How to Remove SoftCop | SoftCop Removal Guide
SoftCop seems to be another rogue antivirus entry in the quite prolific Wini family which includes such rogues as the recent Softsoldier (How to remove SoftSoldier), ( TrustFighter TrustFighter Removal Guide, TrustSoldier removal guide and the following others… SafeFighter (Safefighter Removal), TrustCop (TrustCop Removal Guide), SecureWarrior (SecureWarrior Removal), SecurityFighter (SecurityFighter Removal), SecuritySoldier (SecuritySoldier Removal) and it also has gone under other names. As I’ve noted before they seem to be busy bees at least in the rogue antivirus naming area, they have recycled the look and feel of their product (exception to be written up in a few minutes…) Read on for information on how to remove softcop.
This rogue is installed view attack sites that pose as online virus scans. Most all are really nothing more than a video image of a scan (every visitor sees the same regardless of browser or operating system.) It may also be installed via trojans that are introduced to the system under the guise of a media codec update. Like most rogue antivirus programs it either creates or brings with it a long list of files that it then later detects during it’s scans of the hard drive. It will label these as threats to the system and claim that if you purchase softcop it will protect your system from these threats. Everything is falsified about their claims though. Your system will be much safer if you remove softcop from your computer.
First download malwarebytes antimalware. You can find a copy on my virus removal toolkit page. These rogues are increasingly tricky with regards to downloading and installing a program like malwarebytes while the system is actively infected. (I consider it actively infected when the rogue is running in memory. I consider it dormant if it’s not launching at boot, but the files remain.) Long story short…. you may not be able to install and run malwarebytes while softcop is running on the system. You have a few options to attempt installing it anyway. 1) reboot into safe mode and attempt to install and run malwarebytes installer. If successful, update and run a full scan. 2) Rename the installer (mbam.exe) to something else (henry.exe) and then try to install, update and run a scan. 3) continue with the steps for a manual removal and optionally retry the install after the running processes associated with SoftCop are killed of using the task manager.
The following processes are associated with SoftCop and you should kill them off using the task manager or process explorer (find a link to it on the virus removal toolkit page.) If you are unable to run task manager (taskmgr.exe) copy and paste the file to another filename and rename it to something else….. frank.exe …. then you should be able to run it and kill off the following processes:
SoftCop.exe
Uninstall.exe
You may also need to look for processes that match some of the filenames listed below in the section regarding the deletion of the rogue files. Since these names have a random component to them you should use them as an example to help you in your search for what the rogue may have named them on your install.
After killing off the running processes for SoftCop, proceed to delete the following files and their folders:
%docs%\All Users\Desktop\SoftCop.lnk
%docs%\All Users\Start Menu\Programs\SoftCop
%docs%\All Users\Start Menu\Programs\SoftCop\1 SoftCop.lnk
%docs%\All Users\Start Menu\Programs\SoftCop\2 Homepage.lnk
%docs%\All Users\Start Menu\Programs\SoftCop\3 Uninstall.lnk
%progfiles%\SoftCop Software
%progfiles%\SoftCop Software\SoftCop
%progfiles%\SoftCop Software\SoftCop\SoftCop.exe
%progfiles%\SoftCop Software\SoftCop\uninstall.exe
%win%\10345tr5j9z.dll
%win%\10b9backdoor1z95.ocx
%win%\10ez9parse1845.cpl
%win%\system32\ree5.tmp.exe
%win%\system32\1020zspambo55e39.exe
%win%\system32\10834w95z101.exe
%win%\system32\10z14tro9195.cpl
As noted, the above filenames have a random component to them (as most all the members of the Wini family seem to.) Use the above filenames as a guide to help you find the files that SoftCop has planted on your system to make sure you are able to fully remove SoftCop.
Even after a successful manual removal I would install, update and run malwarebytes to make sure that everything was cleaned up from SoftCop and to be on the safe side go ahead and install, update and run a scan from a reputable antivirus (AVG/Avira are a couple names that are free for home use…) to make sure that you have completed your softcop removal.