Wednesday, January 21, 2009

Another rogue software

Spyware Protect 2009 is a new rogue software. It try to sell you the fake anti-virus or anti-spyware program. If you see these fake windows diaglog box, don't panic. Don't click them. Don't buy this rogue software.


If you launch browser, you may see this screen with URL address: browser-security.microsoft.com. The iehelper.dll make your browser alway go to this URL when you type any URL on the address.


Manual remove:
  1. Press ctrl alt del to bring the windows task manager
  2. Locate any process named sysguard under process tab, and end it.
  3. Using Windows Explorer or Command line to locate files: sysguard.exe (file size:266,240 bytes) and iehelper.dll (file size: 9,216 bytes). Note: Delete only these two files. Do not delete other.
  4. Remove the entry 91.207.117.224 browser-security.microsoft.com (the last line) from HOSTS file.
  5. Open RegEdit, locate and remove any entry related to sysguard.exe and iehelper.dll. Note: Be careful. Back up registry first and remove only bad entry add by fake ware: Spyware Protect 2009. Otherwise, you're screw up your computer. If you're not sure how to use RegEdit, ask someone to help
The Information is provided on an "as is" basis. I does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.

No comments: