JustProtectPc can be removed by stopping the processes and removing the files by using Emsisoft HiJackFree. Then the user should remove the registry entries added or modified by JustProtectPc shown in the removal guide below. JustProtectPc DLL Files should be unregistered too (see removal guide). All files related to JustProtectPc must be deleted.
JustProtectPc should be removed immediately!
JustProtectPc Removal Guide
Kill Process
(How to kill a process effectively?)
wscsvc32[1].exe
wscsvc32.exe
winupd64x.exe
Antivirus.exe
Unregister DLL files
C:\Documents and Settings\malwarehelp.org\Local Settings\Temporary Internet Files\Content.IE5\QVWZ2YCX\AvBho[1].dll
C:\Program Files\Antivirus\AvBho.dll
Delete Registry
HKEY_CLASSES_ROOT\avbho.avbhoapp.1
HKEY_CLASSES_ROOT\avbho.avbhoapp
HKEY_CLASSES_ROOT\CLSID\{9d541c6a-573b-4888-b35e-6816e68c3620}
HKEY_CLASSES_ROOT\Interface\{9692be2f-eb8f-49d9-a11c-c24c1ef734d5}
HKEY_CLASSES_ROOT\Interface\{967a494a-6aec-4555-9caf-fa6eb00acf91}
HKEY_CLASSES_ROOT\TypeLib\{65da0ce6-30d1-4144-a0b6-59bd01372e26}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Antivirus
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9d541c6a-573b-4888-b35e-6816e68c3620}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9d541c6a-573b-4888-b35e-6816e68c3620}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus.exe
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wscsvc32.exe
Remove Folders and Files
C:\WINDOWS\Prefetch\ANTIVIRUS.EXE-26EDE405.pf
C:\SYSTEM VOLUME INFORMATION\_RESTORE{D3113EBC-D804-4C81-9A6A-F59373F8925A}\RP16\A0001034.LNK
$ALLUSERPROFILE%\Start Menu\Programs\AntiVirus
$ALLUSERPROFILE%\Desktop\AntiVirus.lnk
C:\Documents and Settings\malwarehelp.org\Local Settings\Temporary Internet Files\Content.IE5\QVWZ2YCX\AvBho[1].dll
C:\Documents and Settings\malwarehelp.org\Local Settings\Temporary Internet Files\Content.IE5\MGJCX1Y1\wscsvc32[1].exe
C:\Documents and Settings\malwarehelp.org\Local Settings\Temp\winupd64x.exe
C:\Program Files\Antivirus
JustProtectPc should be removed immediately!
JustProtectPc Removal Guide
Kill Process
(How to kill a process effectively?)
wscsvc32[1].exe
wscsvc32.exe
winupd64x.exe
Antivirus.exe
Unregister DLL files
C:\Documents and Settings\malwarehelp.org\Local Settings\Temporary Internet Files\Content.IE5\QVWZ2YCX\AvBho[1].dll
C:\Program Files\Antivirus\AvBho.dll
Delete Registry
HKEY_CLASSES_ROOT\avbho.avbhoapp.1
HKEY_CLASSES_ROOT\avbho.avbhoapp
HKEY_CLASSES_ROOT\CLSID\{9d541c6a-573b-4888-b35e-6816e68c3620}
HKEY_CLASSES_ROOT\Interface\{9692be2f-eb8f-49d9-a11c-c24c1ef734d5}
HKEY_CLASSES_ROOT\Interface\{967a494a-6aec-4555-9caf-fa6eb00acf91}
HKEY_CLASSES_ROOT\TypeLib\{65da0ce6-30d1-4144-a0b6-59bd01372e26}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Antivirus
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9d541c6a-573b-4888-b35e-6816e68c3620}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9d541c6a-573b-4888-b35e-6816e68c3620}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus.exe
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wscsvc32.exe
Remove Folders and Files
C:\WINDOWS\Prefetch\ANTIVIRUS.EXE-26EDE405.pf
C:\SYSTEM VOLUME INFORMATION\_RESTORE{D3113EBC-D804-4C81-9A6A-F59373F8925A}\RP16\A0001034.LNK
$ALLUSERPROFILE%\Start Menu\Programs\AntiVirus
$ALLUSERPROFILE%\Desktop\AntiVirus.lnk
C:\Documents and Settings\malwarehelp.org\Local Settings\Temporary Internet Files\Content.IE5\QVWZ2YCX\AvBho[1].dll
C:\Documents and Settings\malwarehelp.org\Local Settings\Temporary Internet Files\Content.IE5\MGJCX1Y1\wscsvc32[1].exe
C:\Documents and Settings\malwarehelp.org\Local Settings\Temp\winupd64x.exe
C:\Program Files\Antivirus
No comments:
Post a Comment