"System-Protector" malware/spyware/etc.

[Copper]

I've got a problem, a bad one. Something called "System Protector", it pops up with a yellow bar across the top of the screen, and is seriously screwing with my computer. Locks me out of task manager, won't let me run Spybot, etc. Does anybody know what it is/how to get rid of it, or know where to go for help? I honestly don't know where it came from, but I'm thinking it came off the wife's Gmail account (it's on her computer, luckily not mine.) Are there any good bulletin boards for stuff like this? Thanks!

[johnm]

Go To Safe Mode And Run Those Programs. Should Getem

Jm

[WormDrowner]

It is likely a trojan downloader. You will need to go to a site like Symantec.com or McAfee.com and run an online scan. This should identify the specific virus. You should then follow their instructions carefully to ensure that all the virus is removed. I went through this with my father a year or so back and it was a bear to clean out.

[FloridaEd]

The local tech guy in the St Petersburg Times newspaper recommended going to www . malwarebytes. org and downloading their free malware scanner/killer. You will note that this is a non-profit website.

I and numerous others I know have used this and it has, so far, been excellent. The free program runs once, and then you have to manually update/run it when you want to scan. They also sell a program that loads and continually monitors your computer. But programs like this (and Norton) running in the background can slow down your computer a bit... or a lot.

I believe you must have a proper virus checker/firewall system installed, running, and updating automatically to protect yourself. I personally use Norton Internet Security (virus checker and firewall) in combination with a router firewall and Mozilla Firefox as a browser, but stuff has gotten past Norton, Firefox, and the firewall. Malwarebytes cleaned up the stuff that Norton missed.

Just as an aside, I also run two computers (laptop & desktop) with Ubuntu Linux operating system and have never had any virus software or firewalls and have never caught anything on these 2 computers. But you have to be a little 'techie' to run Linux.



Florida Ed

[pigdog]

I'll second the Malwarebytes, stuff. Load it onto a jump drive and run it off of there.

[danrow55]

I use Cyberdefender for my anti-virus protection on my computer. It's also a fee software that scans for trojans, malwares and spywares. You have to upgrade to remove viruses, but the scanning software is free to download. We use this on all our copmuters - it works great.

[blackout]

System Protector is a rogue anti-spyware application. It is advertised and installed without user's permission through the use of trojan viruses when browsing malicious websites. Usually, these trojan viruses display fake security alerts or similar notifications. System Protector is advertised as security scanner, but the truth is that this parasite only mimics normal anti-spyware programs. The main goal of SystemProtector is to frighten the user and trick money from him.

Once installed, System Protector is configured to start automatically and to scan the infected system. After the scan, System Protector states that user's computer is seriously infected and strongly suggests to purchase a full version of System Protector, because trial version can only detect infections, but is is unable to remove them. Of course, those infections are all fake. System Protector displays the same list of infections on all infected computers. This parasite also has built-in utility that blocks security-related websites. It is highly recommended to remove System Protector from the system as soon as possible, because removal delay can only worsen the situation.

FORUM:
Discuss System Protector in
spyware removal forum

Related files: install.exe, lsascs.exe, shellex.dll, Windll32.exe, SpyProtectorSC_Base_new.dat, SpyProtectorSC_Config.ini, System Protector.lnk, Purchase License.url, Support Page.url, spyprotector.cpl

System Protector properties:
• Changes browser settings
• Shows commercial adverts
• Connects itself to the internet
• Stays resident in background

System Protector snapshot:
System Protector removal

Automatic System Protector removal:
remover for System Protector
System Protector manual removal:
Kill processes:
install.exe lsascs.exe windll32.exe
HELP:
how to kill malicious processes

Delete registry values:
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\System "DisableTaskMgr" => 1
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\System Protector
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\Cont extMenuHandlers\System Protector
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{107A1D6 3-2EAA-4694-8ABA-EC209C630D83}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shel lex\ContextMenuHandlers\System Protector
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ ContextMenuHandlers\System Protector
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\App Paths\lsascs.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "System Protector"
HELP:
how to remove registry entries

Unregister DLLs:
shellex.dll
HELP:
how to unregister malicious DLLs

Delete files:
install.exe lsascs.exe shellex.dll windll32.exe SpyProtectorSC_Base_new.dat SpyProtectorSC_Config.ini System Protector.lnk Purchase License.url Support Page.url spyprotector.cpl
HELP:
how to remove harmful files

Delete directories:
C:\Program Files\System Protector
Other programs to remove System Protector:
• Malwarebytes Anti Malware - Review - Download
• Malwarebytes Anti Malware - Review - Download
• Windows Defender - Review - Download

[Scottb NY]

download spyware Doctor and run it to identify and clean them. Then use a GOOD A/V & spyware program such as Vipre from sunbelt software. If you were running McAfee, you might as well have been running nothing at all. I have cleaned 2 machines of this recently and both had McAfee (Useless) . This virus locks out the admin rights also and will not let you load any programs. You will need to use SAFE mode to get the maching back to normal. There are also 2 lines in the registry in the HKLM MICROSOFT SOFTWARE RUN that will look bad. they are .EXE files. delete them .