SafetyKeeper
Last Updated on Friday, 15 January 2010 13:14 Friday, 11 September 2009 04:53
| SafetyKeeper is reported to be a rogue application. There are several ways a fake/rogue application may enter into your computer. 1) You may have downloaded it knowingly or unknowingly mistaking it to be something else.
If you happen to have the rogue installer, you can submit it to threatexpert site and get it analyzed. That will help you to get the precise information about the virus. |
FamilyI have categorized this rogue application as nsProcess.dll group. You can find information of other rogue applications belonging to this group on this link |
Website Info[safetykeeper.com] If you want to know Who owns this website, When was this website registered, Who is the ICANN registrar, Where is it Hosted etc then open this pageDo you feel like complaining to someone?If you have incurred financial losses due to or have any other grievance towards this website [safetykeeper.com] You can send a complaint to the ICANN Registrar of this website, eNom INC. Strangly eNom considers Spam as the only form of abuse that a website may commit. Anyway this is the web based form where you can report a website registered by them You can send a complaint to the Web Host of this website, "Serverconnect I Norrland" in Stockholm, Sweden. This page on their site is their contact form. |
Trying System RestoreIf you know the duration since your computer is infected, you can try to restore your computer at a prior date, that will work like a miracle in removing the infection
|
Free removal tools
|
Manual RemovalThese are the steps to be taken, if you want to or need to remove the infected files manually |
Boot in safe mode Sometimes you will not be able to delete a file even if you find it, in that case you should boot in safe mode and then try to delete it/ them.
|
Remove Processes from Task Manager Press Ctrl Shift Esc to open Task Manager. See in the list of the processes for a processe/s named "SafetyKeeper.exe" and another process with a random name, for example , these are the exe files added by this virus on a single computer, and all these names are semi-randomly generated. These files were found in C:\Windows folder. 10302sp51z19.exe select if found and press the End Process button, confirm and then close the Task Manager. There would also be a random exe file, you will have to use Windows Defender to see the path of a currently running program/ process and its publisher, so as to differentiate malware processes from processes belonging to legitimate publishers. You may find such processes listed under Unknown Publisher in Windows Defender.
Or you can use Sysinternal's Process Explorer for easy detection and removal of virus processes.
|
Removing entry from windows startup The system configuration can be started in xp and in vista by typing msconfig in the run box/ start menu search box. In xp by clicking on Start > run . The windows startup is reversible, therefore you can check / uncheck any entry from windows startup any number of times. After the system configuration window is open, Click on the Startup tab, that will list all the programs that are scheduled to start with windows. Expand the middle column using your mouse pointer so that you can see the full path of the program. Locate and uncheck "SafetyKeeper" and an exe file with a random name as listed above (look for any other suspicious names) Press Apply , Press Close/Ok , Select "Exit without restart" at the next prompt.
Disabling a Service This malware creates a windows service named SafetyKeeperSvc. While still in the windows configuration utility, click on the services tab. Hide All the Microsoft services by checking in the box, and then look for a name SafetyKeeperSvc, uncheck the box in front of its name if found, and the press Apply, press Ok, and restrat the computer at the next prompt. |
View Hidden Files Before you could delete SafetyKeeper and its associated files you need to search for them, and before doing that you need to enable to view hidden files and folders
|
Deleting files After restarting the computer, use the windows search utility to search for "SafetyKeeper. This search will find all its folders on the hard disk , delete the folders from the hard disk. C:\Program Files\SafetyKeeper SoftwareC:\Documents and Settings\All Users\Start Menu\Programs\SafetyKeeper Delete all the above folders if found. %Temp%\nsq2.tmp\nsProcess.dll C:\Windows\System32\ntvdm.exe (these two files seem to be common in this group) Adds files with semi-random names and extensions (.BIN, .CPL, .DLL, .OCX and .EXE) in the windows directory, These files are different in different installations. You can try to look manually in the windows directory for similar files. But you may not find the exact names as they are listed here or in any of the removal instructions. Please see the reports in the link given at the begining of this article for the filenames that this virus creates on an infected computer. |
Run CCleaner After deleting SafetyKeeper and its associated files , as there will be leftover entries in the windows regitry. CCleaner is a free temp files/registry cleaner, that will automatically clean the registry as well as remove the temp files . Click here to read more |
Edit Registry if you are comfortable in using the regedit command. You can search and delete keys mentioning "SafetyKeeper" ans SafetyKeeperSvc from the registry.You can find the registry modifications in any of the reports mentioned in the begining of this article.
|
More ProblemsIf you are unable to open Task Manager, registry editor, System Restore, Folder Options etc If the virus has disabled them. There are free tools and techniques to solve this problem. They are listed here. Tools for Windows XP Tools for Windows Vista Use the System File Checker If you want to make sure that the windows system files are not altered by the virus, and in case if they are altered then to repair them.
Unable to access security related sites It can happen if your Hosts file has been altered. To repair/ edit the hosts file. Login as administrator. open the following file in notepadC:\ WINDOWS \system32 \drivers \etc \hosts remove anything other than 127.0.0.1 Localhost, and save and close the file. Using Firewall Check your firewall for any suspicious communication from your computer to the internet and block it using firewall. |
| Reference of threatexpert reports with permission from ThreatExpert.com |
