Home Malware Programs Rogue Anti-Spyware Programs NeoProtect

NeoProtect

Posted: July 21, 2010

NeoProtect is a rogue antispyware program from the same family of rogues as ByeClean and MedicCop. Neo Protect redirects users to a fake scan page which reports bogus results claiming the system is infected. Soon the system wil be bombarded by false popup warnings urging the purchase of NeoProtect to remove the so-called threats. Do not fall for this trickery and have Neo Protect removed fromthe system immediately.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 C:\Documents and Settings\{username}\Local Settings\Temp\IFU1008.exe
    2 C:\Documents and Settings\{username}\Local Settings\Temporary Internet Files\Content.IE5\18GY3K5D\IFU1008[1].exe
    3 C:\Program Files\Common Files\neoprotect
    4 C:\Program Files\Common Files\neoprotect\neopuninst.exe
    5 C:\Program Files\InfoTab\InfoTab.dll
    6 C:\Program Files\JAinfo\iesearch.dll
    7 C:\Program Files\neoprotect
    8 C:\Program Files\neoprotect\InfoTab_IF91.exe
    9 C:\Program Files\neoprotect\neopai.ini
    10 C:\Program Files\neoprotect\neophk.dll
    11 C:\Program Files\neoprotect\NEOPInstRB2.exe
    12 C:\Program Files\neoprotect\neopli.ini
    13 C:\Program Files\neoprotect\neoprotect.exe
    14 C:\Program Files\neoprotect\neopsc.dat
    15 C:\Program Files\neoprotect\neopupdater.exe
    16 C:\Program Files\neoprotect\neopwcher.exe
    17 C:\Program Files\SMS1000
    18 C:\Program Files\SMS1000\SMS1000Main
    19 C:\Program Files\SMS1000\SMS1000Main\smsm.ico
    20 C:\Program Files\SMS1000\SMS1000Main\smsmupdater.exe
    21 C:\Program Files\SMS1000\SMS1000Main\smsmux.exe
    22 C:\Program Files\SMS1000\SMS1000Main\smsuux.exe
    23 C:\Program Files\SMS1000\SMS1000Main\uninst.exe
    24 C:\WINDOWS\system32\smsmalldel.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\SMS1000UpdateHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotifyHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotifyHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotifyHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{66d6d3c9-b007-421f-89ee-778ccaad1f45}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6cefa6c6-033f-4ae0-933f-d4ca81045c65}HKEY_LOCAL_MACHINE\SOFTWARE\SMS1000HKEY_LOCAL_MACHINE\SOFTWARE\neoprotectHKEY..\..\..\..{RegistryKeys}HKEY_CLASSES_ROOT\CLSID\{66d6d3c9-b007-421f-89ee-778ccaad1f45}HKEY_CLASSES_ROOT\CLSID\{6cefa6c6-033f-4ae0-933f-d4ca81045c65}HKEY_CLASSES_ROOT\Interface\{08c5a58c-68d0-4cf8-be4b-d6d7e060e28d}HKEY_CLASSES_ROOT\Interface\{f75e6bd7-9e08-4413-9feb-d9265fcae8a5}HKEY_CLASSES_ROOT\TypeLib\{4a327d46-fa44-436c-8433-6688074d331a}HKEY_CLASSES_ROOT\TypeLib\{77e5052e-532c-4900-b2bf-734a0f5d3aa7}HKEY_CLASSES_ROOT\iesearch.monHKEY_CLASSES_ROOT\notifywindow.notifyctlHKEY_CLASSES_ROOT\notifywindow.notifyctl.1ccessfully.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neoprotectHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sms1000HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sms1000updateHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}InfoTabsms1000

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to NeoProtect may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria .

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.