Windows Vista Blog

A renamed version of the notorious rogue software Virus Doctor, My Security Wall acts in a similar fashion to its brother software by trying to trick users in to purchasing a software license. My Security Wall gets installed on a user’s system via Trojans that get downloaded from the internet and by fake websites that advertise free virus scanners. As soon as it is installed, this rogue software loads itself at boot time and creates a large number of harmless files on the computer’s hard disk, mainly in the Recent Files folder. It also generates false warnings saying that the computer is about to be hacked by an external host. My Security Wall also performs fake scans of the system, flagging the harmless files it created as dangerous software files. It also claims that the currently installed ‘trial’ version of My Security Wall is insufficient to remove the detected ‘threats’ and asks the user to purchase the ‘full’ version of the software. However, you should not pay for this software as its so-called ‘full’ version is just as incapable of scanning or cleaning your computer as the ‘trial’ version is.

In order to delete My Security Wall, you must stop its processes, unregister its DLL files, delete its files and folders and remove its registry entries.

File Removal Procedures

The first step you need to complete in order to delete My Security Wall is to stop the following processes:

• MS339.exe
• ppal.exe
• kernel32.exe

Next, it is necessary to unregister the following DLLs:

• tempdoc.dll
• mozcrt19.dll
• sqlite3.dll
• exec.dll

As the final step in file removal, the following files and folders should be deleted:

• C:\Documents and Settings\All Users\Application Data\117fc\MS339.exe
• c:\Documents and Settings\All Users\Application Data\MSEAIVCW
• c:\Documents and Settings\All Users\Application Data\MSEAIVCW\MSGWBQLMRPW.cfg
• c:\Documents and Settings\All Users\Application Data\117fc
• c:\Documents and Settings\All Users\Application Data\117fc\MSW.ico
• c:\Documents and Settings\All Users\Application Data\117fc\7463.mof
• c:\Documents and Settings\All Users\Application Data\117fc\mozcrt19.dll
• c:\Documents and Settings\All Users\Application Data\117fc\sqlite3.dll
• c:\Documents and Settings\All Users\Application Data\117fc\BackUp\Adobe Reader Speed Launch.lnk
• c:\Documents and Settings\All Users\Application Data\117fc\BackUp
• c:\Documents and Settings\All Users\Application Data\117fc\BackUp\Adobe Reader Synchronizer.lnk
• c:\Documents and Settings\All Users\Application Data\117fc\MSWSys
• c:\Documents and Settings\All Users\Application Data\117fc\MSWSys\vd952342.bd
• c:\Documents and Settings\All Users\Application Data\117fc\Quarantine Items
• %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\My Security Wall.lnk
• %UserProfile%\Application Data\My Security Wall
• %UserProfile%\Application Data\My Security Wall\cookies.sqlite
• %UserProfile%\Desktop\My Security Wall.lnk
• %UserProfile\Recent\ANTIGEN.tmp
• %UserProfile\Recent\dudl.sys
• %UserProfile\Recent\energy.drv
• %UserProfile\Recent\exec.dll
• %UserProfile\Recent\exec.drv
• %UserProfile\Recent\grid.drv
• %UserProfile\Recent\hymt.drv
• %UserProfile\Recent\kernel32.exe
• %UserProfile\Recent\pal.drv
• %UserProfile\Recent\PE.drv
• %UserProfile\Recent\ppal.exe
• %UserProfile\Recent\tempdoc.dll
• %UserProfile\Recent\tempdoc.drv
• %UserProfile\Recent\tjd.tmp
• %UserProfile%\Start Menu\My Security Wall.lnk
• %UserProfile%\Start Menu\Programs\My Security Wall.lnk
• c:\Program Files\Mozilla Firefox\searchplugins\search.xml

Once these steps have been completed, My Security Wall no longer resides on your hard disk. In order to make sure of this fact it is recommended to conduct a full system sweep using genuine security software such as Spyware Doctor with Antivirus as in most cases additional infections may still be present.

Registry Removal Procedures

Although you may have completed the above steps, My Security Wall has not yet been completely deleted. The following registry keys and settings inserted by My Security Wall should also be removed:

• HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes “URL” = “http://findgala.com/?&uid=7&q=searchTerms”
• HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes “URL” = “http://findgala.com/?&uid=7&q=searchTerms”
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “RunInvalidSignatures” = “1″
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform “Build/13.00007″
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “My Security Wall”
• HKEY_CLASSES_ROOT\Software\Microsoft\Internet Explorer\SearchScopes “URL” = “http://findgala.com/?&uid=7&q=searchTerms”
• HKEY_CLASSES_ROOT\xp_5f014.DocHostUIHandler

After you have completed the removal of these registry entries, your system is completely safe from My Security Wall.

Conclusion

It is not recommended for inexperienced users to attempt to delete My Security Wall manually, as any mistake made on your part could cause damage to your system. Rogue software like My Security Wall is designed to repair itself in case of improper removal. Inexperienced users are advised to use an online repair service such as www.onlinecomputerrepair.org or legitimate antivirus software to delete My Security Wall safely and efficiently.