Completely Remove Puper Spyware From Your Computer...continued

Next you need to make sure that all traces of Puper have been removed. The following instructions assume that for some reason sitRem and Adaware were not able to remove the infection from your computer. If they instruct you to terminate a process or delete a registry key that does not exist, don't worry. This is a good thing. If you don't need to edit the registry, that means that Puper has been removed. Do not make any alterations to the registry other than the ones you are instructed to make here.

To do this you must end the puper tasks. By design, the tasks are difficult to identify. First, press the "ctrl" + "alt" + "del" keys at the same time. The Task Manager window should now appear. Click on the "Processes" tab. Under Process Name, look for any of the tasks listed below in the list in your computer.

• popuper.exe
• intmonp.exe
• shnlog.exe
• nvctrl.exe

Next, click Start -> Run. Then type REGEDIT, and click OK. Navigate to and delete the following subkeys:

• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
• HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
• HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
• HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
• HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}\(Default) = ""
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}\(Default) = ""
• HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}\InprocServer32\(default) = %system%\hp.tmp
• HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}\InprocServer32\ThreadingModel = "Apartment"
• HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}\ProgID\(Default) = "VMHomepage.1"
• HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}\Programmable\(Default) = " "
• HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}\VersionIndependentProgID\{Default) = "VMHomepage"
• HKEY_LOCAL_MACHINE\Software\Classes\CLSID\VMHomepage\CurVer = "VMHomepage.1"
• HKEY_LOCAL_MACHINE\Software\Classes\CLSID\VMHomepage\CLSID = "{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}"
• HKEY_LOCAL_MACHINE\Software\Classes\CLSID\VMHomepage.1\CLSID = "{cf673b59-8e6f-4a0b-b1b9-3224d24f6800}"

Next, delete the following files and folders in Explorer if found:

• C:\WINDOWS\system32\wgwwwtuc.dll
• C:\Windows\System32\dxmpp.dll
• C:\WINDOWS\SYSTEM32\winrvc32.dll
• C:\Documents and Settings\tbaxter\My Documents\?ecurity\
• C:\Program Files\orrs\
• puper.dll
• hhk.dll
• msvol.tlb
• popuper.exe
• intmonp.exe
• shnlog.exe
• nvctrl.exe
• hp[xxxx].tmp

Now, just reboot your computer in normal mode, and you're done!