KB Home

Home / Virus / Spyware

Spyspotter is installed on your PCSpyspotter is a Rogue Security Software, it acts like real security software but will not reveal real threats and is a threat itself. For more information about Rogue Security Software, please follow this link: Rogue Security Software

In order to completely remove this you must do the following.

End the Processes
The two processes you need to end are:

spyspotter.exe
defender.exe

In order to end the process you will need to press: CTRL + ALT + DELETE or right-click on the Windows Taskbar and go to - Task Manager.
If you are using Windows XP this should bring up a dialogue box.

In this dialogue box you should see a few tabs: Applications / Processes / Performance / Networking.
Select the " Processes " Tab.
You will see a list of running processes, locate the two processes.
Select these processes by left-clicking the name of the process.
Now press " End Process " down the bottom right of the open dialogue box

Once you have ended both the above applications, we can now remove the Registry Values!!WARNING!!The registry is very sensitive to changes and tampering with it can cause your computer to stop functioning correctly or at all. To prevent this, please only remove the values we have listed. It is also suggested that you create a backup of your registry.!!END WARNING!!Opening the RegistryGo to Start > Run > then type in "regedit" - press EnterThis will open up the Registry EditorBacking up the RegistryIn the Editor, select File > Then ExportSave this to the desktop or whichever directory you wish.To retrieve this backup, select File > Then Import, select the backup you made.Deleting Registry ValuesTo delete these values, go to Edit > Then Find.Enter the given values and once found, select them and press delete.
HKEY_CLASSES_ROOT\CLSID\{5E022A40-7CC4-4EBA-A143-8D5C3B8838DB}
HKEY_CLASSES_ROOT\CLSID\{6C90276E-8EC4-4DED-B67D-061E92569E72}
HKEY_CLASSES_ROOT\CLSID\{804DB5C7-31E6-4885-850A-F1941B58A4C7}
HKEY_CLASSES_ROOT\CLSID\{AD2069F5-4ECD-48E0-A478-2D0E34D6DC32}
HKEY_CLASSES_ROOT\CLSID\{B2FC70C6-B39A-4D80-AC64-45BBFA82256F}
HKEY_CLASSES_ROOT\CLSID\{D240DC29-C093-4388-B71F-A7103C796B0C}
HKEY_CLASSES_ROOT\CLSID\{D7F152AA-2FE1-4CFA-9838-6782BF85C929}
HKEY_CLASSES_ROOT\CLSID\{D8CB10E7-601A-4176-B6B5-CEFA244D4DEA}
HKEY_CLASSES_ROOT\CLSID\{EE7FADF9-31DA-49AB-A026-EF9366CEB8B0}
HKEY_CLASSES_ROOT\Interface\{0CFC2012-205B-4E00-9417-35822237C52C}
HKEY_CLASSES_ROOT\Interface\{5EC4D98F-CCF4-47B0-8C92-45B764A602A6}
HKEY_CLASSES_ROOT\Interface\{E4A5B138-6BE5-4A0D-A5C3-D2DE4A62EBDC}
HKEY_CLASSES_ROOT\Typelib\{0AC17D72-80F3-4F79-BFCC-9A779BA70334}
HKEY_CLASSES_ROOT\Typelib\{828BC5D5-9C49-4DFD-B3C5-0436707DF5B3}
HKEY_CLASSES_ROOT\Typelib\{AEF5EB3E-0739-4A12-83F3-77249D80F63F}
HKEY_CLASSES_ROOT\Typelib\{B0DDF13B-2D10-472D-B409-F10476E9A12A}
HKEY_CLASSES_ROOT\Typelib\{BE7B3ED5-DD42-43AD-A444-DD08F3E45621}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{804DB5C7-31E6-4885-850A-F1941B58A4C7}
HKEY_CLASSES_ROOT\SOFTWARE\Microsoft\Windows\Currentversion\Explorer\Browser Helper Objects\{D240DC29-C093-4388-B71F-A7103C796B0C}
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser\{804DB5C7-31E6-4885-850A-F1941B58A4C7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Program Files\Common Files\Oem Common\bayesobj.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Program Files\Common Files\Oem Common\robj1.dll
HKEY_CURRENT_USER\Software\Oemji
Unregistering Attached DLL'sFirst off, go to Start > Search > For Files and Folders. You will need to find the locations of the files mentioned below.
In order to Unregister the DLL's you need to open Command Prompt. This can be done by going to Start > Run > Then type "cmd" - Press enter.
The Command Prompt window will appear, change the directory to exact DLL location path. Type the cd command (it is used to change the current directory), put a space and enter the full path (this is the part that looks like C:\Program Files\Spy Spotter) to the folder containing the DLLs, example: cd C:\Program Files\Spy Spotter. Press enter. This will change the current directory to that you have entered. To display directory contents use the dir command.
Within the exact directory type this command: regsvr32 /u [dll_name] and press enter.
The Dll's that you need to remove are:

oemjipls.dll
pbhelper.dll
robj1.dll
sfbnsp.dll

Once this is done you will need to delete the harmful files attached to SpySpotter

spyspotter.exe
defender.exe
spreg.dll
bayesobj.dll
oemjipls.dll
pbhelper.dll
robj1.dll

sfbnsp.dll

Once this is done make sure that you remove the Directories

C:\Program Files\SpySpotter[XVS]
C:\Program Files\Oemji
C:\Program Files\Common Files\Oem Common