AntiSpyCheck – yet another trojan

 

 Do you have noticed how many trojans with ‘Anti-’ names appeared nowdays? It seems to be the last trends among virus/trojans creators. They have masked their malware code as antivirus software with colorful GUI telling you have 345247827469726482246 trojans and viruses and have to hurry to their page and buy antivirus software which is the only one to clean your computer.    
 
Anti Spy Check Description:
Anti Spy Check, or AntiSpyCheck 2.4, is a fake antispyware and antivirus program that claims to be a spyware remover, popup blocker and trojans cleaner.

AntiSpyCheck program may install without your knowledge through a Trojan Zlob.

Trojan.Zlob is a back door Trojan. It allows the hacker to perform various malicious actions on the remote computer.

Trojan.Zlob usually is masked as a needed video codec in the form of ActiveX.

Here is a typical example of it:

 

Image taken from http://www.jahewi.nl/lists/fakecodecs/fakecodecs.html

 

Anti-SpyCheck usually pops up fake security alerts trying to make you buy their software.

How can you get rid of AntiSpyCheck?
The best spyware removal tactic is to uninstall Anti Spy Check  using the “Add/Remove Programs” from the Control Panel.

If there are still files remaining after reboot, follow the steps below: /Sistem Restore has to be disabled/

1. Run the Task Manager /“Alt+Ctrl+Del“, and “Task Manager” opens/ ! ‘+’ sign means to press three keys at once- the 3 fingers rule.

2. Find the following processes: ad-protect.exe and AntiSpyCheck.exe then select one by one and press the ‘End Process’ button.

3.  Find the files above using Search and delete them.

4.  Go to “Start” button and then click on “Run”.

5. In the Run  box  type “cmd“, and then click on “OK”  button

6. Type regsvr32 /u spamdet.dll and hit Enter. This will unregister the trojan .dll library.

7. Find and Delete spamdet.dll

8. Open registry editor /Start — Run — Regedt32/ then find and delete /if any/ the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ad-protect.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\spamdet.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9DA1990B-9BCA-4c80-AEFB-11A40FA849F9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{C628512D-A058-4BD4-B47B-B036F45FA02B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99A753C6-E429-46BD-989E-DD4A21CD059D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BBBD3E11-D201-46C9-8471-091D33159287}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2608046-DD09-A225-01BF-70C1EDD8B2E8}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2C1986A-FBEC-4472-AABF-6D42F08DBC8E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7ABE914-B8CF-4602-9145-6BDAAEDA21AA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3210E86-46A8-5973-963F-0EF4CF226A0C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{214345B8-BB69-498D-A168-29F58F15D806}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CF231820-9904-4A37-B5B0-C87EF6F6CC82}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D2C1986A-FBEC-4472-AABF-6D42F08DBC8E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F51BC478-D997-4C56-988D-79D9EEAAD1EC}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FD4DCB8B-C33A-4E70-A351-6FAB7E1071A4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{32BD20FD-41FD-47FB-9BC9-28DCBD7D55D7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5AA883DB-7CFD-4737-B3C3-C671595ECCE5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Addin
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Addin.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Server
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Server.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\spamdet.SpamDetector
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\spamdet.SpamDetector.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiSpyCheck.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiSpyCheck
HKEY_LOCAL_MACHINE\SOFTWARE\AntiSpyCheck
HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\Addins\Ad-Protect.Addin.1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\AntiSpyCheck  

 

After restarting the computer there will be no more annoying pop ups and slowdowns.

And one advice: there is no free lunch as you know, so when watching porn and it says wou have to download something to watch more – think first before click Yes, or better – Quickly RUN of the site without thinking!

How to close ports

When my computer becomes slow, I use to check connections established. In command prompt /Start button — Run —type  CMD — Enter/ I type command ‘netstat -a‘ and press enter.

It gives all the connections in my computer. Especcialy attention I pay to those marked as ESTABLISHED. Some of them are with my Skype friends or Internet sites I have connected.

 But if I close all the programs running /like Skype, IE, games, torrents, etc/ there are still some established connections with unknown sites in Germany, Russia, all over the world. Near them is written the port. It is known that malicious software uses higher ports number /bigger than 10000/ and ‘good’ programs use small numbered ports.

One way to close a port is to terminate the process /program/ that has opened it.  But if you don’t know the program or someone is using trojans to connect with you, the other way is to use a program to close those ports.

There are many programs for scanning and closing ports. I found this http://www.nirsoft.net/utils/cports.html an use it from time to time. It is free. I don’t know the autors but think it is a good program for non proffessionalists like me. If you have better programs in mind, please share their URL.

IE restrictions – how to open URL

In many schools, computer clubs and offices admins have set restrictions about using Internet explorer so people cannot browse the Internet.

Here is a simple method to open any URL:

Open any Windows program, for example calculator.exe.

Click F1 on keyboard to open the help menu.

Now click with right mouse button on titlebar.

jump to url

Click ‘Jump to URL…’ submenu.

In the new dialog window type your web address and the webpage is opened in the right part of the help.

Internet explorer cannot open the internet site. Operation aborted

I receive this error message many times a day as I browse the Internet. I use IE6.

I did not paid attention, just reloaded the page to solve problem.

Please see the next post with solution of the problem /edited./

Yesterday  I decided to search the web for similar problems.

I was surprised to find out that it is a Microsoft IE bug, they recognised this oh their page.

But on MS pagebug  is only description and advices for the  web developers how to avoid this on their pages using CSS and JavaScripts.  No single word about IE users – what causes the problem. 

I found many web pages commenting this problem. But there were same programming solutions for developers.

Even Google mail can cause this error message! You can check this  by visiting htpp://mail.google.com/mail/ . If you have my IE problem, the error message will appear.

The error message makes many people to change their browsers with FF.

This seems to be one of the worst MS bugs ever!

So for my great regret I have to say – NO solution for this problem for now. /edited/

Just wait for Microsoft to release some update for it.

Edit: see the next post with solution!

CD DVD disappear problem resolved

Many people had had this problem with optical devices: when look in MyComputer, the CD and DVD drives missing.

Instead of panic, here are two solutions:

1. Click on Start button  ->Run   and Type Regedit   then press enter.

The Registry editor is opened.

Some words about Windows Registry – this is a place when Windows ‘remembers’ all your settings so when you restart the computer they are exactly as you had set before. This way it remembers your desktop wallpaper, screensaver, screen resolution, taskbar and startmenu settings, mouse speed settings, which programs to run at startup and many many others things you have changed.

But Registry is a place when all the programs and hardware drivers installed write their settings too.

When CD or DVD registry settings are changed or removed by some progtam you have used, Windows cannot guess and do not shows in My Computer.

So if you are in the registry editor, work very carefully and watch not to delete some other program’s registries by mistake.

First, find the following: 

HKEY_LOCAL_MACHINE\SYSTEM \CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}  and delete it!

Then open Notepad and copy-paste this text:
REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}]
“UpperFilters”=-
“LowerFilters”=-

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdr4_2K]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdralw2k]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdudf]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UdfReadr]
Then save as CDrepair.reg  /be sure you choose ‘all files’ from Notepad dropdown when asked for file name and path./

If file is saved as .reg it has a green icon – this way you can tell it from text file if saved by mistake as .txt

Doubleclick on it . A dialog appears – click OK – because you want to import that values in registry.

That’s all. Restart and if you are lucky the, CD drives will be on their place.

 

 

2. If you don’t dare to play with registry, just take this program and run it. It does all that stuff instead you.

 

And one advice: clicking on unknoun or dubious .reg files is sometimes dangerous. So if you receive them by mail or Skype from strangers, better open first with Notepad to see what exactly are they doing. Otherwice you may harm your computer.

 

Start menu quick cleanup

My start menu is full with programs I do not use. It spreads over all the screen and goes out.

It is possible to delete unused programs with right mouse button –> delete but there is a faster way:

Go to C:\Documents and Settings\YourUserName\Start Menu\Programs

Here you can find the programs installed and delete those you don’t want to appear in start menu.

How to Remove Help and Support from Start Menu

I don’t like ‘Help and Support’ option in my Start menu as I often click it by mistake.

It is easy to remove it:

Right mouse button on Start button –> Properties.

The window “Taskbar and Start Menu Properties” appears. Choose “Start Menu” tab.

Click “Customize…” button.

Then “Advanced” tab.

In the list find “Help and Support” checkbox and uncheck it.

Click OK button and Voila! No help anymore!

Users Login

When I run my computer, a user image is displayed, so I need to click on it and login.

As I am the only user of this computer, I decided to remove it and be logged automatically after Windows starts.

Go to  Start –> Run (Win + R)

Then type “control userpasswords2“. Press OK button.

In User Accounts window you have to UnCheck “Users must enter a user name and password to use this computer“  box.

Then press Apply button.

In new window, enter account name and password /if any/ then click ОК.

Now you will be logged when Windows starts.

 

Security alerts

Every time I start Windows, a message in baloon pops up in taskbar. This is Microsoft Security Center alert. It reminds me that my computer may be in risk and I need to turn my firewall/antivirus protection on.

How to fire this alert:

Go to Control panel -> Secutity Center -> Change the way security center alerts me -> uncheck the box you want not to disturb you / firewall, automatic updates or virus protection./

 

Webpage view problem resolved

Yesterday I noticed that Yahoo page appeared bigger than usualy and half of the page went out of the screen so I had to scroll right to read.

First I thought it is a virus. Done a full system scan – no viruses or spyware found.

The interesting fact was the others pages looked normal.

I tried opening Yahoo on other computers – it looked absolutely normal.

Then I changed all possible monitor settings – nothing!

Finally, as usual, asked Google and voila – the solution is sooo simple.

I am feeling hitting my head on the wall.

There is a hotkey combination I knew before but have forgotten as I did not used it:

Hold down CTRL key while scrolling mouse wheel – the text size becomes bigger or smaller depending of direction you scrolling!

A simple resolving of that stupid problem!

Search bar repair

I had some spyware and after removing it, the Windows search bar /F3/ become blank. I could not type anything to search.

This was a big trouble for me as I have thousands of files in my computer and search for filename or file content many times a day.

After researching the Microsoft page, I found this program: Tweak UI

It is a wellknown software. I have read many times about it but never used as I didn’t had need to tweak my Windows.

The program is small and easy to use.

Here is a screenshot:

 

Expand ‘Explorer’ then check ‘Use Classic Search in Explorer’ checkbox.

This solved my search problem.

 

Task manager view problem

Today my Windows Task manager looked strange. It had no title bar, nor menus. It was so hard to work. I had to close it with ALT+F4.

I asked many people but no one could help me.

At the evening, decided to ask Google.

I love Google!!!

They have answers to every problem!

The Solution is so simple – just doubleclick on the beidje border over the window and voila – it returns its normal view.

Doublecklick again at side border and it goes in that ugly mode.

I will remember this trick forever.

Hope to was usefull.

 

 

Hello world!

Welcome to WordPress.com. This is your first post. Edit or delete it and start blogging!

- Start blogging!

As this is my first post, I want to begin with something funny.

I am in 9th class.

We have computing and ICT classes 4 times a week.

As sometimes they are booring, me and my friends love to play tricks with the teacher.

Here are some of recent jokes we ‘invented’:

• swapping mouse with keyboard inputs and reporting a problem with them.
• swapping mouse left/right buttons
• setting mouse speed to max so it is impossible to open anything by click
• before leaving, decrease monitor brightness so it becomes black and seems not working
• make a screenshot of the desktop and set it as wallpaper. Then hide the real icons  and look someone trying to click on the wallpaper’s icons.
• lock the keyboard with Functional keys.

Those are light jokes. We never intend to destroy something.

I respect my teacher and appreciate her sence of humor