System Protector is a rogue antispyware program that uses fake alerts and false positives to trick you into buying the rogue and installed itself without your permission, through the use trojans. Once infected with these trojans your computer will display large amount of fake security alerts that tells you that your computer is infected and you should download and install System Protector in order to protect your computer.
During installation, System Protector configures itself to run automatically every time, when you start your computer. Once running, System Protector will scan your computer and reports false or exaggerated system security threats on the PC to trick you to buy the paid version of the program.
While System Protector is running your computer will display fake security alerts stating that your computer is infected. All these alerts should be ignored, use the free instructions below for removing the System Protector and any associated malware from your computer.
Symptoms in a HijackThis Log
O4 – HKLM\..\Run: [System Protector] %UserProfile%\Application Data\lsascs.exe
Use the following instructions to remove System Protector (Removal instructions)
Download Avenger from here and unzip to your desktop.
Run Avenger, copy,then paste the following text in Input script Box:
Registry values to delete:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | System Protector
Files to delete:
%UserProfile%\Application Data\lsascs.exe
You will see window similar to the one below.
Avenger
Click on ‘Execute’. You will be asked Are you sure you want to execute the current script?. Click Yes.
You will now be asked First step completed — The Avenger has been successfully set up to run on next boot. Reboot now?. Click Yes.
Your PC will now be rebooted.
Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.
Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded you will see window similar to the one below.
Malwarebytes Anti-Malware Window
Select “Perform Quick Scan”, then click Scan. The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results. You will see a list of infected items similar as shown below. Note: list of infected items may be different than what is shown in the image below.
Malwarebytes Anti-malware, list of infected items
Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
Note: if you need help with the instructions, then post your questions in our Spyware Removal forum.
System Protector creates the following files and folders
%UserProfile%\Application Data\spyprotector
C:\Program Files\System Protector
%UserProfile%\Start Menu\Programs\System Protector
%UserProfile%\Application Data\shellex.dll
%UserProfile%\Application Data\spyprotector\SC_Base_new.dat
%UserProfile%\Application Data\spyprotector\SC_Config.ini
%UserProfile%\Start Menu\Programs\System Protector\Purchase License.url
%UserProfile%\Start Menu\Programs\System Protector\Support Page.url
%UserProfile%\Start Menu\Programs\System Protector\System Protector.lnk
%UserProfile%\Desktop\System Protector.lnk
%UserProfile%\Application Data\Microsoft\windll32.exe
%UserProfile%\Application Data\lsascs.exe
C:\WINDOWS\system32\spyprotector.cpl
System Protector creates the following registry keys and values
HKEY_CLASSES_ROOT\CLSID\{107a1d63-2eaa-4694-8aba-ec209c630d83}
HKEY_CLASSES_ROOT\Drive\shellex\ContextMenuHandlers\System Protector
HKEY_CLASSES_ROOT\Directory\shellex\ContextMenuHandlers\System Protector
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\lsascs.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{107a1d63-2eaa-4694-8aba-ec209c630d83}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system protector
