Solution to ISPYVIRUS and Perfect Defender 2009

The "ISPYVIRUS" a creative, yet damaging piece of Malware has spread to your computer!!! You cannot access the Internet and the Virus is sending you to a fake "Perfect Defender" in hopes of getting you to shell out money for a defunct and phony solution. The REAL VIRUS:TROJAN DESTROYING Solution:

First , Do not put personal information in any of the data fields that pop-up. Similarly, click the X and close that incessant pop-up box that tells you to Enable your firewall. Ignore every single alert your computer is giving, and do not panic regarding your inactive Internet connection or inept virus scanner. Help is on the way.

Second, "Right-Click" the My computer tab. This is probably at the far-left of your DESKTOP. Immediately click the HARDWARE tab.

Third, Go to the DEVICE MANAGER icon, and click "SHOW HIDDEN DEVICES", while doing so, SCROLL down to non-Plug and Play drivers------------and make sure you click the little + icon to expand your selections.

Fourth, As you see a list of Drivers, make sure you signal out the "TDSSserv.sys" driver and DISABLE that bad boy by CLICKING on it. CLICK YES to confirm your actions, and to get rid of this nasty bug of a VIRUS!!!

Fifth reboot your Computer.

Sixth, Download the VIRUS REMOVER HERE

(YES YOUR INTERNET SHOULD BE WORKING)

Seventh, Install the file linked in Step 6, and if you have a Virus Scanner working in the background (it is probably your home scanner) let it do its work. It will not find everything that Malwarebytes will, but it will set the stage by deleting the annoying pop-up. Just because this Pop-UP is gone, does not mean your computer is clean.

Eight: Make sure you click on "CHECK FOR UPDATES" after you install the above program "MalawareBytes"!!!! Install the Updates, then after it is done. CLICK SCAN the Computer, under "SCANNER" tab. After the scan is finished, CLICK "SHOW THE RESULTS," ---It will look like this:

Files Infected:

C:\WINDOWS\system32\drivers\svchost.exe (Trojan.Agent) -> Delete on reboot.

C:\WINDOWS\system32\TDSSlxwp.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Madcap\Local Settings\Temp\TDSSe3b9.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Madcap\Local Settings\Temp\TDSSe3c8.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\winlogon.old (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\TDSStkdu.log (Trojan.TDSS) -> Quarantined and deleted successfully.

Registry Keys Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Somefox (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\MSFox (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nah_Shell (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HPseti (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Madcap\nah_gbyb.exe (Trojan.Agent)

Nine: REBOOT YOUR SYSTEM, Case Closed

Topcap, signing off. Thanks Malwarebytes.