Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for Web Protect for Windows

- - - - -
Started by Metallica , Sep 11 2014 08:33 AM

  • Please log in to reply
1 reply to this topic

#1
Metallica
Posted 11 September 2014 - 08:33 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is Web Protect for Windows ?
 
The Malwarebytes research team has determined that Mezaa is adware. These adware applications display advertisements not originating from the sites you are browsing.
 
How do I know if my computer is affected by Web Protect for Windows ?
 
You may see this entry in your list of installed programs: 
 
warning4.png
 
How did Web Protect for Windows get on my computer?
 
Adware programs use different methods for distributing themselves. This particular one was bundled with other software.
 
How do I remove Web Protect for Windows ?
 
Please note that the preferred way to remove this adware is by using the provided uninstaller! (see screenshot above)
Then proceed with the instructions below.
 
Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.
  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-version.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to the following:
    • Enable free trial of Malwarebytes Anti-Malware Premium
    • Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • If an update is found, you will be prompted to download and install the latest version.
  • Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
  • When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
  • Reboot your computer if prompted.
Is there anything else I need to do to get rid of Web Protect for Windows ?
  • If you were unable to use the uninstaller that came with Web Protect for Windows and you used Malwarebytes Anti-Malware to remove the potentially unwanted program, there will be a dll inserted in your LSP stack. This was not removed because that could possibly break your internet connection. Read the additional guide in the reply to this topic.
How would the full version of Malwarebytes Anti-Malware help protect me?
 
We hope our application and this guide have helped you eradicate this adware application.  
 
As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Web Protect for Windows adware.  It would have warned you before the adware could install itself, giving you a chance to stop it before it became too late.

 
protection1.png

 

Technical details for experts
 
Signs in a HijackThis log:

O10 - Unknown file in Winsock LSP: c:\windows\system32\myosprotect.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\myosprotect.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\myosprotect.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\myosprotect.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\myosprotect.dll
O23 - Service: MyOSProtect - MyOSCompany - C:\Program Files\PCTRunner\MyOSProtect.exe
O23 - Service: Protect Monitor (ProtectMonitor) - Unknown owner - C:\monitorsvc.exe
 
Alterations made by the installer:

File system details  
---------------------------------------------
    In the existing folder C:
       Adds the file monitor.exe"="9/2/2014 9:55 PM, 487483 bytes, A
       Adds the file monitorsvc.exe"="9/2/2014 9:55 PM, 34244 bytes, A
    Adds the folder C:\Program Files\PCTRunner
       Adds the file freebl3.dll"="8/30/2013 8:11 PM, 303104 bytes, A
       Adds the file libnspr4.dll"="8/30/2013 8:11 PM, 295424 bytes, A
       Adds the file libplc4.dll"="8/30/2013 8:11 PM, 48640 bytes, A
       Adds the file libplds4.dll"="8/30/2013 8:11 PM, 46080 bytes, A
       Adds the file MyOSProtect.dll"="9/1/2014 8:28 PM, 304776 bytes, A
       Adds the file MyOSProtect.exe"="9/1/2014 8:26 PM, 1317096 bytes, A
       Adds the file MyOSProtect.tlb"="9/1/2014 8:25 PM, 51112 bytes, A
       Adds the file MyOSProtect64.dll"="9/1/2014 8:28 PM, 350768 bytes, A
       Adds the file nss3.dll"="8/30/2013 8:11 PM, 854528 bytes, A
       Adds the file nssckbi.dll"="8/30/2013 8:11 PM, 417280 bytes, A
       Adds the file nssdbm3.dll"="8/30/2013 8:11 PM, 164352 bytes, A
       Adds the file nssutil3.dll"="8/30/2013 8:11 PM, 135680 bytes, A
       Adds the file PCProxy.tlb"="9/1/2014 8:25 PM, 51112 bytes, A
       Adds the file PCProxyDLL.dll"="9/4/2014 1:24 AM, 827392 bytes, A
       Adds the file pcwatch.sys"="9/1/2014 8:29 PM, 20480 bytes, A
       Adds the file pcwtc64f.sys"="9/1/2014 8:29 PM, 24064 bytes, A
       Adds the file pcwtc64r.sys"="9/1/2014 8:29 PM, 37376 bytes, A
       Adds the file postcollect.exe"="9/10/2014 12:41 AM, 48756 bytes, A
       Adds the file precollect.exe"="9/8/2014 6:21 PM, 46900 bytes, A
       Adds the file smime3.dll"="8/30/2013 8:11 PM, 132608 bytes, A
       Adds the file softokn3.dll"="8/30/2013 8:11 PM, 230400 bytes, A
       Adds the file sqlite3.dll"="8/30/2013 8:11 PM, 455168 bytes, A
       Adds the file ssl3.dll"="8/30/2013 8:11 PM, 228352 bytes, A
       Adds the file uninstallhelper.exe"="9/10/2014 12:42 AM, 790860 bytes, A
       Adds the file WDCertInstaller.dll"="9/1/2014 8:29 PM, 184216 bytes, A
       Adds the file wget.exe"="3/11/2013 8:19 PM, 401408 bytes, A
    In the existing folder C:\Windows\System32
       Adds the file MyOSProtect.dll"="9/1/2014 8:28 PM, 304776 bytes, A
       Adds the file MyOSProtect.ini"="9/11/2014 3:50 PM, 9640 bytes, A
       Adds the file MyOSProtectOff.ini"="9/11/2014 3:50 PM, 2272 bytes, A
    In the existing folder C:\Windows\System32\drivers
       Adds the file pcwatch.sys"="9/1/2014 8:29 PM, 20480 bytes, A

Registry details  
------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}]
       "(Default)"="REG_SZ", "MyOSProtect"
       "InstallingUser"="REG_SZ", "bQBiAGEAbQBwAGMAXABtAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAAAA=="
       "KomodiaParameters1"="REG_DWORD", 0
       "LaunchPermission"="REG_BINARY, ..L.\...0................................. ....... ...
       "LocalService"="REG_SZ", "MyOSProtect"
       "ServiceParameters"="REG_SZ", "-Service"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MyOSProtect.EXE]
       "AppID"="REG_SZ", "{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06FD4518-2CAB-4473-AA8D-0508134C6C1F}]
       "(Default)"="REG_SZ", "ReadOnlyManager Class"
       "AppID"="REG_SZ", "{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06FD4518-2CAB-4473-AA8D-0508134C6C1F}\LocalServer32]
       "(Default)"="REG_SZ", ""C:\Program Files\PCTRunner\MyOSProtect.exe""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06FD4518-2CAB-4473-AA8D-0508134C6C1F}\ProgID]
       "(Default)"="REG_SZ", "MyOSProtectLib.ReadOnlyManager.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06FD4518-2CAB-4473-AA8D-0508134C6C1F}\Programmable]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06FD4518-2CAB-4473-AA8D-0508134C6C1F}\TypeLib]
       "(Default)"="REG_SZ", "{3E4048A7-8F44-48dc-9163-16A4803F7826}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06FD4518-2CAB-4473-AA8D-0508134C6C1F}\VersionIndependentProgID]
       "(Default)"="REG_SZ", "MyOSProtectLib.ReadOnlyManager"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F101D36-9749-4730-AA02-F1F8BD1193EA}]
       "(Default)"="REG_SZ", "DataContainer Class"
       "AppID"="REG_SZ", "{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F101D36-9749-4730-AA02-F1F8BD1193EA}\LocalServer32]
       "(Default)"="REG_SZ", ""C:\Program Files\PCTRunner\MyOSProtect.exe""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F101D36-9749-4730-AA02-F1F8BD1193EA}\ProgID]
       "(Default)"="REG_SZ", "MyOSProtectLib.DataContainer.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F101D36-9749-4730-AA02-F1F8BD1193EA}\Programmable]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F101D36-9749-4730-AA02-F1F8BD1193EA}\TypeLib]
       "(Default)"="REG_SZ", "{3E4048A7-8F44-48dc-9163-16A4803F7826}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F101D36-9749-4730-AA02-F1F8BD1193EA}\VersionIndependentProgID]
       "(Default)"="REG_SZ", "MyOSProtectLib.DataContainer"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}]
       "(Default)"="REG_SZ", "DataTableFields Class"
       "AppID"="REG_SZ", "{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}\LocalServer32]
       "(Default)"="REG_SZ", ""C:\Program Files\PCTRunner\MyOSProtect.exe""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}\ProgID]
       "(Default)"="REG_SZ", "MyOSProtectLib.DataTableFields.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}\Programmable]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}\TypeLib]
       "(Default)"="REG_SZ", "{3E4048A7-8F44-48dc-9163-16A4803F7826}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}\VersionIndependentProgID]
       "(Default)"="REG_SZ", "MyOSProtectLib.DataTableFields"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A8D713-E25C-4c3f-AB27-44A4FEDD9328}]
       "(Default)"="REG_SZ", "WatchDog Class"
       "AppID"="REG_SZ", "{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A8D713-E25C-4c3f-AB27-44A4FEDD9328}\LocalServer32]
       "(Default)"="REG_SZ", ""C:\Program Files\PCTRunner\MyOSProtect.exe""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A8D713-E25C-4c3f-AB27-44A4FEDD9328}\ProgID]
       "(Default)"="REG_SZ", "MyOSProtectLib.WatchDog.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A8D713-E25C-4c3f-AB27-44A4FEDD9328}\Programmable]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A8D713-E25C-4c3f-AB27-44A4FEDD9328}\TypeLib]
       "(Default)"="REG_SZ", "{3E4048A7-8F44-48dc-9163-16A4803F7826}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A8D713-E25C-4c3f-AB27-44A4FEDD9328}\VersionIndependentProgID]
       "(Default)"="REG_SZ", "MyOSProtectLib.WatchDog"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{94B83936-77EA-4708-8FC5-F3BBC55C2A32}]
       "(Default)"="REG_SZ", "LSPLogic Class"
       "AppID"="REG_SZ", "{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{94B83936-77EA-4708-8FC5-F3BBC55C2A32}\LocalServer32]
       "(Default)"="REG_SZ", ""C:\Program Files\PCTRunner\MyOSProtect.exe""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{94B83936-77EA-4708-8FC5-F3BBC55C2A32}\ProgID]
       "(Default)"="REG_SZ", "MyOSProtectLib.LSPLogic.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{94B83936-77EA-4708-8FC5-F3BBC55C2A32}\Programmable]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{94B83936-77EA-4708-8FC5-F3BBC55C2A32}\TypeLib]
       "(Default)"="REG_SZ", "{3E4048A7-8F44-48dc-9163-16A4803F7826}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{94B83936-77EA-4708-8FC5-F3BBC55C2A32}\VersionIndependentProgID]
       "(Default)"="REG_SZ", "MyOSProtectLib.LSPLogic"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DA5534ED-88FD-49fa-9D2D-B92584CB21AC}]
       "(Default)"="REG_SZ", "DataTable Class"
       "AppID"="REG_SZ", "{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DA5534ED-88FD-49fa-9D2D-B92584CB21AC}\LocalServer32]
       "(Default)"="REG_SZ", ""C:\Program Files\PCTRunner\MyOSProtect.exe""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DA5534ED-88FD-49fa-9D2D-B92584CB21AC}\ProgID]
       "(Default)"="REG_SZ", "MyOSProtectLib.DataTable.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DA5534ED-88FD-49fa-9D2D-B92584CB21AC}\Programmable]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DA5534ED-88FD-49fa-9D2D-B92584CB21AC}\TypeLib]
       "(Default)"="REG_SZ", "{3E4048A7-8F44-48dc-9163-16A4803F7826}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DA5534ED-88FD-49fa-9D2D-B92584CB21AC}\VersionIndependentProgID]
       "(Default)"="REG_SZ", "MyOSProtectLib.DataTable"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE4EF20E-BC71-4a63-BC1E-C13B37815A00}]
       "(Default)"="REG_SZ", "DataController Class"
       "AppID"="REG_SZ", "{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE4EF20E-BC71-4a63-BC1E-C13B37815A00}\LocalServer32]
       "(Default)"="REG_SZ", ""C:\Program Files\PCTRunner\MyOSProtect.exe""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE4EF20E-BC71-4a63-BC1E-C13B37815A00}\ProgID]
       "(Default)"="REG_SZ", "MyOSProtectLib.DataController.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE4EF20E-BC71-4a63-BC1E-C13B37815A00}\Programmable]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE4EF20E-BC71-4a63-BC1E-C13B37815A00}\TypeLib]
       "(Default)"="REG_SZ", "{3E4048A7-8F44-48dc-9163-16A4803F7826}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE4EF20E-BC71-4a63-BC1E-C13B37815A00}\VersionIndependentProgID]
       "(Default)"="REG_SZ", "MyOSProtectLib.DataController"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E3F32F05-71B6-44c5-8BEE-13D239E27E98}]
       "(Default)"="REG_SZ", "DataTableHolder Class"
       "AppID"="REG_SZ", "{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E3F32F05-71B6-44c5-8BEE-13D239E27E98}\LocalServer32]
       "(Default)"="REG_SZ", ""C:\Program Files\PCTRunner\MyOSProtect.exe""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E3F32F05-71B6-44c5-8BEE-13D239E27E98}\ProgID]
       "(Default)"="REG_SZ", "MyOSProtectLib.DataTableHolder.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E3F32F05-71B6-44c5-8BEE-13D239E27E98}\Programmable]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E3F32F05-71B6-44c5-8BEE-13D239E27E98}\TypeLib]
       "(Default)"="REG_SZ", "{3E4048A7-8F44-48dc-9163-16A4803F7826}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E3F32F05-71B6-44c5-8BEE-13D239E27E98}\VersionIndependentProgID]
       "(Default)"="REG_SZ", "MyOSProtectLib.DataTableHolder"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataContainer]
       "(Default)"="REG_SZ", "DataContainer Class"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataContainer\CLSID]
       "(Default)"="REG_SZ", "{2F101D36-9749-4730-AA02-F1F8BD1193EA}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataContainer\CurVer]
       "(Default)"="REG_SZ", "MyOSProtectLib.DataContainer.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataContainer.1]
       "(Default)"="REG_SZ", "DataContainer Class"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataContainer.1\CLSID]
       "(Default)"="REG_SZ", "{2F101D36-9749-4730-AA02-F1F8BD1193EA}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataController]
       "(Default)"="REG_SZ", "DataController Class"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataController\CLSID]
       "(Default)"="REG_SZ", "{DE4EF20E-BC71-4a63-BC1E-C13B37815A00}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataController\CurVer]
       "(Default)"="REG_SZ", "MyOSProtectLib.DataController.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataController.1]
       "(Default)"="REG_SZ", "DataController Class"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataController.1\CLSID]
       "(Default)"="REG_SZ", "{DE4EF20E-BC71-4a63-BC1E-C13B37815A00}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTable]
       "(Default)"="REG_SZ", "DataTable Class"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTable\CLSID]
       "(Default)"="REG_SZ", "{DA5534ED-88FD-49fa-9D2D-B92584CB21AC}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTable\CurVer]
       "(Default)"="REG_SZ", "MyOSProtectLib.DataTable.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTable.1]
       "(Default)"="REG_SZ", "DataTable Class"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTable.1\CLSID]
       "(Default)"="REG_SZ", "{DA5534ED-88FD-49fa-9D2D-B92584CB21AC}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableFields]
       "(Default)"="REG_SZ", "DataTableFields Class"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableFields\CLSID]
       "(Default)"="REG_SZ", "{533403E2-6E21-4615-9E28-43F4E97E977B}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableFields\CurVer]
       "(Default)"="REG_SZ", "MyOSProtectLib.DataTableFields.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableFields.1]
       "(Default)"="REG_SZ", "DataTableFields Class"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableFields.1\CLSID]
       "(Default)"="REG_SZ", "{533403E2-6E21-4615-9E28-43F4E97E977B}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableHolder]
       "(Default)"="REG_SZ", "DataTableHolder Class"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableHolder\CLSID]
       "(Default)"="REG_SZ", "{E3F32F05-71B6-44c5-8BEE-13D239E27E98}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableHolder\CurVer]
       "(Default)"="REG_SZ", "MyOSProtectLib.DataTableHolder.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableHolder.1]
       "(Default)"="REG_SZ", "DataTableHolder Class"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableHolder.1\CLSID]
       "(Default)"="REG_SZ", "{E3F32F05-71B6-44c5-8BEE-13D239E27E98}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.LSPLogic]
       "(Default)"="REG_SZ", "LSPLogic Class"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.LSPLogic\CLSID]
       "(Default)"="REG_SZ", "{94B83936-77EA-4708-8FC5-F3BBC55C2A32}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.LSPLogic\CurVer]
       "(Default)"="REG_SZ", "MyOSProtectLib.LSPLogic.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.LSPLogic.1]
       "(Default)"="REG_SZ", "LSPLogic Class"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.LSPLogic.1\CLSID]
       "(Default)"="REG_SZ", "{94B83936-77EA-4708-8FC5-F3BBC55C2A32}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.ReadOnlyManager]
       "(Default)"="REG_SZ", "ReadOnlyManager Class"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.ReadOnlyManager\CLSID]
       "(Default)"="REG_SZ", "{06FD4518-2CAB-4473-AA8D-0508134C6C1F}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.ReadOnlyManager\CurVer]
       "(Default)"="REG_SZ", "MyOSProtectLib.ReadOnlyManager.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.ReadOnlyManager.1]
       "(Default)"="REG_SZ", "ReadOnlyManager Class"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.ReadOnlyManager.1\CLSID]
       "(Default)"="REG_SZ", "{06FD4518-2CAB-4473-AA8D-0508134C6C1F}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.WatchDog]
       "(Default)"="REG_SZ", "WatchDog Class"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.WatchDog\CLSID]
       "(Default)"="REG_SZ", "{59A8D713-E25C-4c3f-AB27-44A4FEDD9328}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.WatchDog\CurVer]
       "(Default)"="REG_SZ", "MyOSProtectLib.WatchDog.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.WatchDog.1]
       "(Default)"="REG_SZ", "WatchDog Class"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.WatchDog.1\CLSID]
       "(Default)"="REG_SZ", "{59A8D713-E25C-4c3f-AB27-44A4FEDD9328}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3E4048A7-8F44-48DC-9163-16A4803F7826}\1.0]
       "(Default)"="REG_SZ", "MyOSProtect 1.0 Type Library"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3E4048A7-8F44-48DC-9163-16A4803F7826}\1.0\0\win32]
       "(Default)"="REG_SZ", "C:\Program Files\PCTRunner\MyOSProtect.tlb"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3E4048A7-8F44-48DC-9163-16A4803F7826}\1.0\FLAGS]
       "(Default)"="REG_SZ", "0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3E4048A7-8F44-48DC-9163-16A4803F7826}\1.0\HELPDIR]
       "(Default)"="REG_SZ", "C:\Program Files\PCTRunner"
    [HKEY_LOCAL_MACHINE\SOFTWARE\PCTRunner]
       "(Default)"="REG_SZ", "installed"
       "installdate"="REG_SZ", "2014-09-11"
       "installid"="REG_SZ", "{1B822A41-8719-4A9A-9D12-E37330521604}"
       "installtimestamp"="REG_SZ", "1410443405"
       "mode"="REG_SZ", "1"
       "partner"="REG_SZ", "tgu"
       "product"="REG_SZ", "dc_bundle"
       "softwaredomain"="REG_SZ", "www-content.com/dcollect.js"
       "testgroup"="REG_SZ", ""
       "version"="REG_SZ", "214"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\pcwatch.sys]
       "(Default)"="REG_SZ", "Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MyOSProtect]
       "(Default)"="REG_SZ", "service"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\pcwatch.sys]
       "(Default)"="REG_SZ", "Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MyOSProtect]
       "DependOnService"="REG_MULTI_SZ, "RPCSS "
       "Description"="REG_SZ", "This service protects your computer from malicious websites and attacks while you are browsing the internet"
       "DisplayName"="REG_SZ", "MyOSProtect"
       "ErrorControl"="REG_DWORD", 1
       "ImagePath"="REG_EXPAND_SZ, "C:\Program Files\PCTRunner\MyOSProtect.exe"
       "ObjectName"="REG_SZ", "LocalSystem"
       "Start"="REG_DWORD", 3
       "Type"="REG_DWORD", 16
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\pcwatch]
       "Data"="REG_BINARY, ..............)............................................>.....................
       "DisplayName"="REG_SZ", "pcwatch service"
       "ErrorControl"="REG_DWORD", 1
       "ImagePath"="REG_EXPAND_SZ, "\??\C:\Windows\system32\Drivers\pcwatch.sys"
       "Start"="REG_DWORD", 1
       "Type"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\pcwatch\Enum]
       "0"="REG_SZ", "Root\LEGACY_PCWATCH\0000"
       "Count"="REG_DWORD", 1
       "NextInstance"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ProtectMonitor]
       "DisplayName"="REG_SZ", "Protect Monitor"
       "ErrorControl"="REG_DWORD", 1
       "ImagePath"="REG_EXPAND_SZ, "C:\monitorsvc.exe"
       "ObjectName"="REG_SZ", "LocalSystem"
       "Start"="REG_DWORD", 2
       "Type"="REG_DWORD", 16
    [HKEY_CURRENT_USER\Software\PCTRunner]
       "installid"="REG_SZ", "{1B822A41-8719-4A9A-9D12-E37330521604}"
 
Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 9/11/2014
Scan Time: 3:54:55 PM
Logfile: mbamWebProtect.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.09.11.03
Rootkit Database: v2014.09.10.02
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Malwarebytes

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 265127
Time Elapsed: 3 min, 23 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 1
PUP.Optional.OSProtect.A, C:\Program Files\PCTRunner\MyOSProtect.exe, 2124, Delete-on-Reboot, [a3bcf0fc6b10d660e91a0bb146bba55b]

Modules: 9
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\freebl3.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\libnspr4.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\libplc4.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\libplds4.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\nss3.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\nssutil3.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\PCProxyDLL.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\smime3.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\WDCertInstaller.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], 

Registry Keys: 24
PUP.Optional.OSProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\MyOSProtect, Delete-on-Reboot, [a3bcf0fc6b10d660e91a0bb146bba55b], 
PUP.Optional.OSProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\pcwatch, Delete-on-Reboot, [4817608cf88373c3679b942829d8649c], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{3E4048A7-8F44-48DC-9163-16A4803F7826}, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{0C27B569-9410-406B-BA79-3EF654739236}, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4A55DCF1-2410-4139-A579-15DED320D84A}, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{632ACF93-7DAA-4CFD-8BB5-9DCBB9116176}, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{6DA234CD-4043-46C6-922F-A39529AE3D4B}, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{704C6F87-E9C5-44FE-B5AF-A84DB18AFB54}, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{C1F5E799-B218-4C32-B189-3C389BA140BB}, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{C64747EF-5093-48B3-A876-579B3A529C27}, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{E2179B6D-BB95-4004-8A51-B9E8FBE9FF24}, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{E3F16E3B-4C44-445B-8854-EB76DC059891}, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{F60C9408-3110-4C98-A139-ABE1EE1111DD}, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\wp-dcollect-tgu, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\PCTRunner, Delete-on-Reboot, [3d2210dc0873f83ea0250dec61a127d9], 
PUP.Optional.Downloader, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\PROTECTMONITOR, Quarantined, [bda213d9c3b878bea17d7eeb9b699e62], 
PUP.Optional.MyOSProtect.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\PCTRunner, Quarantined, [451acc2081fac27425a127d228da19e7], 

Registry Values: 1
PUP.Optional.Downloader, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\PROTECTMONITOR|ImagePath, C:\monitorsvc.exe, Quarantined, [bda213d9c3b878bea17d7eeb9b699e62]

Registry Data: 0
(No malicious items detected)

Folders: 1
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], 

Files: 33
PUP.Optional.OSProtect.A, C:\Program Files\PCTRunner\MyOSProtect.exe, Delete-on-Reboot, [a3bcf0fc6b10d660e91a0bb146bba55b], 
PUP.Optional.OSProtect.A, C:\Windows\System32\drivers\pcwatch.sys, Delete-on-Reboot, [4817608cf88373c3679b942829d8649c], 
PUP.Optional.OSProtect.A, C:\Users\Malwarebytes\Desktop\wp-dcollect-tgu.211.exe, Quarantined, [1d4220ccf08bce68eb18229a3fc2d42c], 
PUP.Optional.OSProtect.A, C:\Program Files\PCTRunner\pcwatch.sys, Quarantined, [de818c603e3d89ad5ba7dae21ce540c0], 
PUP.Optional.Monitor.A, C:\monitor.exe, Quarantined, [144bdf0ddba0a6909d259762f11120e0], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\MyOSProtect.tlb, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\freebl3.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\libnspr4.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\libplc4.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\libplds4.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\MyOSProtect.dll, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\MyOSProtect64.dll, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\nss3.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\nssckbi.dll, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\nssdbm3.dll, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\nssutil3.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\PCProxy.tlb, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\PCProxyDLL.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\pcwtc64f.sys, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\pcwtc64r.sys, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\postcollect.exe, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\precollect.exe, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\smime3.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\softokn3.dll, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\sqlite3.dll, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\ssl3.dll, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\uninstallhelper.exe, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\WDCertInstaller.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\wget.exe, Quarantined, [401fcc200c6fad899f242fcabd459e62], 
PUP.Optional.MyOSProtect.A, C:\Windows\Temp\MyOSProtect.log, Delete-on-Reboot, [c8970fdd86f51a1c9c2814e58f730cf4], 
PUP.Optional.MyOSProtect.A, C:\Windows\System32\MyOSProtectOff.ini, Quarantined, [fc63c22aea91d1652bd1a5559072f50b], 
PUP.Optional.MyOSProtect.A, C:\Windows\System32\MyOSProtect.ini, Quarantined, [421d8d5f4635162052abf1099e64936d], 
PUP.Optional.Downloader, C:\monitorsvc.exe, Quarantined, [bda213d9c3b878bea17d7eeb9b699e62], 

Physical Sectors: 0
(No malicious items detected)


(end)
 
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements

#2
Metallica
Posted 11 September 2014 - 08:33 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
The easiest way to remove unwanted items from your LSP stack is to restore the default settings for Windows.
Warning! This might however break other applications that use the LSP stack, like iTunes, some AV's and some firewalls.
If you are not sure about having legitimate items, post your log in the forum following the directions here
Go to Start -> Programs -> Accessories -> right click on the Command Prompt and choose Run as administrator.
Type netsh winsock reset catalog in the Command Prompt window, and then press the Enter key.
Restart the computer when prompted
After the reboot you can manually delete the associated files
Depending on whether you are running a 32-bit or 64-bit versions of Windows you may find and delete:
C:\Windows\System32\MyOSProtect64.dll
C:\Windows\SysWOW64\MyOSProtect64.dll
C:\Windows\SysWOW64\MyOSProtect.dll
c:\windows\system32\myosprotect.dll
  • 0
Back to Malware Removal Guides and Tutorials


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Malware Removal Guides and Tutorials

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.