Friday
2008-11-30, 00:01
The following instructions have been created to help you to get rid of "NiceSpy" manually.
Use this guide at your own risk; software should usually be better suited to remove malware, since it is able to look deeper.
If this guide was helpful to you, please consider donating towards this site (http://www.safer-networking.org/index.php?page=donate).
Threat Details:
Categories:
spyware
Description:
NiceSpy is a software which gets installed to spy on other computer users. The program runs in the background of windows and records all keytrokes, visited websites and used files.
Removal Instructions:
Desktop:
Please remove the following files from your desktop.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.
Shortcuts named "NiceViewer.lnk" and pointing to "<$PROGRAMFILES>\NiceSPY system expert\nsserver.exe".
Autorun:
Please use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd), RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer) or msconfig.exe to remove the following autorun entries.
Entries named "SystemService" and pointing to "<$PROGRAMFILES>\NiceSPY system expert\nsserver.exe".
Folders:
Please use Windows Explorer or another file manager of your choice to locate and delete these folders.
The directory at "<$PROGRAMFILES>\NiceSPY system expert".
The directory at "<$PROGRAMFILES>\NiceSPY system expert\images".
Make sure you set your file manager to display hidden and system files. If NiceSpy uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify folders!
Registry:
You can use regedit.exe (included in Windows) to locate and delete these registry entries.
Delete the registry key "{03418CC8-4835-495B-B872-712373FCB9E8}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{0DF4F2EA-BB82-4B39-B6B1-76380A2BD511}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{0EA6B21C-D079-4496-811B-F65F789584B6}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{61A97AB1-549D-4BE0-B996-95DAC5CF266F}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{64C7DBCC-AA2A-46DE-BEC2-D38BDC7DE2B2}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{6C36FAD9-05D1-4FEE-9801-C0D8DE072231}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{7CCEA6B7-9FA5-4943-97D2-10D023CF0861}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{82782BC8-FA2C-4BE4-BB97-EDBFBE5D7A96}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{8738B430-6CF3-4B27-86D3-6D3C5E70702A}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{8EA58D13-80D3-4D37-A348-6F54F221DBE6}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{93F6D1D2-E82D-446F-975A-8B2CEEE9AE9D}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{9E5E31A2-B318-452A-9383-B21393234F1D}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{A68D4F55-3A3F-4D36-97A6-E73DEF853DAC}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{AF027B74-640D-4DC9-A512-7B40AB718541}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{B4B8EFD3-E3F5-4CFB-A658-3EB23D3394F7}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{E4A124C5-02E1-4556-83E0-CBA6BCF69D98}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{E9EE4194-A178-4F1A-8374-3488B3839DD1}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{EBB60944-8D04-4293-93D7-8F9C92C7B0F2}" at "HKEY_CLASSES_ROOT\CLSID\".
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.AboutBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.AboutBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.AppMonitor", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.AppMonitor.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.AppMonitorBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.AppMonitorBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.ExplorerBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.ExplorerBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.FileMonitor", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.FileMonitor.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.FileMonitorBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.FileMonitorBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.KeyBoardMonitor", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.KeyBoardMonitor.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.KeyBoardMonitorBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.KeyBoardMonitorBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.LogonMonitor", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.LogonMonitor.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.LogonMonitorBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.LogonMonitorBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.RegisterBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.RegisterBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.ScreenMonitor", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.ScreenMonitor.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.ScreenMonitorBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.ScreenMonitorBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.SettingBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.SettingBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.TextInputMonitor", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.TextInputMonitor.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.TextInputMonitorBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.TextInputMonitorBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.WebMonitor", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.WebMonitor.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.WebMonitorBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.WebMonitorBox.1", plus associated values.
Delete the registry key "{A5F07B4C-3530-4982-80FE-261F8279DDC9}" at "HKEY_CLASSES_ROOT\TypeLib\".
If NiceSpy uses rootkit technologies, use our RegAlyzer (http://www.safer-networking.org/index.php?page=regalyzer), RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
Final Words:
If neither Spybot-S&D nor self help did resolve the issue or you would prefer one on one help,
Please read these instructions (http://forums.spybot.info/showthread.php?t=288) before requesting assistance,
Then start your own thread in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) where a volunteer analyst will advise you as soon as available.
Use this guide at your own risk; software should usually be better suited to remove malware, since it is able to look deeper.
If this guide was helpful to you, please consider donating towards this site (http://www.safer-networking.org/index.php?page=donate).
Threat Details:
Categories:
spyware
Description:
NiceSpy is a software which gets installed to spy on other computer users. The program runs in the background of windows and records all keytrokes, visited websites and used files.
Removal Instructions:
Desktop:
Please remove the following files from your desktop.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.
Shortcuts named "NiceViewer.lnk" and pointing to "<$PROGRAMFILES>\NiceSPY system expert\nsserver.exe".
Autorun:
Please use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd), RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer) or msconfig.exe to remove the following autorun entries.
Entries named "SystemService" and pointing to "<$PROGRAMFILES>\NiceSPY system expert\nsserver.exe".
Folders:
Please use Windows Explorer or another file manager of your choice to locate and delete these folders.
The directory at "<$PROGRAMFILES>\NiceSPY system expert".
The directory at "<$PROGRAMFILES>\NiceSPY system expert\images".
Make sure you set your file manager to display hidden and system files. If NiceSpy uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify folders!
Registry:
You can use regedit.exe (included in Windows) to locate and delete these registry entries.
Delete the registry key "{03418CC8-4835-495B-B872-712373FCB9E8}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{0DF4F2EA-BB82-4B39-B6B1-76380A2BD511}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{0EA6B21C-D079-4496-811B-F65F789584B6}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{61A97AB1-549D-4BE0-B996-95DAC5CF266F}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{64C7DBCC-AA2A-46DE-BEC2-D38BDC7DE2B2}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{6C36FAD9-05D1-4FEE-9801-C0D8DE072231}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{7CCEA6B7-9FA5-4943-97D2-10D023CF0861}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{82782BC8-FA2C-4BE4-BB97-EDBFBE5D7A96}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{8738B430-6CF3-4B27-86D3-6D3C5E70702A}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{8EA58D13-80D3-4D37-A348-6F54F221DBE6}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{93F6D1D2-E82D-446F-975A-8B2CEEE9AE9D}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{9E5E31A2-B318-452A-9383-B21393234F1D}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{A68D4F55-3A3F-4D36-97A6-E73DEF853DAC}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{AF027B74-640D-4DC9-A512-7B40AB718541}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{B4B8EFD3-E3F5-4CFB-A658-3EB23D3394F7}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{E4A124C5-02E1-4556-83E0-CBA6BCF69D98}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{E9EE4194-A178-4F1A-8374-3488B3839DD1}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{EBB60944-8D04-4293-93D7-8F9C92C7B0F2}" at "HKEY_CLASSES_ROOT\CLSID\".
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.AboutBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.AboutBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.AppMonitor", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.AppMonitor.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.AppMonitorBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.AppMonitorBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.ExplorerBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.ExplorerBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.FileMonitor", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.FileMonitor.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.FileMonitorBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.FileMonitorBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.KeyBoardMonitor", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.KeyBoardMonitor.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.KeyBoardMonitorBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.KeyBoardMonitorBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.LogonMonitor", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.LogonMonitor.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.LogonMonitorBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.LogonMonitorBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.RegisterBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.RegisterBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.ScreenMonitor", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.ScreenMonitor.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.ScreenMonitorBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.ScreenMonitorBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.SettingBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.SettingBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.TextInputMonitor", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.TextInputMonitor.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.TextInputMonitorBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.TextInputMonitorBox.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.WebMonitor", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.WebMonitor.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.WebMonitorBox", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "NiceSpyDll.WebMonitorBox.1", plus associated values.
Delete the registry key "{A5F07B4C-3530-4982-80FE-261F8279DDC9}" at "HKEY_CLASSES_ROOT\TypeLib\".
If NiceSpy uses rootkit technologies, use our RegAlyzer (http://www.safer-networking.org/index.php?page=regalyzer), RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
Final Words:
If neither Spybot-S&D nor self help did resolve the issue or you would prefer one on one help,
Please read these instructions (http://forums.spybot.info/showthread.php?t=288) before requesting assistance,
Then start your own thread in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) where a volunteer analyst will advise you as soon as available.