Once your computer is infected with this parasite, it will immediately displays security warnings, alerts and system scans stating that your computer is heavily infected. These warnings are all false and are only displayed to make you think your computer is truly infected and that it is necessary to buy the full version of the software to remove the so-called infections.

Make sure to not fall in this scam, if your computer is infected with Spy Protector, it is recommended to remove it immediately and to scan your system with a real security software.

Symptoms of infection

• The process lsascs.exe is running in your system
• The process windll32.exe is running in your system
• Slow computer performance
• Repeated security warnings, alerts and system scans
• Web sites that suddenly are shown on your desktop

Malicious web sites and urls:

1
2
3
4

spy-protector-pro.com
av-onlinescan.com
av-onlinescan.org
webscannertools.com

When the program is executed, it creates the following files:

1
2
3
4
5
6
7
8
9
10

%AllUsers%\ApplicationData\lsascs.exe
%AllUsers%\ApplicationData\Microsoft\windll32.exe
%AllUsers%\ApplicationData\shellex.dll
%AllUsers%\ApplicationData\SpyProtector\SC_Base_new.dat
%AllUsers%\ApplicationData\SpyProtector\SC_Config.ini
%AllUsers%\Desktop\Spy Protector.lnk
%ProgramFiles%\Spy Protector\Purchase License.url
%ProgramFiles%\Spy Protector\Spy Protector.lnk
%ProgramFiles%\Spy Protector\Support Page.url
C:\WINDOWS\system32\spyprotector.cpl

The program creates the following registry entries:

1
2
3
4
5

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Spy Protector
HKLM\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Spy Protector
HKCU\Software\Microsoft\Windows\CurrentVersion\SpyProtector
HKCU\Software\Microsoft\Internet Explorer\Main\startpage\
hxxp://www.spy-protector-pro.com/securitypage

How to remove Spy Protector (manual removal) ?

• Kill the running process lsascs.exe
• Kill the running process windll32.exe
• Unregister all the Spy Protector DLLs
• Delete all the Spy Protector files
• Delete all the Spy Protector registry entries

How to remove Spy Protector (automatic removal) ?

• Download and Install NoVirusThanks Malware Remover
• Update the database
• Click the button Scan
• Delete infected files

Once your computer is infected with this parasite, it will immediately displays security warnings, alerts and system scans stating that your computer is heavily infected. These warnings are all false and are only displayed to make you think your computer is truly infected and that it is necessary to buy the full version of the software to remove the so-called infections.

Make sure to not fall in this scam, if your computer is infected with Spy Protector, it is recommended to remove it immediately and to scan your system with a real security software.

Symptoms of infection

• The process srcss.exe is running in your system
• Slow computer performance
• Repeated security warnings, alerts and system scans
• Web sites that suddenly are shown on your desktop

Malicious web sites and urls:

1

spy-protector.org

When the program is executed, it creates the following files:

1
2
3
4
5
6
7
8
9
10
11
12

%ProgramFiles%\Spy Protector
%UserProfile%\Application Data\install.exe
%UserProfile%\Application Data\shellex.dll
%UserProfile%\Application Data\srcss.exe
%UserProfile%\Application Data\SpyProtector
%UserProfile%\Application Data\SpyProtector\SC_Base_new.dat
%UserProfile%\Application Data\SpyProtector\SC_Config.ini
%UserProfile%\Desktop\Spy Protector.lnk
%UserProfile%\Start Menu\Programs\Spy Protector
%UserProfile%\Start Menu\Programs\Spy Protector\Purchase License.url
%UserProfile%\Start Menu\Programs\Spy Protector\Spy Protector.lnk
%UserProfile%\Start Menu\Programs\Spy Protector\Support Page.url

The program creates the following registry entries:

1
2
3
4
5

HKCU\Software\Microsoft\Windows\CurrentVersion\SpyProtector
HKCR\*\shellex\ContextMenuHandlers\Spy Protector
HKCR\Directory\shellex\ContextMenuHandlers\Spy Protector
HKCR\Drive\shellex\ContextMenuHandlers\Spy Protector
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spy Protector

How to remove XPShield (manual removal) ?

• Kill all the Spy Protector processes
• Unregister all the Spy Protector DLLs
• Delete all the Spy Protector files
• Delete all the Spy Protector registry entries

How to remove Spy Protector (automatic removal) ?

• Download and Install NoVirusThanks Malware Remover
• Update the database
• Click the button Scan
• Delete infected files