Do you know what Viruswebprotect.com is?

DESCRIPTION

Viruswebprotect.com is a browser hijacker that may render your web browser unusable by taking it over. Viruswebprotect.com is a dirty website that pushes fake anti-spyware software. Viruswebprotect.com displays annoying popups and alert messages on your computer stating that you are infected with spyware.

Type: Virus
Infection Length: 138,293 bytes
Systems Affected: Windows 95, 98, ME, NT (all versions), 2003, Windows XP (all service packs)
Systems Not Affected: DOS, EPOC, Linux, Macintosh, Novell Netware, OS/2, UNIX
Technical details: 1. Creates files in %Windir%\ directory. By default, this is C:\Windows.
2. Adds values to registry keys:
HKEY_LOCAL_MNACHINE\Software\Microsoft\Windows\CurrentVersion\Run
3. Scans the hard drive for .exe files and infects any executable files.
Searches for passwords/information, which it may send to a remote attacker.
Recomendations [SIC]: Click “OK” to download officially approved security software.
Always keep your patch levels up-to-date.

Non-techie terms: Viruswebprotect.com is installed onto your system through the Downloader.Affiliase Trojan. The Downloader.Affiliase Trojan is usually downloaded and installed through a video codec download or P2P website. Viruswebprotect.com and any associated website such as PureSafetyHere.com were created by hackers to take your hard earned money. Do not under any circumstances purchase Viruswebprotect.com or any programs advertised on PureSafetyHere.com.

Automatic Removal Instructions for Viruswebprotect.com

1. Download SmitFraudFix and Restart your computer into Safe Mode.
2. Open and run SmitFraudFix and allow it to clean your computer and registry from any infections.
3. Reboot your computer after the cleaning process has completed.

Manual Removal Instructions for Viruswebprotect.com

1. Uninstall Viruswebprotect.com Program
   Click on Start > Settings > Control Panel > Double-click on Add/Remove Programs. Search for and uninstall Viruswebprotect.com if found.
2. To stop Viruswebprotect.com processes (view process removal steps)
   Go to Start > Run > type taskmgr. The click the Processes tab and you’ll see a list of running processes.
   Search and stop these Viruswebprotect.com processes:
   regpowerclean.exe

   For each unwanted process, right-click on it and then select “End task”.

3. To Unregister Viruswebprotect.com DLLs (view DLL removal steps)
   Search and unregister these Viruswebprotect.com DLLs:
   WINLCTL4.DLL

   To locate the Viruswebprotect.com DLL path, go to Start > Search > All Files or Folders. Type Viruswebprotect.com and in the Look in: select either My Computer or Local Hard Drives. Click the Search button.
   Once you have the Viruswebprotect.com DLL path, go to Start and then click on Run. In the Run command box, type cmd, and then click on OK.
   To locate the exact DLL path, type cd in order to change the current directory. To display the contents of the directory, use the dir command. To remove the DLL file type regsvr32 /u FILENAME.dll (FILENAME is the name of the file that you want to unregister).

4. To unregister Viruswebprotect.com registry keys (view registry keys removal steps)
   Go to Start > Run > type regedit > press OK.
   Edit the value (on the right pane) by right-clicking on it and selecting the Modify option. Select the Delete option.
   Search and delete these Viruswebprotect.com registry keys:

   HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
   RegPowerClean=”%Program Files%\Winferno\Viruswebprotect.com\RegPowerClean.exe”
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IE Setup\DependentComponents\
   “RegPowerClean” = “5.0″
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\HTML Help\”RegPowerClean.chm
   46763EE0-CAB2-11CE-8C20-00AA0051E5D4
   0BE35203-8F91-11CE-9DE3-00AA004BB851
   0BE35204-8F91-11CE-9DE3-00AA004BB851
   000204EF-0000-0000-C000-000000000046
   HKEY_CLASSES_ROOT\TypeLib\{000204EF-0000-0000-C000-000000000046}\6.0\9\win32\”(Default)” = “%System%\msvbvm60.dll”
   HKEY_CLASSES_ROOT\TypeLib\{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}\6.0\9\win32\”(Default)” = “%System%\msvbvm60.dll\3″
   HKEY_CLASSES_ROOT\Applications\regpowerclean.exe
   HKEY_CURRENT_USER\Software\Winferno\RegPowerClean
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
   RegPowerClean2006_is1
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\
   %system%\WINCTL3.OCX
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\
   %system%\WINLCTL4.DLL
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\
   %system%\WINUTIL4.DLL
   HKEY_CLASSES_ROOT\WINCTL3.IObjectSubclass
   HKEY_CLASSES_ROOT\WINCTL3.XButton
   HKEY_CLASSES_ROOT\WINCTL3.XButtonEx
   HKEY_CLASSES_ROOT\WINCTL3.XButtonExWin
   HKEY_CLASSES_ROOT\WINCTL3.XEdit
   HKEY_CLASSES_ROOT\WINCTL3.XExplorerBar
   HKEY_CLASSES_ROOT\WINCTL3.XGrid
   HKEY_CLASSES_ROOT\WINCTL3.XTabStrip
   HKEY_CLASSES_ROOT\WINCTL3.cExplorerBar
   HKEY_CLASSES_ROOT\WINCTL3.cExplorerBarItem
   HKEY_CLASSES_ROOT\WINCTL3.cExplorerBarItems
   HKEY_CLASSES_ROOT\WINCTL3.cExplorerBars
   HKEY_CLASSES_ROOT\WINCTL3.cGridCell
   HKEY_CLASSES_ROOT\WINCTL3.cGridShellSortCells
   HKEY_CLASSES_ROOT\WINLCTL4.CCheck2WINLCTL1
   HKEY_CLASSES_ROOT\WINLCTL4.CIconsImageList2
   HKEY_CLASSES_ROOT\WINLCTL4.CIconsSystem2
   HKEY_CLASSES_ROOT\WINLCTL4.IObjectSubclass
   HKEY_CLASSES_ROOT\WINLCTL4.LProgressBar
   HKEY_CLASSES_ROOT\WINLCTL4.LProgressBar2
   HKEY_CLASSES_ROOT\WINLCTL4.LRichEdit
   HKEY_CLASSES_ROOT\WINLCTL4.LSplitter2
   HKEY_CLASSES_ROOT\WINLCTL4.LStatusBar
   HKEY_CLASSES_ROOT\WINLCTL4.LTimer
   HKEY_CLASSES_ROOT\WINLCTL4.LTooltip
   HKEY_CLASSES_ROOT\WINLCTL4.LTreeView
   HKEY_CLASSES_ROOT\WINUTIL4.CBrowseForFolder2
   HKEY_CLASSES_ROOT\WINUTIL4.CCheck2WINUTIL1
   HKEY_CLASSES_ROOT\WINUTIL4.CCommandLine
   HKEY_CLASSES_ROOT\WINUTIL4.CDataStructures3
   HKEY_CLASSES_ROOT\WINUTIL4.CDeploy2
   HKEY_CLASSES_ROOT\WINUTIL4.CEmailMessage
   HKEY_CLASSES_ROOT\WINUTIL4.CHTMLHelp
   HKEY_CLASSES_ROOT\WINUTIL4.CProcess
   HKEY_CLASSES_ROOT\WINUTIL4.CRegistry2
   HKEY_CLASSES_ROOT\WINUTIL4.CServicesFileIO2
   HKEY_CLASSES_ROOT\WINUTIL4.CServicesFileInfo2
   HKEY_CLASSES_ROOT\WINUTIL4.CServicesFileNames2
   HKEY_CLASSES_ROOT\WINUTIL4.CServicesFileTemporary2
   HKEY_CLASSES_ROOT\WINUTIL4.CServicesFileUtilities2
   HKEY_CLASSES_ROOT\WINUTIL4.CServicesInputOutput
   HKEY_CLASSES_ROOT\WINUTIL4.CServicesSpecialFolders2
   HKEY_CLASSES_ROOT\WINUTIL4.CVersion
   HKEY_CLASSES_ROOT\WINUTIL4.CWindowManager
   HKEY_CLASSES_ROOT\WINUTIL4.CXMLElement
   HKEY_CLASSES_ROOT\WINUTIL4.CXMLFile
   HKEY_CLASSES_ROOT\WINUTIL4.IObjectSubclass
   

5. If your homepage has been changed, go to Start > Control Panel > Internet Options > click on the General > click Use Default under Home Page. Add the your desired default homepage, then click Apply > click OK. Open a new web browser to check that you have your desired default homepage.
6. To remove Viruswebprotect.com icons on your Desktop, drag and drop them to the Recycle Bin.

Source: http://www.spyware-techie.com/viruswebprotectcom-removal-guide/