SoftCop is a new rogue antispyware (fake antivirus) program from WiniGuard family as SoftSoldier. It is is distributed through the use of trojan. This trojan will install SoftCop and create a lot of harmless files with random names. When SoftCop is installed it will be set to start automatically when Windows loads. Once running, SoftCop will begin to scan your computer and list previously created files as infections to scare you into thinking that your computer is infected in order to trick you to buy the paid version of the software. All of these infections are fake, so you can safely ignore them!
SoftCop
While SoftCop is running your computer will show false security alerts and nag screens, that your computer is infected by spyware or being attacked by an Internet Virus. An example:
Spyware Alert!
Your computer is infected with spyware. It could damage your
critical files or expose your private data on the Internet. Click
here to register your copy of SoftCop and remove spyware
threats from your PC.
SoftCop also will show a fake Windows Security Center that will recommend you register the software. However, all of these alerts are a fake and like scan false results should be ignored! It is important to know that SoftCop is fake and does not offer any protection to computer! If your computer is infected with SoftCop, then use these removal instructions below, which will remove SoftCop and any other infections you may have on your computer for free.
More SoftCop screen shoots
Symptoms in a HijackThis Log
O4 – HKCU\..\Run: [aza4.tmp.exe] C:\WINDOWS\system32\aza4.tmp.exe
O4 – HKCU\..\Run: [SoftCop] C:\Program Files\SoftCop Software\SoftCop\SoftCop.exe -min
Use the following instructions to remove SoftCop (Uninstall instructions)
Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.
Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded you will see window similar to the one below.
Malwarebytes Anti-Malware Window
Select Perform Quick Scan, then click Scan, it will start scanning your computer for SoftCop infection. This procedure can take some time, so please be patient.
When the scan is complete, click OK, then Show Results to view the results. You will see a list of infected items similar as shown below. Note: list of infected items may be different than what is shown in the image below.
Malwarebytes Anti-malware, list of infected items
Make sure that everything is checked, and click Remove Selected for start SoftCop removal process. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
Note: if you need help with the instructions, then post your questions in our Spyware Removal forum.
SoftCop creates the following files and folders
C:\Program Files\SoftCop Software
C:\Program Files\SoftCop Software\SoftCop
C:\Documents and Settings\All Users\Start Menu\Programs\SoftCop
C:\WINDOWS\system32\aza4.tmp.exe
C:\Program Files\SoftCop Software\SoftCop\SoftCop.exe
C:\Program Files\SoftCop Software\SoftCop\uninstall.exe
C:\Documents and Settings\All Users\Start Menu\Programs\SoftCop\1 SoftCop.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\SoftCop\2 Homepage.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\SoftCop\3 Uninstall.lnk
C:\Documents and Settings\All Users\Desktop\SoftCop.lnk
SoftCop creates the following registry keys and values
HKEY_LOCAL_MACHINE\SOFTWARE\SoftCop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftCop
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aza4.tmp.exe
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SoftCop
I have softcop problems, but it was not installed. I just have this ‘Security Center Alert’ that keeps showing up.
I have Vista and it only showed in HKEY_LOCAL_MACHINE\SOFTWARE\SoftCop
I deleted it, restarted my computer, but I still have the softcop alert.
PLEASE HELP! HELP!
I was browsing a manga site, when my page minimized into a little fake warning window called Softcop and asked me to click okay. It was still Mozilla Firefox, but minimized and changed. I closed using the Task Manager, reloaded firefox and haven’t seen it yet. Do I have it, or have I narrowly avoided having it? Should I check and make sure just in case?
I also found out that there was ONLY registry entries to be deleted with the mentioned software. However I noticed a strange (something).tmp.exe file on taskmanager. Killed it and popups ended. I also had to delete registry entry for that file which kept running it on startup. If I remember it right it was in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ and the file was (something).tmp.exe
Hay, yes scan your computer with Malwarebytes Anti-malware.
In addition to the comment of Akula. The files to be removed are ccx35F.tmp.exe. let your computor search for this file and remove them all. Then the problem should be solved.
The file (ccx35F.tmp.exe) uses random names to hide itself. Malwarebytes should find and remote it.
Checked using Hijackthis for the listed results, didn;t find anything.
I used Malwarebytes. Did the scan, delete, and then restart. Then I checked again using Malwarebytes and it was gone, but Softcop still keeps on popping up! HElP Help!!! huhu.. T_T
And how do I find the files to delete; and where can I find the registry entries? Because when I use \
I installed Malwarebytes Anti-Malware and ran the scan and had it delete all the files found and rebooted. I still have the SoftCop popping up! What gives?????
autumn and emo, please ask for help in our Spyware removal forum.
autumn & emo, do you happen to have any processes running in your task manager which are named as (random letters).tmp.exe? If yes, kill it and see if it ends the popups.
In my case malwarebytes software didn’t really find anything when scanning this file directly, and it still was the very reason for softcop popups.
thanks for your article, its well done and great tips!
Akula,
your advice was definitely the most helpful and fixed my problem!! thank you so much
I used the malwarebytes to scan my computer and than erased the list of infections, searched for all the keys or files about softcop but didn’t find anything ( I guess it’s because I deleted softcop before ) but the biggest problem left may be the fake windows security center alert that always pop up!! Now, I have no idea if softcop still exists in my pc or it’s just the fake security alert… What should I do or download to remove the fake alert and/or the softcop? (sorry for my bad english!)
Also, there is always a sound like “don” that can be heard every 15 min after softcop infected my PC! Is it the malwarebyte or the fake security or the softcop that make this sound?
kurini, download HijackThis from here.
Run it.
Click “Do a system scan only” button.
Once finished, select a line that looks like below by placing a tick in the left hand check box.
Once you have selected it, close all running programs then click once on the “fix checked” button.
Reboot your computer.