Security Alert: Adware.GoonSquad

Adware.GoonSquad is an Adware infection which modifies your web search results. It creates the following files on infected systems:

  • C:\Documents and Settings\All Users\Application Data\bProtector\protector.dll
  • C:\Windows 32\System%\protector.dll

In addition to creating these files, it also creates the following registry entries:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\”AppInit_DLLs” = “%System%\protector.dll”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\”AppInit_DLLs” = “C:\Documents and Settings\All Users\Application Data\bProtector\protector.dll”
  • HKEY_CURRENT_USER\Software\bProtector

Finding these files and these registry settings is an indication that you are infected with this Adware. Before removing the infection, backup your registry following the steps here: https://www.windows-secrets.co.uk/backing-up-registry/

  1. Press [Windows Key] + [R], type REGEDIT and click OK.
  2. Navigate to the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
  3. Delete the registry entry: AppInit_DLLs = “%System%\protector.dll”
  4. Navigate to the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
  5. Delete the registry entry: AppInit_DLLs = “C:\Documents and Settings\All Users\Application Data\bProtector\protector.dll”
  6. Delete the registry key: HKEY_CURRENT_USER\Software\bProtector
  7. Exit the Registry Editor.

RELATED ARTICLES:

  • No Related Articles Found
Print This Post Print This Post