SpyOnThis
SpyOnThis or also called as SpyOn This is a misleading application that will be promoted through counterfeit security web sites. SpyOnThis requires manual execution to be installed on the system so user must have a full knowledge of it. Rogue program such as this can easily deceive users and can undoubtedly make itself loaded via fake alerts. The alerts will detect non-existent virus and immediately advise to remove it by downloading a copy of SpyOnThis.
Screen Shot Image:
Damage Level: Medium
Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7
SpyOnThis Removal Procedures
SpyOnThis REMOVAL TOOL:
Efficient and complete removal of SpyOnThis can be provided by Malwarebytes Anti-Malware. Please download, install and scan. If downloading is blocked by a virus, use a clean computer and save it to a Disc or USB drive and execute the removal on infected machine.
MANUAL REMOVAL:
1. Unload any running SpyOnThis process by pressing Ctrl+Alt+Del on your keyboard. This will open Task Manager. Look for the following process and click “End Process”:
SpyOnThis.exe
2. If antivirus program Is installed, connect to Internet and update it to have the latest database and pattern files.
3. Thoroughly scan the computer and clean/delete all infected files. See lists of SpyOnThis associated files below.
4. Edit Windows registry and delete malicious entries as stated below. [how to edit registry]
5. Close registry editor, changes will be save automatically.
6. Remove SpyOnThis start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. System Configuration Utility will open. Go to Startup tab and uncheck the following Startup item(s):
SpyOnThis.exe
7. Click on Apply and reboot the computer for changes to take effect.
Additional Useful Tools
Kaspersky Bootable USB Flash Drive
A tool from Kaspersky will allow you to create a bootable virus scanner that can be run from any computer. This can be boot and run from media drives such as CD, DVD or USB Flash Drive. Download and follow the procedures here.
Technical Details and Additional Information:
If SpyOnThis is installed, a modification is performed both on Windows registry and system files. This process will allow the unwanted application to flood the computer with fake warning and virus detection. It also prompt to pay for the full version of the software ranging from $29.95 for single user up to the maximum of $104.95 for five users licenses.
Technical Details and Additional Information:
Malicious Files Added by SpyOnThis
%ProgramFiles%\SpyOnThis v2.0\SpyOnThis.exe
%ProgramFiles%\SpyOnThis v2.0\SpyOnThisMonitor.exe
%ProgramFiles%\SpyOnThis v2.0\unins000.exe
%ProgramFiles%\SpyOnThis v2.0\unins000.dat
%ProgramFiles%\SpyOnThis v2.0\paths.dat
%ProgramFiles%\SpyOnThis v2.0\settings.ini
%ProgramFiles%\SpyOnThis v2.0\immunization.xml
%ProgramFiles%\SpyOnThis v2.0\ignore.dat
%ProgramFiles%\SpyOnThis v2.0\defs.sbd
%ProgramFiles%\SpyOnThis v2.0\config.xml
SpyOnThis Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”SpyOnThisScanner” = “%ProgramFiles%\SpyOnThis v2.0\SpyOnThis.exe -m”