How to remove Gphone.exe

[Ashish]

Gphone.exe description

Gphone.exe is worm which spreads via instant messengers. It usually affects Yahoo! Messenger and Google Talk applications. Gphone.exe send a message and invites victims to visit a website. If clicked upon, the link actually delivers a copy of Gphone.exe infection.

The worm delivers the following message:

“There is in the worst of fortune the best of chances for a happy change
There is only one way to happiness and that is to cease worrying about things which are beyond the power of our will
The wisest mind has something yet to learn
The wise man in the storm prays God, not for safety from danger, but for deliverance from fear
Happiness is a choice that requires effort at times
Action may not always bring happiness; but there is no happiness without action
Happiness is not a destination. It is a method of life
The best way to cheer yourself up is to try to cheer somebody else up
If you want truly to understand something, try to change it
I am a strong believer in luck and I find the harder I work the more I have of it
View my webcam (private)”

Once it’s on board a computer, Gphone.exe blocks security tools. This enables Gphone.exe to download and install other malwares.

How to manually remove Gphone.exe

To remove Gphone.exe spyware you must block Gphone.exe sites, stop and remove processes, unregister DLL files, search and delete all other Gphone.exe files and registry utility. Follow the Gphone.exe detection and removal instructions below.

The most typical software removal method is to remove Gphone.exe by using "Add or Remove Programs" service. However there may be hidden Gphone.exe files, running processes and registries in your computer, so Gphone.exe may recreate all other files after reboot.

Gphone.exe manual removal instructions

Block Gphone.exe sites:

Code:

rnd009.googlepages.com

Read more how to block Gphone.exe sites

Stop and remove Gphone.exe processes:

Code:

DEFAULT_NOT_SET.exe
New Folder.exe
gphone.exe

Read more how to kill Gphone.exe processes


Locate and delete Gphone.exe registry entries:

Code:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCr​awler\Shares\"shared"  = "[ROOT FOLDER]\New Folder.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"Yahoo Messengger" = "%System%\gphone.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"Shell" = "Explorer.exe gphone.exe"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Schedule\”AtTaskMaxHours” = "0"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Schedule\"NextAtJobId" = "2"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\"DisableTaskMgr" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\"DisableRegistryTools" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NofolderOptions" = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\"Default_Page_URL" = "http://rnd009.googlepages.com/google.html"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\"Default_Search_URL" = "http://rnd009.googlepages.com/google.html"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\"Search Page" = "http://rnd009.googlepages.com/google.html"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\"Start Page" = "http://rnd009.googlepages.com/google.html"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\"Start Page" = "http://rnd009.googlepages.com/google.html"
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\"HomePage" = "1"
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\"HomePage" = "1"

Read more how to delete Gphone.exe registry entries

Detect and delete other Gphone.exe files:

Code:

%Windir%\gphone.exe
%System%\gphone.exe
%System%\DEFAULT_NOT_SET.exe
C:\Documents and Settings\All Users\Desktop\gphone.exe
%Temp%\gphone.exe
%System%\gphone.exe
%DriveLetter%\New Folder.exe
%DriveLetter%\gphone.exe
[ROOT FOLDER]\New Folder.exe
[ROOT FOLDER]\gphone.exe
%DriveLetter%\autorun.inf
%Windir%\Tasks\At1.job
[ROOT FOLDER]\autorun.inf
C:\disk.txt
%System%\autorun.ini
%System%\setting.ini
%Temp%\log_[TIME AND DATE].txt

We strongly recommend you to use spyware remover to track Gphone.exe and automaticaly remove Gphone.exe processes, registries and files as well as other spyware threats.

Click to Download gphone.exe removal tool

[Admin]

One More tools for Remove Gphone.exe Virus

Download Attachment