Free virus removal tool for system protector (AKA security mechanic)

Written by Administrator | Saturday, 21 November 2009 03:27

System Protector is a fake program which is generally installed without your will on your system. The fake program will use a variety of methods to scare the user into purchasing their full version program that does not even exist.

system-protector

To remove System Protector AKA Security Mechanic

Download the free removal tool
Extract
Run
Click on the delete button

After running the patch, your homepage Internet Explorer becomes search.net-studio.org, done deliberately to erase all traces of then malware, BHOs (Browser Helper Object) are also deleted. You can always restore this setting in Internet Explorer options.

Files

%UserProfile%\Application Data\install.exe
%UserProfile%\Application Data\lsascs.exe
%UserProfile%\Application Data\shellex.dll
%UserProfile%\Application Data\Microsoft\windll32.exe
%UserProfile%\Application Data\SpyProtectorSC_Base_new.dat
%UserProfile%\Application Data\SpyProtectorSC_Config.ini
%UserProfile%\Start Menu\Programs\System Protector\Purchase License.url
%UserProfile%\Start Menu\Programs\System Protector\Support Page.url
%ProgramFiles%\System Protector
%system32%\spyprotector.cpl
%AppData%\lsascs.exe
%AppData%\Microsoft\windll32.exe
%AppData%\shellex.dll
%AppData%\SpyProtector\SC_Base_new.dat
%AppData%\SpyProtector\SC_Config.ini
%Programs%\Security Mechanic\Purchase License.ur
%Programs%\Security Mechanic\Security Mechanic.lnk
%Programs%\Security Mechanic\Support Page.url
%System%\spyprotector.cpl

Folder

%AppData%\SpyProtector
%Programs%\Security Mechanic
%ProgramFiles%\Security Mechanic

Registry

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\System Protector
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\System Protector
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{107A1D63-2EAA-4694-8ABA-EC209C630D83}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\System Protector
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\System Protector
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\lsascs.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Security Mechanic
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{107A1D63-2EAA-4694-8ABA-EC209C630D83}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{107A1D63-2EAA-4694-8ABA-EC209C630D83}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Security Mechanic
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Security Mechanic
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
- DisableTaskMgr=1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "System Protector"