Viruswebprotect.com Removal Process (remove Viruswebprotect.com)
March 8, 2008 – 10:01 amViruswebprotect.com is a recent browser hijacker that may take over certain functions of your web browser. Viruswebprotect.com sells and promotes rogue anti-spyware programs and you must stay away from this harmful website to prevent damage to your system. Viruswebprotect.com is a malicious website designed by hackers that displays annoying popups and system messages saying that you are infected with spyware as a scare tactic.
The following process will help you remove it from your system easily and safely.
Viruswebprotect.com Manual Removal Process:
1. Click on the Start Menu button, then click on the Control Panel option, and then Double-click on the Add or Remove Programs icon.
2. Locate Viruswebprotect.com and double-click on it to uninstall Viruswebprotect.com. Follow the screen step-by-step screen instructions to complete uninstallation of Viruswebprotect.com. Do not worry about this if you cannot find it in Add/Remove window. Simply skip to #5.
3. Restart the computer.
4. When it has completed uninstalling you can close Add or Remove Programs and your Control Panel.
5. Close all programs.
6. Search and delete the following infected entries in registry. If you do not know how to edit registry, click here to read more.
HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046}\6.0\9\win32\”(Default)” = “%System%\msvbvm60.dll”
HKEY_CLASSES_ROOT\TypeLib\{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}\6.0\9\win32\”(Default)” = “%System%\msvbvm60.dll\3″
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\HTML Help\”RegPowerClean.chm
46763EE0-CAB2-11CE-8C20-00AA0051E5D4
0BE35203-8F91-11CE-9DE3-00AA004BB851
0BE35204-8F91-11CE-9DE3-00AA004BB851
000204EF-0000-0000-C000-000000000046
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\
%system%\WINCTL3.OCX
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\
%system%\WINLCTL4.DLL
HKEY_CLASSES_ROOT\Applications\regpowerclean.exe
HKEY_CURRENT_USER\Software\Winferno\RegPowerClean
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
RegPowerClean2006_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\
%system%\WINUTIL4.DLL
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
RegPowerClean=”%Program Files%\Winferno\Viruswebprotect.com\RegPowerClean.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IE Setup\DependentComponents\
“RegPowerClean” = “5.0″
HKEY_CLASSES_ROOT\WINCTL3.IObjectSubclass
HKEY_CLASSES_ROOT\WINCTL3.XEdit
HKEY_CLASSES_ROOT\WINCTL3.XExplorerBar
HKEY_CLASSES_ROOT\WINCTL3.XGrid
HKEY_CLASSES_ROOT\WINCTL3.XTabStrip
HKEY_CLASSES_ROOT\WINCTL3.cExplorerBar
HKEY_CLASSES_ROOT\WINCTL3.XButton
HKEY_CLASSES_ROOT\WINCTL3.XButtonEx
HKEY_CLASSES_ROOT\WINCTL3.XButtonExWin
HKEY_CLASSES_ROOT\WINCTL3.cExplorerBars
HKEY_CLASSES_ROOT\WINCTL3.cGridCell
HKEY_CLASSES_ROOT\WINCTL3.cGridShellSortCells
HKEY_CLASSES_ROOT\WINCTL3.cExplorerBarItem
HKEY_CLASSES_ROOT\WINCTL3.cExplorerBarItems
HKEY_CLASSES_ROOT\WINLCTL4.IObjectSubclassHKEY_CLASSES_ROOT\WINLCTL4.LRichEdit
HKEY_CLASSES_ROOT\WINLCTL4.LSplitter2
HKEY_CLASSES_ROOT\WINLCTL4.LProgressBar
HKEY_CLASSES_ROOT\WINLCTL4.LProgressBar2
HKEY_CLASSES_ROOT\WINLCTL4.CCheck2WINLCTL1
HKEY_CLASSES_ROOT\WINLCTL4.CIconsImageList2
HKEY_CLASSES_ROOT\WINLCTL4.CIconsSystem2
HKEY_CLASSES_ROOT\WINLCTL4.LTreeView
HKEY_CLASSES_ROOT\WINUTIL4.CBrowseForFolder2
HKEY_CLASSES_ROOT\WINUTIL4.CCheck2WINUTIL1
HKEY_CLASSES_ROOT\WINUTIL4.CServicesInputOutput
HKEY_CLASSES_ROOT\WINUTIL4.CServicesSpecialFolders2
HKEY_CLASSES_ROOT\WINUTIL4.CCommandLine
HKEY_CLASSES_ROOT\WINUTIL4.CDataStructures3
HKEY_CLASSES_ROOT\WINUTIL4.CDeploy2
HKEY_CLASSES_ROOT\WINUTIL4.CEmailMessage
HKEY_CLASSES_ROOT\WINUTIL4.CXMLFile
HKEY_CLASSES_ROOT\WINUTIL4.IObjectSubclass
HKEY_CLASSES_ROOT\WINUTIL4.CHTMLHelp
HKEY_CLASSES_ROOT\WINUTIL4.CProcess
HKEY_CLASSES_ROOT\WINUTIL4.CRegistry2
HKEY_CLASSES_ROOT\WINUTIL4.CServicesFileIO2
HKEY_CLASSES_ROOT\WINUTIL4.CServicesFileInfo2
HKEY_CLASSES_ROOT\WINUTIL4.CServicesFileNames2
HKEY_CLASSES_ROOT\WINUTIL4.CServicesFileTemporary2
HKEY_CLASSES_ROOT\WINUTIL4.CServicesFileUtilities2
HKEY_CLASSES_ROOT\WINLCTL4.LStatusBar
HKEY_CLASSES_ROOT\WINLCTL4.LTimer
HKEY_CLASSES_ROOT\WINLCTL4.LTooltip
HKEY_CLASSES_ROOT\WINUTIL4.CVersion
HKEY_CLASSES_ROOT\WINUTIL4.CWindowManager
HKEY_CLASSES_ROOT\WINUTIL4.CXMLElement
7. Stop Viruswebprotect.com process. If you do not know how to stop a running process, click here to read more.
8. Find and delete the following infected files from your system. Don’t worry if you don’t find these files. Just proceed to next step.
WINLCTL4.DLL
If you do not know how to find it or having difficulties locating the file, click here to read more.
9. Rename the files that you found above to “foundbadfile1.dll” and “foundbadfile2.dll” (if you can not rename this file, then try to restart your computer in safe mode then try to rename this file.) If you don’t know how to start the computer in safe mode, click here to read more.
10. Go to C:\Program Files\ folder and delete the “Viruswebprotect.com” folder (if you can’t delete it, reboot your computer to safe mode then delete the folder. Do not worry about it if you can’t find this folder.)
11. Click here to bookmark this page (you will need to comeback to this page after reboot)
(If you are using Firefox click on Ctrl+D on your keyboard to bookmark this page)
12. Restart your computer
13. Go to your computer and delete the “foundbadfile1.dll” and “foundbadfile2.dll” file
14. You have just removed Viruswebprotect.com from your computer manually.
Remove Viruswebprotect.com with SmithfraudFix:
SmithfraudFix is a free tool that S!Ri created to remove fake anti-spyware programs. It can be risky so we cannot guarantee the result. Please use it with reservations. We would never recommend to purchase anything unless it’s necessary. That’s why we produce this free removal process.
1. Download SmithfraudFix tool and save it to your desktop.
2. Restart your computer and boot into Safe Mode. If you don’t know how to start the computer in safe mode, click here to read more.
3. Double-click on the SmithfraudFix.exe icon then follow the screen instructions. Option #2 should be selected in this case.
4. When you are prompted with “Do you want to clean the registry ?”, simply answer “Y”.
5. Reboot.
6. You should have removed Viruswebprotect.com from your computer. Sometimes it might take more than once to work properly. If SmithfraudFix removal tool does not work, which is in no-guarantee due to the nature of spyware, please refer to the manual removal steps above or purchase a legitimate removal tool if necessary.
(Disclaimers: These instructions are free and not guaranteed to work. Please use it at your own risks. We are not responsible for any damages.)
