NeoProtect
NeoProtect is a rogue antispyware program from the same family of rogues as ByeClean and MedicCop. Neo Protect redirects users to a fake scan page which reports bogus results claiming the system is infected. Soon the system wil be bombarded by false popup warnings urging the purchase of NeoProtect to remove the so-called threats. Do not fall for this trickery and have Neo Protect removed fromthe system immediately.
File System Modifications
- The following files were created in the system:
# File Name 1 C:\Documents and Settings\{username}\Local Settings\Temp\IFU1008.exe 2 C:\Documents and Settings\{username}\Local Settings\Temporary Internet Files\Content.IE5\18GY3K5D\IFU1008[1].exe 3 C:\Program Files\Common Files\neoprotect 4 C:\Program Files\Common Files\neoprotect\neopuninst.exe 5 C:\Program Files\InfoTab\InfoTab.dll 6 C:\Program Files\JAinfo\iesearch.dll 7 C:\Program Files\neoprotect 8 C:\Program Files\neoprotect\InfoTab_IF91.exe 9 C:\Program Files\neoprotect\neopai.ini 10 C:\Program Files\neoprotect\neophk.dll 11 C:\Program Files\neoprotect\NEOPInstRB2.exe 12 C:\Program Files\neoprotect\neopli.ini 13 C:\Program Files\neoprotect\neoprotect.exe 14 C:\Program Files\neoprotect\neopsc.dat 15 C:\Program Files\neoprotect\neopupdater.exe 16 C:\Program Files\neoprotect\neopwcher.exe 17 C:\Program Files\SMS1000 18 C:\Program Files\SMS1000\SMS1000Main 19 C:\Program Files\SMS1000\SMS1000Main\smsm.ico 20 C:\Program Files\SMS1000\SMS1000Main\smsmupdater.exe 21 C:\Program Files\SMS1000\SMS1000Main\smsmux.exe 22 C:\Program Files\SMS1000\SMS1000Main\smsuux.exe 23 C:\Program Files\SMS1000\SMS1000Main\uninst.exe 24 C:\WINDOWS\system32\smsmalldel.exe
Registry Modifications
- The following newly produced Registry Values are:
HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\SMS1000UpdateHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotifyHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotifyHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotifyHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{66d6d3c9-b007-421f-89ee-778ccaad1f45}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6cefa6c6-033f-4ae0-933f-d4ca81045c65}HKEY_LOCAL_MACHINE\SOFTWARE\SMS1000HKEY_LOCAL_MACHINE\SOFTWARE\neoprotectHKEY..\..\..\..{RegistryKeys}HKEY_CLASSES_ROOT\CLSID\{66d6d3c9-b007-421f-89ee-778ccaad1f45}HKEY_CLASSES_ROOT\CLSID\{6cefa6c6-033f-4ae0-933f-d4ca81045c65}HKEY_CLASSES_ROOT\Interface\{08c5a58c-68d0-4cf8-be4b-d6d7e060e28d}HKEY_CLASSES_ROOT\Interface\{f75e6bd7-9e08-4413-9feb-d9265fcae8a5}HKEY_CLASSES_ROOT\TypeLib\{4a327d46-fa44-436c-8433-6688074d331a}HKEY_CLASSES_ROOT\TypeLib\{77e5052e-532c-4900-b2bf-734a0f5d3aa7}HKEY_CLASSES_ROOT\iesearch.monHKEY_CLASSES_ROOT\notifywindow.notifyctlHKEY_CLASSES_ROOT\notifywindow.notifyctl.1ccessfully.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neoprotectHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sms1000HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sms1000updateHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}InfoTabsms1000
Leave a Reply
Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter . If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.