv111[1].exe
new26[1].exe
sysguard.exe
iehelper.dll
av.19.1[1].exe
vvilsysguard.exe
nalxsysguard.exe
ntnrsysguard.exe
free_scan.exe
ntos.exe
load[1].exe
usp10.dll
Omahonafazeq.dll
new23[1].exe
gr[2].exe
adv111[1].exe
new26[1].exe
sysguard.exe
iehelper.dll
av.19.1[1].exe
vvilsysguard.exe
nalxsysguard.exe
ntnrsysguard.exe
Spyware Protect 2009 DLL's to remove:
usp10.dll
Omahonafazeq.dll
iehelper.dll
Omahonafazeq.dll
iehelper.dll
Spyware Protect 2009 processes to kill:
sysguardn.exe
free_scan.exe
ntos.exe
load[1].exe
new23[1].exe
gr[2].exe
adv111[1].exe
new26[1].exe
sysguard.exe
av.19.1[1].exe
vvilsysguard.exe
nalxsysguard.exe
ntnrsysguard.exe
free_scan.exe
ntos.exe
load[1].exe
new23[1].exe
gr[2].exe
adv111[1].exe
new26[1].exe
sysguard.exe
av.19.1[1].exe
vvilsysguard.exe
nalxsysguard.exe
ntnrsysguard.exe
Remove Spyware Protect 2009 registry entries:
Microsoft\Windows\CurrentVersion\Run\sysguardn
Microsoft\Windows\CurrentVersion\Run\Mmexofumutokara
Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C9C42510-9B21-41c1-9DCD-8382A2D07C61}
{C9C42510-9B21-41c1-9DCD-8382A2D07C61}
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\system tool
Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BBD4551A-9B23-41cd-9BCD-818AA2DA7B63}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ system tool
Microsoft\Windows\CurrentVersion\Run\Mmexofumutokara
Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C9C42510-9B21-41c1-9DCD-8382A2D07C61}
{C9C42510-9B21-41c1-9DCD-8382A2D07C61}
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\system tool
Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BBD4551A-9B23-41cd-9BCD-818AA2DA7B63}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ system tool
Comments
The version that hit my machine also edited my lmhosts file, sending a microsoft address to its own servers.
testing this message board to see if these are legit comments... sorry for double checking... but if it works... I will
I used this and it worked fine.
My problem is that all these anti 'spyware protect 2009' programs that will remove the threat, I cant even access the page. I think there is a trojan *****ociated with this threat that doesnt allow me to download or access these programs. It also keeps me from system restore
yeah me too. it keeps me from system restore and as such no internet connection.
pls help!
I am in the same boat as Jay and Rob. There has to be a way around this...
I am finding no solution to this
Yes, I am in the same boat as Jay-Rob and Jason. I cannot do a system restore, I can only access certain sites, and I get a auto popup for when I go through my computer folders. What's the deal?
try in safe mode
Any Ideas on this situation, I received this virus yesterday and I cant do anything to get rid of it any answers, I cant even restore or web browse
I tried posting my solution to the problem here but it wont show...
Goto this site--- posted the solution Under the name 'James'
Firefox has been infected
I received this through my ISP and it is incredibly annoying. I couldn't remove it despite my bag of tricks, it wasn't until late last night I realized it came through Comcast. -_-
***** SPYWARE PROTECT 2009!!!! Whoever created this has serious mental problems!
Do you guys know who created this?
I ***** hate this! ***** i dont have enough money to buy a new ***** computer!!!! *****K
I kept plugging away and deleting files and registry keys till I got it. The list at the top of this post is a real life saver. Thank you very much for this information, kept me from reloading.
These are the Awsome LifeSaving Steps From This Weird Spyware.
Guys Rely on it
any solutions?? i can't do system restore, i deleted reg keys and files I found...manged to do a scan but it couldn't delete everything.
This is really frusterating...I thiught it was here to help until i finally googled it now i cant get it off!
SpyHunter downloaded but won't start, even in Safe Mode
any idea? thx
Hello,
Try redownloading SpyHunter. The new version removes Spyware Protect 2009 perfectly!
PcThreat team
is this thread legit
we found ONE file and deleted it and that took care of the problem. WE were happy to have this information. At first we thought we would have to locate all of the files listed but we didnt.
If this virus has blocked access to your internet here is another website to access from another computer that provides manual directions to delete this found ONE file from the above list and deleted that which eliminated the virus.
At first we were overwhelmed with thinking about how we could find all of the files.
website provides manual instructions to delete this virus.
I've seen a lot of people ask if this thread is for real, and since I haven't seen a definitive yes yet, I'd like one.
I've got the same infection and removed it after reading blog
Bob - You want an opinion? YES!! This is a very REAL threat! This virus is quite malicious and can destroy your computer at least, and aid the authors in identity threat at most.
i'll chop ur faces off if i find out who is behind this program.
I put a post here yesterday.why isnt it still here? Is this site real?
Why was my blog removed?R U really *****ociated with the SOB'S ????????
WTF man i cant find any of those processes on my process list...except for sysguard.exe
I had the annoying pop-ups and the spyware demo kept coming up on its own, so I searched for ways to delete it from my system. The following website details which files you can look for and remove. The only place I had to remove any files was from the registry. You have to be careful though, so you don't remove anything else by mistake. So far it has worked, and I haven't had any more issues (yet).
Your lists about which processes to stop and which files to remove was very important and helpful to me - thank you! First I had tried a tool for automatic removement, but it didn't work as my PC still runs on Windows 2000. So the only possibility was to delete the files manually - but you have to know which ones :-)! Thanks again!
im having the same problem as jay rob and jason and g dubz i think. i ran some malware program and it removed most of this kunt of a virus. no more rigged pop ups, but also no internet connection. the lil icon in the system tray says acquiring network address. its putting me on m*****ive tilt. im going to go through and manually take everything out..i was trying to watch that show eastbound and down..i hope the creators of that virus rot in eternal hell.
OK...I can't even access the internet...how do I fix my system? I have deleted the registries, etc but cannot get my internet to work. Can't run System Restore either. I can see previous restore dates but it won't let me click on "next" to run it.
Tom,
try downloading Spyhunter on another machine and the use a USB flash to install it.
Will this reset my internet settings? I've gotten rid of the spyware files (I believe) and have deleted the registries. I don't get anymore popups, etc but just can't access the internet now.
Thanks you !!!!!
Can't transfer it via flash drive...it's 22mb. I don't have a flash that big. Any other ideas? If I could just get my internet unblocked, or whatever is going on, I can download it directly right away.
Thanks !!
tom
This thing is brutal.... thank god for another laptop in my house. Removed the iehelper.dll, and the pop ups have ceased, yet I cannot upgrade my AV because no connectivity.... Just like Tom, "any ideas"?
Thanks so much for this list, it really really helped.
I was getting quite pissed off that i couldn't find out what was wrong.
I think i was hacked, as soon as my wife got on the web site
this trojan is a bitch. I just removed it. it took me hours though.
I am going to get my shotgun and shoot the bastard who made this.
I just CTRL ALT DELETEd the application "sysguardn.exe," and it stopped the problem temporarily.
But I think next time I reboot my computer, it might start up again automatically if it has truly installed itself.
go all over and even temp files what ever is not familer get rid of registry to. I did not download this I was warned, get rid of anything you think is not to be there and restart. good luck
I'm running Windows XP Pro -- this has gotten into my personal user account twice now -- if I login as administrator I can remove it. I login as admin only when necessary and disconnect from the wireless network as much as I can while logged in as admin.
For future reference, maybe that's one way around it -- another identity with admin privileges.
But I'm still downloading this and another malware freebie just to be sure I'm clean.
GUYS SIMPLE PROCESS -- Login in Safe mode with networking option.Windows will ask if you want to continue to safe mode or use system restore. Click on 'no' which will throw the system restore screen.Restore to the latest available point before you got the spyware protect bit**.
Guys, as Simon mentioned very important thing that is not mentioned in the article above...
Take a look at your /%rootdir%/SYSTEM32/DRIVERS/etc/hosts file
for ordinary users it should contain only line
::1 localhost
remove all other lines, as that adware adds reference to its website there replacing known good website's ip-addresees with its website, and when you start your IE you will get that thing on your computer again and again.
continuing the story as comments area length is limited ...
IT-guys should know themselves what it supposed to be, if they changed "hosts" file for their purpose.
also Spyware Protect 2009 DLL's to remove - usually located in /%rootdir%/system32/
Files *****ociated with Spyware Protect 2009 infection - usually located in /%rootdir%/
/%rootdir%/ - usually is c:\WINNT\ or c:\WINDOWS\ folder
continuing the story again as comments area length is limited ...
I am going to try to create empty fake files with names sysguardn.exe and iehelper.dll and make them readonly, we will see if that helps
good luck to everyone
and also make "hosts" file read only too.
the file or process also can be named sysguard.exe or sysguardn.exe
i love u guys so much!!! all i did was 3 things: delete sysguard in processes, then kill sysguard.exe and finally restarting my computer!! now im virus-free! XDDD
HELLO the spyware 2009 sets your browser up to use a PROXY SERVER
go to tools >CONNECTIONS and configure your browser back to DIRECT INTERNET CONNECTION
you still have to get rid of the spyware but at least you will have internet
what a lame stupid little annoyance
I could make a better virus than this in 5 minutes on a 386
OK....I still can't get internet to work. I've tried system restore and click on "next" button but it doesn't do anything...even in safe mode. I've killed all "running" files in task mgr and system is running great but no internet. I've checked interenet options and everything looks fine. I tried checking the "system32/drivers/etc...Host" file but can't open it to see if "localhost" is the only line in the file.
I'm out of ideas. Any suggestions ? Please ???
These are awesome suggestions, but what happens when it start telling you that you are the administrator and so your options are either further limited, for crying out load, there are only so many files i can enter!!!!
Oh,i found the files though a infinite search, but i cant delete them
I managed to get it off, but unfortunately, none of the files listed above i didn't find them. But it gave me an idea, thanks never the less.
Spyware Protect locked up my system and blocked any programs I would try to run, safe mode or not. I booted into safemode command prompt. Removed usp10.dll from windows\system32 and windows\system32\dllcache. Found no other listed files. I also removed two folders that were in the c:\documents and settings\all users\application data folder: "10307964" & "15194844". Seems they're not always the same. 1 'unknown file' in each.
Looks like this thread IS real! Good luck
i can't find any of the processes to remove from my spyware protect 2009
i did not read any priblem like mine. wireless and unknown people are using and sending up my bill and also interfering with my info. from my web site.
Fix works well, ***** the bored russian n00bs who made this...