Jump to content

Removal instructions for Web Protect for Windows


Recommended Posts

  • Staff

What is Web Protect for Windows ?

 

The Malwarebytes research team has determined that Web Protect for Windows is adware. These adware applications display advertisements not originating from the sites you are browsing.

 

How do I know if my computer is affected by Web Protect for Windows ?

 

You may see this entry in your list of installed programs: 

 

warning4.png

 

How did Web Protect for Windows get on my computer?

 

Adware programs use different methods for distributing themselves. This particular one was bundled with other software.

 

How do I remove Web Protect for Windows ?

 

Please note that the preferred way to remove this adware is by using the provided uninstaller! (see screenshot above)

Then proceed with the instructions below.

 

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.

  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-version.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to the following:
    • Enable free trial of Malwarebytes Anti-Malware Premium
    • Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • If an update is found, you will be prompted to download and install the latest version.
  • Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
  • When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
  • Reboot your computer if prompted.
Is there anything else I need to do to get rid of Web Protect for Windows ?
  • If you were unable to use the uninstaller that came with Web Protect for Windows and you used Malwarebytes Anti-Malware to remove the potentially unwanted program, there will be a dll inserted in your LSP stack. This was not removed because that could possibly break your internet connection. Read the additional guide in the reply to this topic.
How would the full version of Malwarebytes Anti-Malware help protect me?

 

We hope our application and this guide have helped you eradicate this adware application.  

 

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Web Protect for Windows adware.  It would have warned you before the adware could install itself, giving you a chance to stop it before it became too late.

 

protection1.png

 

Technical details for experts

 

Signs in a HijackThis log:

 

O10 - Unknown file in Winsock LSP: c:\windows\system32\myosprotect.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\myosprotect.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\myosprotect.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\myosprotect.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\myosprotect.dllO23 - Service: MyOSProtect - MyOSCompany - C:\Program Files\PCTRunner\MyOSProtect.exeO23 - Service: Protect Monitor (ProtectMonitor) - Unknown owner - C:\monitorsvc.exe
 

Alterations made by the installer:

 

File system details  ---------------------------------------------    In the existing folder C:       Adds the file monitor.exe"="9/2/2014 9:55 PM, 487483 bytes, A       Adds the file monitorsvc.exe"="9/2/2014 9:55 PM, 34244 bytes, A    Adds the folder C:\Program Files\PCTRunner       Adds the file freebl3.dll"="8/30/2013 8:11 PM, 303104 bytes, A       Adds the file libnspr4.dll"="8/30/2013 8:11 PM, 295424 bytes, A       Adds the file libplc4.dll"="8/30/2013 8:11 PM, 48640 bytes, A       Adds the file libplds4.dll"="8/30/2013 8:11 PM, 46080 bytes, A       Adds the file MyOSProtect.dll"="9/1/2014 8:28 PM, 304776 bytes, A       Adds the file MyOSProtect.exe"="9/1/2014 8:26 PM, 1317096 bytes, A       Adds the file MyOSProtect.tlb"="9/1/2014 8:25 PM, 51112 bytes, A       Adds the file MyOSProtect64.dll"="9/1/2014 8:28 PM, 350768 bytes, A       Adds the file nss3.dll"="8/30/2013 8:11 PM, 854528 bytes, A       Adds the file nssckbi.dll"="8/30/2013 8:11 PM, 417280 bytes, A       Adds the file nssdbm3.dll"="8/30/2013 8:11 PM, 164352 bytes, A       Adds the file nssutil3.dll"="8/30/2013 8:11 PM, 135680 bytes, A       Adds the file PCProxy.tlb"="9/1/2014 8:25 PM, 51112 bytes, A       Adds the file PCProxyDLL.dll"="9/4/2014 1:24 AM, 827392 bytes, A       Adds the file pcwatch.sys"="9/1/2014 8:29 PM, 20480 bytes, A       Adds the file pcwtc64f.sys"="9/1/2014 8:29 PM, 24064 bytes, A       Adds the file pcwtc64r.sys"="9/1/2014 8:29 PM, 37376 bytes, A       Adds the file postcollect.exe"="9/10/2014 12:41 AM, 48756 bytes, A       Adds the file precollect.exe"="9/8/2014 6:21 PM, 46900 bytes, A       Adds the file smime3.dll"="8/30/2013 8:11 PM, 132608 bytes, A       Adds the file softokn3.dll"="8/30/2013 8:11 PM, 230400 bytes, A       Adds the file sqlite3.dll"="8/30/2013 8:11 PM, 455168 bytes, A       Adds the file ssl3.dll"="8/30/2013 8:11 PM, 228352 bytes, A       Adds the file uninstallhelper.exe"="9/10/2014 12:42 AM, 790860 bytes, A       Adds the file WDCertInstaller.dll"="9/1/2014 8:29 PM, 184216 bytes, A       Adds the file wget.exe"="3/11/2013 8:19 PM, 401408 bytes, A    In the existing folder C:\Windows\System32       Adds the file MyOSProtect.dll"="9/1/2014 8:28 PM, 304776 bytes, A       Adds the file MyOSProtect.ini"="9/11/2014 3:50 PM, 9640 bytes, A       Adds the file MyOSProtectOff.ini"="9/11/2014 3:50 PM, 2272 bytes, A    In the existing folder C:\Windows\System32\drivers       Adds the file pcwatch.sys"="9/1/2014 8:29 PM, 20480 bytes, ARegistry details  ------------------------------------------    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}]       "(Default)"="REG_SZ", "MyOSProtect"       "InstallingUser"="REG_SZ", "bQBiAGEAbQBwAGMAXABtAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAAAA=="       "KomodiaParameters1"="REG_DWORD", 0       "LaunchPermission"="REG_BINARY, ..L.\...0................................. ....... ...       "LocalService"="REG_SZ", "MyOSProtect"       "ServiceParameters"="REG_SZ", "-Service"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MyOSProtect.EXE]       "AppID"="REG_SZ", "{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06FD4518-2CAB-4473-AA8D-0508134C6C1F}]       "(Default)"="REG_SZ", "ReadOnlyManager Class"       "AppID"="REG_SZ", "{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06FD4518-2CAB-4473-AA8D-0508134C6C1F}\LocalServer32]       "(Default)"="REG_SZ", ""C:\Program Files\PCTRunner\MyOSProtect.exe""    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06FD4518-2CAB-4473-AA8D-0508134C6C1F}\ProgID]       "(Default)"="REG_SZ", "MyOSProtectLib.ReadOnlyManager.1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06FD4518-2CAB-4473-AA8D-0508134C6C1F}\Programmable]    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06FD4518-2CAB-4473-AA8D-0508134C6C1F}\TypeLib]       "(Default)"="REG_SZ", "{3E4048A7-8F44-48dc-9163-16A4803F7826}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06FD4518-2CAB-4473-AA8D-0508134C6C1F}\VersionIndependentProgID]       "(Default)"="REG_SZ", "MyOSProtectLib.ReadOnlyManager"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F101D36-9749-4730-AA02-F1F8BD1193EA}]       "(Default)"="REG_SZ", "DataContainer Class"       "AppID"="REG_SZ", "{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F101D36-9749-4730-AA02-F1F8BD1193EA}\LocalServer32]       "(Default)"="REG_SZ", ""C:\Program Files\PCTRunner\MyOSProtect.exe""    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F101D36-9749-4730-AA02-F1F8BD1193EA}\ProgID]       "(Default)"="REG_SZ", "MyOSProtectLib.DataContainer.1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F101D36-9749-4730-AA02-F1F8BD1193EA}\Programmable]    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F101D36-9749-4730-AA02-F1F8BD1193EA}\TypeLib]       "(Default)"="REG_SZ", "{3E4048A7-8F44-48dc-9163-16A4803F7826}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F101D36-9749-4730-AA02-F1F8BD1193EA}\VersionIndependentProgID]       "(Default)"="REG_SZ", "MyOSProtectLib.DataContainer"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}]       "(Default)"="REG_SZ", "DataTableFields Class"       "AppID"="REG_SZ", "{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}\LocalServer32]       "(Default)"="REG_SZ", ""C:\Program Files\PCTRunner\MyOSProtect.exe""    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}\ProgID]       "(Default)"="REG_SZ", "MyOSProtectLib.DataTableFields.1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}\Programmable]    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}\TypeLib]       "(Default)"="REG_SZ", "{3E4048A7-8F44-48dc-9163-16A4803F7826}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}\VersionIndependentProgID]       "(Default)"="REG_SZ", "MyOSProtectLib.DataTableFields"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A8D713-E25C-4c3f-AB27-44A4FEDD9328}]       "(Default)"="REG_SZ", "WatchDog Class"       "AppID"="REG_SZ", "{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A8D713-E25C-4c3f-AB27-44A4FEDD9328}\LocalServer32]       "(Default)"="REG_SZ", ""C:\Program Files\PCTRunner\MyOSProtect.exe""    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A8D713-E25C-4c3f-AB27-44A4FEDD9328}\ProgID]       "(Default)"="REG_SZ", "MyOSProtectLib.WatchDog.1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A8D713-E25C-4c3f-AB27-44A4FEDD9328}\Programmable]    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A8D713-E25C-4c3f-AB27-44A4FEDD9328}\TypeLib]       "(Default)"="REG_SZ", "{3E4048A7-8F44-48dc-9163-16A4803F7826}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59A8D713-E25C-4c3f-AB27-44A4FEDD9328}\VersionIndependentProgID]       "(Default)"="REG_SZ", "MyOSProtectLib.WatchDog"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{94B83936-77EA-4708-8FC5-F3BBC55C2A32}]       "(Default)"="REG_SZ", "LSPLogic Class"       "AppID"="REG_SZ", "{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{94B83936-77EA-4708-8FC5-F3BBC55C2A32}\LocalServer32]       "(Default)"="REG_SZ", ""C:\Program Files\PCTRunner\MyOSProtect.exe""    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{94B83936-77EA-4708-8FC5-F3BBC55C2A32}\ProgID]       "(Default)"="REG_SZ", "MyOSProtectLib.LSPLogic.1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{94B83936-77EA-4708-8FC5-F3BBC55C2A32}\Programmable]    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{94B83936-77EA-4708-8FC5-F3BBC55C2A32}\TypeLib]       "(Default)"="REG_SZ", "{3E4048A7-8F44-48dc-9163-16A4803F7826}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{94B83936-77EA-4708-8FC5-F3BBC55C2A32}\VersionIndependentProgID]       "(Default)"="REG_SZ", "MyOSProtectLib.LSPLogic"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DA5534ED-88FD-49fa-9D2D-B92584CB21AC}]       "(Default)"="REG_SZ", "DataTable Class"       "AppID"="REG_SZ", "{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DA5534ED-88FD-49fa-9D2D-B92584CB21AC}\LocalServer32]       "(Default)"="REG_SZ", ""C:\Program Files\PCTRunner\MyOSProtect.exe""    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DA5534ED-88FD-49fa-9D2D-B92584CB21AC}\ProgID]       "(Default)"="REG_SZ", "MyOSProtectLib.DataTable.1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DA5534ED-88FD-49fa-9D2D-B92584CB21AC}\Programmable]    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DA5534ED-88FD-49fa-9D2D-B92584CB21AC}\TypeLib]       "(Default)"="REG_SZ", "{3E4048A7-8F44-48dc-9163-16A4803F7826}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DA5534ED-88FD-49fa-9D2D-B92584CB21AC}\VersionIndependentProgID]       "(Default)"="REG_SZ", "MyOSProtectLib.DataTable"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE4EF20E-BC71-4a63-BC1E-C13B37815A00}]       "(Default)"="REG_SZ", "DataController Class"       "AppID"="REG_SZ", "{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE4EF20E-BC71-4a63-BC1E-C13B37815A00}\LocalServer32]       "(Default)"="REG_SZ", ""C:\Program Files\PCTRunner\MyOSProtect.exe""    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE4EF20E-BC71-4a63-BC1E-C13B37815A00}\ProgID]       "(Default)"="REG_SZ", "MyOSProtectLib.DataController.1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE4EF20E-BC71-4a63-BC1E-C13B37815A00}\Programmable]    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE4EF20E-BC71-4a63-BC1E-C13B37815A00}\TypeLib]       "(Default)"="REG_SZ", "{3E4048A7-8F44-48dc-9163-16A4803F7826}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE4EF20E-BC71-4a63-BC1E-C13B37815A00}\VersionIndependentProgID]       "(Default)"="REG_SZ", "MyOSProtectLib.DataController"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E3F32F05-71B6-44c5-8BEE-13D239E27E98}]       "(Default)"="REG_SZ", "DataTableHolder Class"       "AppID"="REG_SZ", "{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E3F32F05-71B6-44c5-8BEE-13D239E27E98}\LocalServer32]       "(Default)"="REG_SZ", ""C:\Program Files\PCTRunner\MyOSProtect.exe""    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E3F32F05-71B6-44c5-8BEE-13D239E27E98}\ProgID]       "(Default)"="REG_SZ", "MyOSProtectLib.DataTableHolder.1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E3F32F05-71B6-44c5-8BEE-13D239E27E98}\Programmable]    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E3F32F05-71B6-44c5-8BEE-13D239E27E98}\TypeLib]       "(Default)"="REG_SZ", "{3E4048A7-8F44-48dc-9163-16A4803F7826}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E3F32F05-71B6-44c5-8BEE-13D239E27E98}\VersionIndependentProgID]       "(Default)"="REG_SZ", "MyOSProtectLib.DataTableHolder"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataContainer]       "(Default)"="REG_SZ", "DataContainer Class"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataContainer\CLSID]       "(Default)"="REG_SZ", "{2F101D36-9749-4730-AA02-F1F8BD1193EA}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataContainer\CurVer]       "(Default)"="REG_SZ", "MyOSProtectLib.DataContainer.1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataContainer.1]       "(Default)"="REG_SZ", "DataContainer Class"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataContainer.1\CLSID]       "(Default)"="REG_SZ", "{2F101D36-9749-4730-AA02-F1F8BD1193EA}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataController]       "(Default)"="REG_SZ", "DataController Class"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataController\CLSID]       "(Default)"="REG_SZ", "{DE4EF20E-BC71-4a63-BC1E-C13B37815A00}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataController\CurVer]       "(Default)"="REG_SZ", "MyOSProtectLib.DataController.1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataController.1]       "(Default)"="REG_SZ", "DataController Class"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataController.1\CLSID]       "(Default)"="REG_SZ", "{DE4EF20E-BC71-4a63-BC1E-C13B37815A00}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTable]       "(Default)"="REG_SZ", "DataTable Class"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTable\CLSID]       "(Default)"="REG_SZ", "{DA5534ED-88FD-49fa-9D2D-B92584CB21AC}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTable\CurVer]       "(Default)"="REG_SZ", "MyOSProtectLib.DataTable.1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTable.1]       "(Default)"="REG_SZ", "DataTable Class"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTable.1\CLSID]       "(Default)"="REG_SZ", "{DA5534ED-88FD-49fa-9D2D-B92584CB21AC}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableFields]       "(Default)"="REG_SZ", "DataTableFields Class"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableFields\CLSID]       "(Default)"="REG_SZ", "{533403E2-6E21-4615-9E28-43F4E97E977B}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableFields\CurVer]       "(Default)"="REG_SZ", "MyOSProtectLib.DataTableFields.1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableFields.1]       "(Default)"="REG_SZ", "DataTableFields Class"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableFields.1\CLSID]       "(Default)"="REG_SZ", "{533403E2-6E21-4615-9E28-43F4E97E977B}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableHolder]       "(Default)"="REG_SZ", "DataTableHolder Class"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableHolder\CLSID]       "(Default)"="REG_SZ", "{E3F32F05-71B6-44c5-8BEE-13D239E27E98}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableHolder\CurVer]       "(Default)"="REG_SZ", "MyOSProtectLib.DataTableHolder.1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableHolder.1]       "(Default)"="REG_SZ", "DataTableHolder Class"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.DataTableHolder.1\CLSID]       "(Default)"="REG_SZ", "{E3F32F05-71B6-44c5-8BEE-13D239E27E98}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.LSPLogic]       "(Default)"="REG_SZ", "LSPLogic Class"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.LSPLogic\CLSID]       "(Default)"="REG_SZ", "{94B83936-77EA-4708-8FC5-F3BBC55C2A32}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.LSPLogic\CurVer]       "(Default)"="REG_SZ", "MyOSProtectLib.LSPLogic.1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.LSPLogic.1]       "(Default)"="REG_SZ", "LSPLogic Class"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.LSPLogic.1\CLSID]       "(Default)"="REG_SZ", "{94B83936-77EA-4708-8FC5-F3BBC55C2A32}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.ReadOnlyManager]       "(Default)"="REG_SZ", "ReadOnlyManager Class"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.ReadOnlyManager\CLSID]       "(Default)"="REG_SZ", "{06FD4518-2CAB-4473-AA8D-0508134C6C1F}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.ReadOnlyManager\CurVer]       "(Default)"="REG_SZ", "MyOSProtectLib.ReadOnlyManager.1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.ReadOnlyManager.1]       "(Default)"="REG_SZ", "ReadOnlyManager Class"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.ReadOnlyManager.1\CLSID]       "(Default)"="REG_SZ", "{06FD4518-2CAB-4473-AA8D-0508134C6C1F}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.WatchDog]       "(Default)"="REG_SZ", "WatchDog Class"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.WatchDog\CLSID]       "(Default)"="REG_SZ", "{59A8D713-E25C-4c3f-AB27-44A4FEDD9328}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.WatchDog\CurVer]       "(Default)"="REG_SZ", "MyOSProtectLib.WatchDog.1"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.WatchDog.1]       "(Default)"="REG_SZ", "WatchDog Class"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyOSProtectLib.WatchDog.1\CLSID]       "(Default)"="REG_SZ", "{59A8D713-E25C-4c3f-AB27-44A4FEDD9328}"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3E4048A7-8F44-48DC-9163-16A4803F7826}\1.0]       "(Default)"="REG_SZ", "MyOSProtect 1.0 Type Library"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3E4048A7-8F44-48DC-9163-16A4803F7826}\1.0\0\win32]       "(Default)"="REG_SZ", "C:\Program Files\PCTRunner\MyOSProtect.tlb"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3E4048A7-8F44-48DC-9163-16A4803F7826}\1.0\FLAGS]       "(Default)"="REG_SZ", "0"    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3E4048A7-8F44-48DC-9163-16A4803F7826}\1.0\HELPDIR]       "(Default)"="REG_SZ", "C:\Program Files\PCTRunner"    [HKEY_LOCAL_MACHINE\SOFTWARE\PCTRunner]       "(Default)"="REG_SZ", "installed"       "installdate"="REG_SZ", "2014-09-11"       "installid"="REG_SZ", "{1B822A41-8719-4A9A-9D12-E37330521604}"       "installtimestamp"="REG_SZ", "1410443405"       "mode"="REG_SZ", "1"       "partner"="REG_SZ", "tgu"       "product"="REG_SZ", "dc_bundle"       "softwaredomain"="REG_SZ", "www-content.com/dcollect.js"       "testgroup"="REG_SZ", ""       "version"="REG_SZ", "214"    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\pcwatch.sys]       "(Default)"="REG_SZ", "Driver"    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MyOSProtect]       "(Default)"="REG_SZ", "service"    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\pcwatch.sys]       "(Default)"="REG_SZ", "Driver"    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MyOSProtect]       "DependOnService"="REG_MULTI_SZ, "RPCSS "       "Description"="REG_SZ", "This service protects your computer from malicious websites and attacks while you are browsing the internet"       "DisplayName"="REG_SZ", "MyOSProtect"       "ErrorControl"="REG_DWORD", 1       "ImagePath"="REG_EXPAND_SZ, "C:\Program Files\PCTRunner\MyOSProtect.exe"       "ObjectName"="REG_SZ", "LocalSystem"       "Start"="REG_DWORD", 3       "Type"="REG_DWORD", 16    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\pcwatch]       "Data"="REG_BINARY, ..............)............................................>.....................       "DisplayName"="REG_SZ", "pcwatch service"       "ErrorControl"="REG_DWORD", 1       "ImagePath"="REG_EXPAND_SZ, "\??\C:\Windows\system32\Drivers\pcwatch.sys"       "Start"="REG_DWORD", 1       "Type"="REG_DWORD", 1    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\pcwatch\Enum]       "0"="REG_SZ", "Root\LEGACY_PCWATCH\0000"       "Count"="REG_DWORD", 1       "NextInstance"="REG_DWORD", 1    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ProtectMonitor]       "DisplayName"="REG_SZ", "Protect Monitor"       "ErrorControl"="REG_DWORD", 1       "ImagePath"="REG_EXPAND_SZ, "C:\monitorsvc.exe"       "ObjectName"="REG_SZ", "LocalSystem"       "Start"="REG_DWORD", 2       "Type"="REG_DWORD", 16    [HKEY_CURRENT_USER\Software\PCTRunner]       "installid"="REG_SZ", "{1B822A41-8719-4A9A-9D12-E37330521604}"
 

Malwarebytes Anti-Malware log:

 

Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 9/11/2014Scan Time: 3:54:55 PMLogfile: mbamWebProtect.txtAdministrator: YesVersion: 2.00.2.1012Malware Database: v2014.09.11.03Rootkit Database: v2014.09.10.02License: FreeMalware Protection: DisabledMalicious Website Protection: DisabledSelf-protection: DisabledOS: Windows 7 Service Pack 1CPU: x86File System: NTFSUser: MalwarebytesScan Type: Threat ScanResult: CompletedObjects Scanned: 265127Time Elapsed: 3 min, 23 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: DisabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 1PUP.Optional.OSProtect.A, C:\Program Files\PCTRunner\MyOSProtect.exe, 2124, Delete-on-Reboot, [a3bcf0fc6b10d660e91a0bb146bba55b]Modules: 9PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\freebl3.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\libnspr4.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\libplc4.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\libplds4.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\nss3.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\nssutil3.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\PCProxyDLL.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\smime3.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\WDCertInstaller.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], Registry Keys: 24PUP.Optional.OSProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\MyOSProtect, Delete-on-Reboot, [a3bcf0fc6b10d660e91a0bb146bba55b], PUP.Optional.OSProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\pcwatch, Delete-on-Reboot, [4817608cf88373c3679b942829d8649c], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{3E4048A7-8F44-48DC-9163-16A4803F7826}, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{0C27B569-9410-406B-BA79-3EF654739236}, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4A55DCF1-2410-4139-A579-15DED320D84A}, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{632ACF93-7DAA-4CFD-8BB5-9DCBB9116176}, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{6DA234CD-4043-46C6-922F-A39529AE3D4B}, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{704C6F87-E9C5-44FE-B5AF-A84DB18AFB54}, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{C1F5E799-B218-4C32-B189-3C389BA140BB}, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{C64747EF-5093-48B3-A876-579B3A529C27}, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{E2179B6D-BB95-4004-8A51-B9E8FBE9FF24}, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{E3F16E3B-4C44-445B-8854-EB76DC059891}, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{F60C9408-3110-4C98-A139-ABE1EE1111DD}, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\wp-dcollect-tgu, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, HKLM\SOFTWARE\PCTRunner, Delete-on-Reboot, [3d2210dc0873f83ea0250dec61a127d9], PUP.Optional.Downloader, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\PROTECTMONITOR, Quarantined, [bda213d9c3b878bea17d7eeb9b699e62], PUP.Optional.MyOSProtect.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\PCTRunner, Quarantined, [451acc2081fac27425a127d228da19e7], Registry Values: 1PUP.Optional.Downloader, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\PROTECTMONITOR|ImagePath, C:\monitorsvc.exe, Quarantined, [bda213d9c3b878bea17d7eeb9b699e62]Registry Data: 0(No malicious items detected)Folders: 1PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], Files: 33PUP.Optional.OSProtect.A, C:\Program Files\PCTRunner\MyOSProtect.exe, Delete-on-Reboot, [a3bcf0fc6b10d660e91a0bb146bba55b], PUP.Optional.OSProtect.A, C:\Windows\System32\drivers\pcwatch.sys, Delete-on-Reboot, [4817608cf88373c3679b942829d8649c], PUP.Optional.OSProtect.A, C:\Users\Malwarebytes\Desktop\wp-dcollect-tgu.211.exe, Quarantined, [1d4220ccf08bce68eb18229a3fc2d42c], PUP.Optional.OSProtect.A, C:\Program Files\PCTRunner\pcwatch.sys, Quarantined, [de818c603e3d89ad5ba7dae21ce540c0], PUP.Optional.Monitor.A, C:\monitor.exe, Quarantined, [144bdf0ddba0a6909d259762f11120e0], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\MyOSProtect.tlb, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\freebl3.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\libnspr4.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\libplc4.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\libplds4.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\MyOSProtect.dll, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\MyOSProtect64.dll, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\nss3.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\nssckbi.dll, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\nssdbm3.dll, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\nssutil3.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\PCProxy.tlb, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\PCProxyDLL.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\pcwtc64f.sys, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\pcwtc64r.sys, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\postcollect.exe, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\precollect.exe, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\smime3.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\softokn3.dll, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\sqlite3.dll, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\ssl3.dll, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\uninstallhelper.exe, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\WDCertInstaller.dll, Delete-on-Reboot, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Program Files\PCTRunner\wget.exe, Quarantined, [401fcc200c6fad899f242fcabd459e62], PUP.Optional.MyOSProtect.A, C:\Windows\Temp\MyOSProtect.log, Delete-on-Reboot, [c8970fdd86f51a1c9c2814e58f730cf4], PUP.Optional.MyOSProtect.A, C:\Windows\System32\MyOSProtectOff.ini, Quarantined, [fc63c22aea91d1652bd1a5559072f50b], PUP.Optional.MyOSProtect.A, C:\Windows\System32\MyOSProtect.ini, Quarantined, [421d8d5f4635162052abf1099e64936d], PUP.Optional.Downloader, C:\monitorsvc.exe, Quarantined, [bda213d9c3b878bea17d7eeb9b699e62], Physical Sectors: 0(No malicious items detected)(end)
 

As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.

We use different ways of protecting your computer(s):

  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
Link to post
Share on other sites

  • Staff

The easiest way to remove unwanted items from your LSP stack is to restore the default settings for Windows.

Warning! This might however break other applications that use the LSP stack, like iTunes, some AV's and some firewalls.

If you are not sure about having legitimate items, post your log in the forum following the directions here.

Go to Start -> Programs -> Accessories -> right click on the Command Prompt and choose Run as administrator.

Type netsh winsock reset catalog in the Command Prompt window, and then press the Enter key.

Restart the computer when prompted

After the reboot you can manually delete the associated files

Depending on whether you are running a 32-bit or 64-bit versions of Windows you may find and delete:

C:\Windows\System32\MyOSProtect64.dll

C:\Windows\SysWOW64\MyOSProtect64.dll

C:\Windows\SysWOW64\MyOSProtect.dll

c:\windows\system32\myosprotect.dll

Link to post
Share on other sites

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.