How to remove Spyware Protect 2009 (Delete instructions)

Spyware Protect 2009 is a rogue antispyware program that uses fake alerts and false positives to trick you into buying the fake antispyware. Spyware Protect 2009 uses Conficker worm and trojans (trojan Vundo for example) to install itself in your computer.

Once infected, your computer will display numerous fake system alerts or security alerts notifying you about supposed spyware infections. When installing, Spyware Protect 2009 configures itself to run automatically every time, when you start Windows. In addition the fake antispyware creates a few files with random names. These files during the scan will determine as trojans and spyware. Spyware Protect 2009 may drastically slow the performance of your computer.

Immediately after launch, the program starts scanning the computer and found a lot of trojans and spyware.

Spyware Protect 2009 (more screen shoots 1, 2, 3, 4)

Then, it said that you should purchase Spyware Protect 2009 in order to remove them and protect your PC. While the fake antispyware software is running your computer will display fake alerts.

Windows Security alert
Windows reports that computer is infected. Antivirus software
helps to protect your computer against viruses and other
security threats. Click here for the scan your computer. Your
system might be at risk now.

INFILTRATION ALERT

Your computer is being attacked by an Internet
Virus. It could be a password-stealing attack, a
trojan – dropper or simular.

DETAILS

Attack from: 100.53.148.153, port 42733
Attacked port: 14750
Threat: Win32/Nuqel.E

Do you want block this attack?

Please ignore these alerts. Use the free instructions below to remove the rogue antispyware and any associated malware from your computer.

Symptoms in a HijackThis Log.

O2 – BHO: BHO – {ABD42510-9B22-41cd-9DCD-8182A2D07C63} – C:\WINDOWS\system32\iehelper.dll
O4 – HKCU\..\Run: [system tool] C:\WINDOWS\sysguard.exe

Use the following instructions to remove Spyware Protect 2009 (Uninstall instructions).

Remove trojan TDSServ (Tidserv)

Some variants of Spyware Protect 2009 uses the trojan for infecting your computer and blocking access to security sites (For example, you can`t to download Malwarebytes Anti-malware).

Download Avenger from here and unzip to your desktop.

Run Avenger, copy,then paste the following text in Input script Box:

Drivers to delete:
TDSSserv.sys
msqpdxserv.sys
gaopdxserv.sys
gxvxcserv.sys
seneka
seneka.sys
ndisprot.sys
UACd.sys

You will see window similar to the one below.

Avenger

Click on ‘Execute’. You will be asked Are you sure you want to execute the current script?. Click Yes.

You will now be asked First step completed — The Avenger has been successfully set up to run on next boot. Reboot now?. Click Yes.

Your PC will now be rebooted.

Remove Spyware Protect 2009 and associated malware

Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.

Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

Once the program has loaded you will see window similar to the one below.

Malwarebytes Anti-Malware Window

Select “Perform Quick Scan”, then click Scan. The scan may take some time to finish,so please be patient.

When the scan is complete, click OK, then Show Results to view the results. You will see a list of infected items similar as shown below. Note: list of infected items may be different than what is shown in the image below.

Malwarebytes Anti-malware, list of infected items

Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.

Note: if you need help with the instructions, then post your questions in our Spyware Removal forum.

Spyware Protect 2009 creates the following files and folders

C:\WINDOWS\system32\iehelper.dll
C:\WINDOWS\sysguard.exe

Spyware Protect 2009 creates the following registry keys and values

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bbd4551a-9b23-41cd-9bcd-818aa2da7b63}
HKEY_CLASSES_ROOT\CLSID\{bbd4551a-9b23-41cd-9bcd-818aa2da7b63}
HKEY_CURRENT_USER\SOFTWARE\AvScan
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system tool