Free malware removal tool for KeepCop

KeepCop is another fake Antivirus that install itself on your computer. Once installed, it tries to trick you into buying the full version because the one you have is just a shareware. It shows you fake alert, don’t worry about that; I’m sure the only malware in your system is KeepCop.

To remove KeepCop

• Download this removal tool
• Extract it
• Launch
• Click on the delete button

This virus will be removed from your system in less than a minute. Restart your computer when it’s finished.

After running the patch, your homepage Internet Explorer becomes search.net-studio.org, done deliberately to erase all traces of then malware, BHOs (Browser Helper Object) are also deleted. You can always restore this setting in Internet Explorer options.

Process

• [RANDOM CHARCTERS].exe
• KeepCop.exe

Files and folders of the malwar

• %CommonStartMenu%\Programs\KeepCop
• %CommonStartMenu%\Programs\KeepCop\1 KeepCop.lnk
• %CommonStartMenu%\Programs\KeepCop\2 Homepage.lnk
• %CommonStartMenu%\Programs\KeepCop\3 Uninstall.lnk
• %CommonDesktop%\KeepCop.lnk
• %Temp%\<random>.exe
• %ProgramFiles%\KeepCop Software
• %ProgramFiles%\KeepCop Software\KeepCop
• %ProgramFiles%\KeepCop Software\KeepCop\KeepCop.exe
• %ProgramFiles%\KeepCop Software\KeepCop\uninstall.exe
• %WINDOWS%\105019pambotzde.ocx
• %WINDOWS%\10527ziru9465.dll
• %WINDOWS%\105z9ir12765.ocx
• %WINDOWS%\system32\30059viruz4f9.cpl
• %WINDOWS%\system32\30077vir5zf9.dll
• %WINDOWS%\system32\302z0spam9ot5a3.exe

Registered dlls

• 10527ziru9465.dll
• 30077vir5zf9.dll

Registry keys and values created

• HKEY_CURRENT_USER\Software\KeepCop
• HKEY_LOCAL_MACHINE\SOFTWARE\KeepCop
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KeepCop
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARCTERS].exe"
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "KeepCop"