Macatte removal tool to get rid of macatte

False Antivirus are booming these days, not later than the day before yesterday, a new malware has appeared on the internet, he called macatte. The creators of these fake antivirus often accompany their creations in cracks or files downloaded from pirate sites. A file containing the virus is the crack of a software called Pro scan, the address of the infected file is http://rapidshare.com/files/137433710/ProScan_5.1.rar. This file weighs normally 1M and the rest are files of the virus.

There is also another file that is infected crack software "NTI Media Maker Premium v8 0 0 6366. This file may be downloaded via Limewire or torrent P2P network. Fortunately Limewire blocked file. Once clicked the infected files, your system will also be infected but the virus waits 5 to 10 minutes to show its presence by fake alarms. He warned you there are plenty of virus in your system. It also displays false attacks on your system by posting bogus.

There are also links on the Internet with one of these links is proscan5.info. Once you open that page, an image of a browser opens and you are bombarded with warnings like "Warning! Your PC is at risk of viruses and malware attack. Your system requires immediate check!” . Once you click OK, another message appears on the screen, this time is more serious. If ever you fell on its pages, do not touch anything, close your browser by pressing CTRL + ALT + DEL and end the process of your browser.
Despite all this, if ever cursed this virus is already present in your system, here is a small removal tool to easily remove this virus.

To remove the virus:

• Download this patch by clicking the download button below
• Unzip the file with Winrar
• Run the patch
• Click the delete button when it is finished, the patch keeps you informed
• Restart your system.

Everything should return to normal now.

Here are the details of the virus if you want to learn more about its operation.

Process

• mstdl.exe
• msc.exe
• temp.exe
• mcull.exe
• msc.exe
• u7[1].exe
• protector.exe
• start.exe
• new.exe
• uninstall.exe

DLL

• WPtect.dll

Files and folders

• %CommonAppData%\msca
• %CommonAppData%\msca\msca.ico
• %CommonAppData%\msca\mcull.exe
• %CommonAppData%\msca\msc.exe
• %CommonAppData%\msca\Viruses.dat
• %CommonAppData%\Microsoft\Media\WPtect.dll
  
  
• %CommonDesktop%\msca.lnk
• %CommoneStartMenu%\Programs\msca
• %CommoneStartMenu%\Programs\msca\msca.lnk
  
  
• [#Folder of your download]\temp.exe
• %TempInternetFiles%\Content.IE5\82EE5ZLE\u5[1].exe

Registry

• HKEY_CURRENT_USER\Software\msca
• HKEY_CURRENT_USER\Software\msca\imposs=02964
• HKEY_CURRENT_USER\Software\msca\Exename=%CommonAppData%\msca\protector.exe
• HKEY_CURRENT_USER\Software\msca\Sound=%CommonAppData%\msca\sound.wav
• HKEY_CURRENT_USER\Software\msca\Startup=%CommonAppData%\msca\start.exe
• HKEY_CURRENT_USER\Software\msca\New=%CommonAppData%\msca\new.exe
• HKEY_CURRENT_USER\Software\msca\Licensed=false
• HKEY_CURRENT_USER\Software\msca\boot=1
• HKEY_CURRENT_USER\Software\msca\complete_scan=true
  
  
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{459b6bf8-5320-4c41-8833-85baedf31086}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{459b6bf8-5320-4c41-8833-85baedf31086}\DefaultIcon
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{459b6bf8-5320-4c41-8833-85baedf31086}\Shell
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{459b6bf8-5320-4c41-8833-85baedf31086}\Shell\Open
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{459b6bf8-5320-4c41-8833-85baedf31086}\Shell\Open\Command
  
  
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A73890FC-177F-4198-AE3D-C64F7D9E69D8}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{459b6bf8-5320-4c41-8833-85baedf31086}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{459b6bf8-5320-4c41-8833-85baedf31086}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{459b6bf8-5320-4c41-8833-85baedf31086}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace\{459b6bf8-5320-4c41-8833-85baedf31086}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\msca=%CommonAppData%\msca\start.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\msca
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\msca\DisplayName=msca
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\msca\UninstallString=%CommonAppData%\msca\uninstall.exe
  
  
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPost=0
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect=0
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnonBadCertRecving=0

Attention

If ever your files are not identical to ours, you can always remove the virus with Windows Optimum, a tutorial on removing this virus will be available tomorrow, November 5, 2009.