Free malware removal tool for KeepCop

Written by Administrator | Thursday, 26 November 2009 12:29

KeepCop is another fake Antivirus that install itself on your computer. Once installed, it tries to trick you into buying the full version because the one you have is just a shareware. It shows you fake alert, don’t worry about that; I’m sure the only malware in your system is KeepCop.

KeepCop

To remove KeepCop

Download this removal tool
Extract it
Launch
Click on the delete button

This virus will be removed from your system in less than a minute. Restart your computer when it’s finished.

After running the patch, your homepage Internet Explorer becomes search.net-studio.org, done deliberately to erase all traces of then malware, BHOs (Browser Helper Object) are also deleted. You can always restore this setting in Internet Explorer options.

Process

[RANDOM CHARCTERS].exe
KeepCop.exe

Files and folders of the malwar

%CommonStartMenu%\Programs\KeepCop
%CommonStartMenu%\Programs\KeepCop\1 KeepCop.lnk
%CommonStartMenu%\Programs\KeepCop\2 Homepage.lnk
%CommonStartMenu%\Programs\KeepCop\3 Uninstall.lnk
%CommonDesktop%\KeepCop.lnk
%Temp%\<random>.exe
%ProgramFiles%\KeepCop Software
%ProgramFiles%\KeepCop Software\KeepCop
%ProgramFiles%\KeepCop Software\KeepCop\KeepCop.exe
%ProgramFiles%\KeepCop Software\KeepCop\uninstall.exe
%WINDOWS%\105019pambotzde.ocx
%WINDOWS%\10527ziru9465.dll
%WINDOWS%\105z9ir12765.ocx
%WINDOWS%\system32\30059viruz4f9.cpl
%WINDOWS%\system32\30077vir5zf9.dll
%WINDOWS%\system32\302z0spam9ot5a3.exe

Registered dlls

10527ziru9465.dll
30077vir5zf9.dll

Registry keys and values created

HKEY_CURRENT_USER\Software\KeepCop
HKEY_LOCAL_MACHINE\SOFTWARE\KeepCop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KeepCop
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARCTERS].exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "KeepCop"