Monday, August 4, 2008

PyroAntiSpy - destroy your PC! New rogue from VirusProtect family

PyroAntiSpy 2.2 is a new scamware from one of the most dangerous rogue family (VirusProtect). PyroAntiSpy have new engine and use latest version of Zlob trojan to install itself on your computer and hijack browser homepage. Once executed, PyroAntiSpy will scan your machine and use false positives in order to frighten you into purchasing the full version of the program. Although PyroAntiSpy may appear to be undamaging, it is a security risk to your computer and it may actually expose you to more security threats by installing additional malware. We recomend to use Spyware Doctor + Antivirus to protect your PC from PyroAntiSpy.

PyroAntiSpy screenshots:




PyroAntiSpy removal tool:

PyroAntiSpy manual removal instructions:

Delete PyroAntiSpy files:

PyroAntiSpy 2.2.lnk
PyroAntiSpy.lnk
[Random Name].TMP
PyroAntiSpy 2.2 Website.lnk
Uninstall PyroAntiSpy 2.2.lnk
blacklist.txt
English.ini
msvcp71.dll
msvcr71.dll
PyroAntiSpy.exe
PyroAntiSpy.url
ref.dat
uninst.exe
Delete PyroAntiSpy registry entries:
HKEY_CLASSES_ROOT\CLSID\{1696AFC0-5194-4380-4EAD-1ABA5BCE1B57}
HKEY_CLASSES_ROOT\Interface\{0EF1C54E-C3B6-4BD4-BC03-B8C307A018E5}
HKEY_CLASSES_ROOT\Interface\{14B17A8E-B176-47A0-B6BC-4E1BA8228BD0}
HKEY_CLASSES_ROOT\Interface\{31115F60-D58E-42AF-89F0-E524A55427BA}
HKEY_CLASSES_ROOT\Interface\{38F560FD-646A-44B0-AD5E-3069D8ADC851}
HKEY_CLASSES_ROOT\Interface\{50229B5C-ED47-49EC-8959-F66758830C5C}
HKEY_CLASSES_ROOT\Interface\{5F0E78FA-C76B-49FB-88FC-61A7306C2FE1}
HKEY_CLASSES_ROOT\Interface\{6667E268-6334-4204-97DF-85F1D27D7CC9}
HKEY_CLASSES_ROOT\Interface\{6D1595CE-B92A-47C5-9CC3-AE11E5A9AAFA}
HKEY_CLASSES_ROOT\Interface\{844EC9CE-24A3-491A-A660-B8B7DF4766BA}
HKEY_CLASSES_ROOT\Interface\{A363B82A-1069-41EC-B185-188B59F504E6}
HKEY_CLASSES_ROOT\Interface\{BC760874-E3AC-4D05-969B-8FC28EB85252}
HKEY_CLASSES_ROOT\Interface\{C2194F32-D124-4956-8060-AE4696A78911}
HKEY_CLASSES_ROOT\Interface\{C783B30B-54CB-4745-AC2A-D41A4948C975}
HKEY_CLASSES_ROOT\Interface\{EE22CCD9-5D92-459B-B955-4115E6A1D0D7}
HKEY_CLASSES_ROOT\Interface\{F813DA8B-A263-450E-96AC-DB4BA5D55605}
HKEY_CLASSES_ROOT\Interface\{FF753266-C9EF-490C-85D0-A1A4C24FE8D2}
HKEY_CLASSES_ROOT\TypeLib\{12FCEB01-1FB2-486C-BBCB-7479300468F1}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\PyroAntiSpy.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PyroAntiSpy
HKEY_LOCAL_MACHINE\SOFTWARE\PyroAntiSpy

No comments: