EmailSpyMonitor Removal Process

December 23, 2007 – 9:41 pm

EmailSpyMonitor is a new email keylogger that engineered by Internet hackers. EmailSpyMonitor traces and tracks your emails, and put your privacy in great danger. Do remove EmailSpyMonitor immediately if your computer happens to be infected.

The following process will help you remove it from your system easily and safely.

EmailSpyMonitor Manual Removal Process:

1. Click on the Start Menu button, then click on the Control Panel option, and then Double-click on the Add or Remove Programs icon.

2. Locate EmailSpyMonitor and double-click on it to uninstall EmailSpyMonitor. Follow the screen step-by-step screen instructions to complete uninstallation of EmailSpyMonitor.

3. Restart the computer.

4. When it has completed uninstalling you can close Add or Remove Programs and your Control Panel.

5. Close all programs.

6. Stop EmailSpyMonitor process. If you do not know how to stop a running process, click here to read more.

pnsvre.exe
unins000.exe
unins000.dat
dpnsvre.exe
adsnwe.exe
vssvce.exe
vssvce.exe
adsnwe.exe
wineml.exe
wineml.exe
unins000.exe

7. Delete the following infected files from your system.

emlusr.ini
help.chm
emxfile007.dat
ps_demo_report.html
testftpok.html

If you do not know how to find it or having difficulties locating the file, click here to read more.

8. Rename the files that you found above to “foundbadfile1.dll” and “foundbadfile2.dll” (if you can not rename this file, then try to restart your computer in safe mode then try to rename this file.) If you don’t know how to start the computer in safe mode, click here to read more.

9. Go to C:\Program Files\ folder and delete the “IE Defender” folder (if you can’t delete it, reboot your computer to safe mode then delete the folder. Don’t worry about it if you can’t find it.)

10. Click here to bookmark this page (you will need to comeback to this page after reboot)
(If you are using Firefox click on Ctrl+D on your keyboard to bookmark this page)

11. Restart your computer

12. Search and delete the following infected entries in registry. If you do not know how to edit registry, click here to read more.

HKEY_CLASSES_ROOT\chilkat.emailbundle2.1\clsid
HKEY_CLASSES_ROOT\interface\{d56c1af1-3fde-471c-9bc2-c52515f260c1}
HKEY_CLASSES_ROOT\chilkat.mailman2.1\clsid
HKEY_CLASSES_ROOT\chilkatmail2.chilkatemail2
HKEY_CLASSES_ROOT\chilkat.email2
HKEY_CLASSES_ROOT\chilkat.emailbundle2.1
HKEY_CLASSES_ROOT\chilkatmail2.chilkatemailbundle2.1\clsid
HKEY_CLASSES_ROOT\chilkatmail2.chilkatmailman2
HKEY_CLASSES_ROOT\mapiprop.mapipropwrapper
HKEY_CLASSES_ROOT\chilkatmail2.chilkatemail2.1
HKEY_CLASSES_ROOT\interface\{5acae4b8-62d9-4124-a58a-9b1258b77e99}
HKEY_CLASSES_ROOT\interface\{7d37ded8-1945-4e42-a3fd-b9620e0ad8e3}
HKEY_CLASSES_ROOT\interface\{c4c23b78-db98-444c-b601-dcac6ebbec54}
HKEY_CLASSES_ROOT\interface\{ccb7fb40-99ec-4678-9202-52798da78aba}
HKEY_CLASSES_ROOT\interface\{d12fb216-99da-4eb3-9cc0-c0f760b174a0}
HKEY_CLASSES_ROOT\chilkat.mailman2
HKEY_CLASSES_ROOT\chilkat.mailman2.1
HKEY_CLASSES_ROOT\chilkatmail2.chilkatemailbundle2
HKEY_CLASSES_ROOT\chilkatmail2.chilkatemailbundle2.1
HKEY_CLASSES_ROOT\chilkatmail2.chilkatmailman2.1
HKEY_CLASSES_ROOT\chilkatmail2.chilkatmailman2.1\clsid
HKEY_CLASSES_ROOT\typelib\{1df3afed-99e0-4474-9900-954b8fd24e86}
HKEY_CLASSES_ROOT\typelib\{64debe33-c381-465b-a707-3f56c5b93470}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\email spy monitor_is1
HKEY_CLASSES_ROOT\interface\{06544919-f559-4ae5-9001-f903bd8a84e6}
HKEY_CLASSES_ROOT\interface\{51a0888c-9970-44de-8c2c-835ba870d06f}
HKEY_CLASSES_ROOT\chilkat.email2.1\clsid
HKEY_CLASSES_ROOT\chilkat.emailbundle2
HKEY_CLASSES_ROOT\clsid\{5883ca7c-b619-45c9-8e5d-dd6f7ea91785}
HKEY_CLASSES_ROOT\clsid\{a4643a87-99a0-4404-9bc5-2322bdd61637}
HKEY_CLASSES_ROOT\clsid\{a46e5261-9956-4767-88ca-dfced050d09e}
HKEY_CLASSES_ROOT\clsid\{a7ec2cd3-9941-4fd4-9d01-105dc16a4313}
HKEY_CLASSES_ROOT\chilkat.email2.1
HKEY_CLASSES_ROOT\chilkatmail2.chilkatemail2.1\clsid
HKEY_CLASSES_ROOT\interface\{e656b867-992c-4462-a27d-ebe604ec3a48}
HKEY_CLASSES_ROOT\interface\{fc279bc4-9e6e-4999-93e2-3ae39cce2927}

13. Restart your computer.

14. You have just removed EmailSpyMonitor from your computer manually.

Remove EmailSpyMonitor with SmithfraudFix:

SmithfraudFix is a free tool that S!Ri created to remove fake anti-spyware programs. It can be risky so we cannot guarantee the result. Please use it with reservations. We would never recommend to purchase anything unless it’s necessary. That’s why we produce this free removal process.

1. Download SmithfraudFix tool and save it to your desktop.

2. Restart your computer and boot into Safe Mode. If you don’t know how to start the computer in safe mode, click here to read more.

3. Double-click on the SmithfraudFix.exe icon then follow the screen instructions. Option #2 should be selected in this case.

4. When you are prompted with “Do you want to clean the registry ?”, simply answer “Y”.

5. Reboot.

6. You have just removed EmailSpyMonitor from your computer.

(Disclaimers: These instructions are free and not guaranteed to work. Please use it at your own risks. We are not responsible for any damages.)