How to remove BankerFox.A

Friday, June 19th, 2009 at 12:01 am
Home » Fake warning messages, Trojan » BankerFox.A

BankerFox.A description

BankerFox.A is not a real threat to a computer. The trojan is only reported by rogue security programs trying to make an image of badly infected system. Do not buy anti-spyware or anti-virus applications that warn you about BankerFox trojan! It’s a fraud.

Infiltration Alert
Your computer is being attacked by an Internet Virus. It could be a password-stealing attack, a Trojan – dropper or similar.
Threat: BankerFox.A
Do you want to block this attack?

BankerFox.A is usually reported by Spyware Protect 2009.

Remove SpywareProtect 2009 to get rid of annoying pop-ups.

How to manually remove BankerFox.A

To remove BankerFox.A spyware you must block BankerFox.A sites, stop and remove processes, unregister DLL files, search and delete all other BankerFox.A files and registry utility. Follow the BankerFox.A detection and removal instructions below.

The most typical software removal method is to remove BankerFox.A by using "Add or Remove Programs" service. However there may be hidden BankerFox.A files, running processes and registries in your computer, so BankerFox.A may recreate all other files after reboot.

BankerFox.A manual removal instructions

Block BankerFox.A sites:
Read more how to block BankerFox.A sites

Stop and remove BankerFox.A processes:
Read more how to kill BankerFox.A processes

Locate and delete BankerFox.A registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "sysguardn"
HKEY_CURRENT_USER\Software\Spyware Protect 2009
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\uninstall\Spyware Protect 2009
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Spyware Protect 2009
Read more how to delete BankerFox.A registry entries
Download RegistryBooster 2010 to scan errors caused by BankerFox.A

Search and unregister BankerFox.A DLL libraries:
vbzlib2.dll Read more how to unregister BankerFox.A DLL files

Detect and delete other BankerFox.A files:
c:\Program Files\Spyware Protect 2009
c:\Program Files\Spyware Protect 2009\gfx.bin
c:\Program Files\Spyware Protect 2009\options.ini
c:\Program Files\Spyware Protect 2009\SpywareProtect2009.exe
c:\Program Files\Spyware Protect 2009\SpywareProtect2009.exe.MANIFEST
c:\Program Files\Spyware Protect 2009\SpywareProtect2009_start_setup.exe
c:\Program Files\Spyware Protect 2009\tp_starter.exe
c:\Program Files\Spyware Protect 2009\uninstall.exe
c:\Program Files\Spyware Protect 2009\uninstall.log
c:\Program Files\Spyware Protect 2009\vbase.ini
c:\Program Files\Spyware Protect 2009\lang
c:\Program Files\Spyware Protect 2009\lang\english.lng

We strongly recommend you to use spyware remover to track BankerFox.A and automaticaly remove BankerFox.A processes, registries and files as well as other spyware threats.

Download does not start? Try a mirror download here

Tags: ,

58 Responses to


  1. Brian

    This keeps stopping me from runnning the scan

    Luciana Reply:

    Run the scan in a safe mode. This way the infection won’t be able to block spyware remover.

    Jess Reply:

    I had the virus, ran the program, and successfully removed the virus. Only problem is that I can’t log on to the internet now when not running in normal mode! I must have deleted something by accident! Can anyone advise me on how to remedy this problem?!?! Thanks for all the help!

    bryan Reply:

    You must have deleted someting. There might be some problems with your tcp/ip layer, try to download this tool: check and fix it.

    Don Reply:

    make sure that the proxy server setting are correct in IE

  2. joannie

    How do i run it in safe mode?

    Luciana Reply:

    Restart your computer and keep clicking F8 key while the PC is still booting up. You’ll get to the menu with the option to boot into safe mode.

  3. Shauna

    My computer will not allow me to run removal tool for banker fox and will not allow me to switch the compuetr on in safe mode-what do I need to do?????

  4. dele

    That virus is a stinker. The way I removed it was to hold down the shift key immediately I saw the window logo, this will stop the bankerfox.a etc from runing. I then went into task manager and stoped all the sewrvices that I did not recognize. One of them or more relates to the virus. You then can go into your registry and search for bankerfox.a and nqel or something like that and deleted them.

    zelda Reply:

    Thank you for your post. To make a long story short, the shift key procedure worked! It did not let the virus run, and immediately enabled my Norton Utilities to do their job and obliterate it all together! Prior to this approach, the virus which had as they call it, “entered through the back door”, got by the Norton, and hid itself well onto our system. It had blocked all functions. Could not get to task manager, would not allow access to Antimalware/Malwarebytes, no internet access etc. In safemode, I was able to run virus software but it did not remove all of the virus. My last resort was the shift key. Only set back was that settings were changed and had to work with tech support to reestablish modem configurations ad IP address/default gateways. System is back and operating after a short setback.

  5. Mason

    My computer got this virus some how. And it won’t let me open task manager or go into the registry editor or even let me open my spyware program. I’ve tried downloading two other spyware programs and it still won’t let me open them. I get a message saying the .exe file is infected. Any ideas??

  6. Clarissa

    I’ve got the exact same problem, it wont let me open anything, everytime I click on an icon, it doesnt open and I can’t go on any websites but it randomy opens porn sites. Please someone help!

    Luciana Reply:

    You can delete Spyware Protect 2009 manually so your browser won’t get redirected and you won’t receive BankerFox.A pop-up. Click here for SpywareProtect 2009 removal instructions.

  7. Sean

    are win32nuquel.e and bankerfox.a tied with sysguard???? if so, then i deleted sysguard (abfssysyguard for me, it sometimes hides itself) and all the pop-ups disappeared.

  8. steve

    i found that if you quickly access task manager on windows startup you can access it and end the wfrrsysguard.exe process from task manager. This allowed me to run spybot search and destroy which deleted most of the files. Then had to access msconfig and remove wfrrsysguard and a couple of other proccesses from starting when windows does. This appears tio have stopped the spyware from loading although im pretty sure there are probably a couple of infected files left on the computer but the processes have stopped running so it is no longer causing problems. Hope this helps

    jo Reply:

    how do I know which process on the task manager to end??

    Luciana Reply:

    The malicious processes are listed above the comments section.

  9. Norma

    How do you trigger the task manager at startup? I really need to know this so that I can get in and delete this virus. It is a pain in the butt. It won’t let me open the Add/Remove program and won’t let me open the Internet Options to block certain websites.

    Please help.

    Luciana Reply:

    Press Ctrl+Alt+Delete buttons simultaneously or right-click the Task bar and choose “Task Manager” option.

  10. carole

    Thank you, thank you, thank you. I have been trying to get rid of this for 3 days. Your site’s links and advice was the only one that worked.

  11. Tony

    Top instructions, sorted the job out. well done.

  12. Mandy

    we got this virus. Norton finally found some threats and we downloaded another spyware program. We still can not access the internet. It says a firwall is blocking the website. We ran both antivirus/spyware programs in safe mode and nothing was detected. Is this virus still hiding somewhere? Is there something wrong with internet explorer? We tried all the do it yourself removal.

    mallesh nagothi Reply:

    check your browser’s proxy settings. the virus adds a proxy script

  13. Dayna

    I am stuck in the same position as Mandy right now and Need answers asap. This laptop has my school stuff on it so i need to get this virus off!!

  14. Jimi D

    I just followed the advice to first open in safe mode I you can’t do that open and get to the task manager immediatly the end process sysguard or anything like it found about 4 or 5 you can also end process tree instead after that the pop ups stopped I the went to my Internet connections to see why I couldn’t get to the Internet and found that something switch me to proxy server which is wrong for me so I changed that then went to my antivirus updated that the went to startup from msconfig found and disabled anything I didn’t recognize or that had sysguard in it then ran my antivirus “Webroot essentials great stuff” shut down and reboot so far no problems.

  15. Eileen

    Evidently they are still going on with this after these solutions. The version of the bug I Have blocks any attempt to open the task manager via any route I know as well as most programs on my PC and all control panel functions. I haven’t tried rebooting to safe mode. Afraid I’ll never get my machine back up if I shut it down.

    This time the bogus software is called Antivirus soft, but it’s the same thing, even has the same illiterate typo in the warning window.

    can someone direct me to instructions on removing the latest strain? Thanks :)

  16. Rick

    What do I do if I don’t have a comments section in Task Manager? What else can I do to get rid of this virus.

    Luciana Reply:

    There is no comments section in Task Manager. Names of processes loaded by this malware are listed on this page BankerFox.A removal. Scroll down till you see “BankerFox.A manual removal instructions”, you will find tutorial there on how to delete all the things related to this malware.

  17. Meg

    Thank you!!

  18. Chris

    None of the processes mentioned show up in the process library on my computer. Even when this malware’s icon shows up on my task bar there are no processes that match those given in the above list.

  19. steven

    i have this virus. I cannot find anyof the files listed above. and ive tried about every spyware removal tool there is out there. is it possible that i have a new form of the virus. I just got it yesterday

  20. Joe

    This may seem too easy. I’m no PC guru but I just selected the System Restore prompt after rebooting in Safe Mode and selected a restore point from a few days back when my PC wasn’t infected and that fixed my problem. Hope it’s a permanent fix.

  21. Adam

    I am also having the same problem. You guys say its this spyware 2009 program but i am getting a new program name which is Antivirus Soft.

  22. Shellie

    I have this virus on my laptop. I cannot get access to the inernet to download anything to remove the virus. Every time I try to get on the internet, it freezes on the page that prompts me to buy the antivirus software. Then, a porn sites and viagra sites pop up. How can I get on the internet to download the things I need to remove this mess?????? Please help!!

    Susan Reply:

    I just got it today. It came up as Antivirus soft and also immediately froze everything so I could not access task manager, spybot, my antivirus software, etc. Then showed the same message as shown at the top of the page, I rebooted but was not quick enough to put it in safe mode and can now access all of these things. And my internet. None of the programs listed above are in my registry. I’m afraid it is now sleeping on my computer.. I read on another forum the virus is a keylogger that access passwords and credit card info. Is this true, does anyone know more information on this virus? The forum also said system restore is not effective, the only thing that works properly is a reformat. Since my computer is no longer showing signs of a malware attack, I don’t know what to think. I don’t want to assume it’s safe, and next thing I know my identity is stolen.

    Jerome Reply:

    Shellie, this might not help that much, but in my case, if I reboot in “Windows Safe mode with Networking”, the virus no longer bugs me and I can go download things on the Internet with Firefox. Not that I identified yet what to download though…

  23. Dennis Grecco

    10 Feb 10. I just got it today. It came up as Antivirus soft. Downloaded PC Tools Spyware Doctor and am on my third pass and it is still finding infected files.

  24. Ellie

    I got it yesterday. I was on Facebook commenting on my OWN picture and was redirected to the site that dumped Antivirus Soft on my laptop. I’m fortunate to have a working desktop to find the cure, but I’m having trouble starting my laptop in safe mode. I tried F8, F12 and Ctrl + F11. Nothing works. I have a Dell.

    I was able to get to my Task Manager and also do not have any of those programs running. This sucks.

  25. Jerome

    Similar problem. My wife’s laptop is now host of this thing which keeps claiming that processes are infected any time a process is started, advertising a fake security Web site if say yes to activate more security, and popping up a porn Web site every now and then (to the great amusement of my teenagers!).

    Can’t find any of the suggested files, processes or registry entries. Norton 360 was mostly disabled. I (painfully) succeeded to re-install it from the Windows safe mode, and update it to the latest signatures, and run a full scan. No luck. Malwarebytes’ Anti-Malware doesn’t seem to find anything either.

    Quite clearly, this virus recently morphed to a new form, not known by Norton or Malwarebytes. I just don’t know how to approach the problem… Ideas would be very welcome.

  26. Miranda

    My virus now looks like it’s gone, and I picked it up today, in its most recent incarnation.
    What I did was started in safe mode with networking, then when it prompted me before launching I ran system restore.

    AVG’s just gone through the registry and nothing. Malwarebytes has found nothing… should I be worried?

  27. Don

    Just helping a friend with bankerfox.a and win32/nuquel.e spyware/virus. As soon as the computer booted up, I hit cntrl+alt+del then brought up the task manager. This prevented the virus from blocking the task manager. then I went to the process tab and once the virus reared its ugly head, systematically began to end-process that I figure shouldn’t be the problem, then address the ones that looked suspicious.

    Alot of programs, like windowslive chat, get added to your start-up programs and begin running automatically when you boot up (this also slows your computer) you can control what starts up auto and what has a pause or waits for your command.

    In the process I found powrsftav.exe, and when I shut it down the attack stopped. I searched his computer (remember to advance search and select hidden and non-indexed files since it is hidden) and came across two files with pwrsftrav name and deleted both…end of problem.

  28. Paul

    Can someone help me, when i try to open the comp in safe mode and chhose to open in safe mode it goes straight back to safe mode screen without the comp starting up and just keeps looping back asking me to start in windows normal mode.

  29. Paul

    I have managed to do stage 1 but cannot find any of the exe files in the processes, cannot find any of the named files in the registry entry, cannot find the spyprotect in the programs files, and the virus is till merrily pissing me off….

    bryan Reply:

    well if u can not find processes listed above my advice would be to kill every unknown process and scan your pc with antispyware program

  30. Miranda

    I downloaded Spyware Doctor in the end, though it still took four scans to eradicate everything. Worth the 30 quid I think – I couldn’t find any of the processes or registry entries either.

  31. Kylie

    Thank you everyone… 4hours later i have got removed this horrible virus….

    1. Safemode
    2. Then I restored my system to an earlier date.

    Thank you…

  32. Miranda

    I did that and it came back. You’re best to eradicate it using Spyware Doctor or following the instructions above.

  33. Blake

    I just got rid of this virus and nearly pulled my hair out trying to get rid of it. My father-in-law had a fix-it program and i was able to run it. I had to shut the computer down and open the program before the virus booted up. As for the internet problem i ended up resetting my explorer settings and it worked! Tools, options, advanced, and then hit reset. Good luck to anyone who gets this virus! And if any of the creators are watching this post, may you burn in an elevated temperature environment (not sure of the content guidelines on this post lol) Anyway, you get the picture

  34. Linda

    My computer opens up to the Windows and then I can’t click on anything as my mouse is now frozen with the hour glass…..I tried the shift key as soon as it turns on but that doesn’t work either, any other suggestions?

  35. Susan

    I have been having problems with this virus as well. I have problems opening anything because everything was comming up with “infected” errors. Could not open AVG or anything. Here is what I did – I turned it off by cutting the power and forcing it to reboot from scratch. I have multiple profiles on my laptop including a guest one that has no admin rights. When I logged into it – it came up with a message that the virus was trying to run but could not – got the name of it there. Then I logged into my main account and while it was still bringing up start menu stuff, I could open task manager with a right click in the task bar. I found the exe with the same name in the list there and ended the process. Once that was closed, I no longer had any problems with running my virus scans, getting to the internet, or deleting the exe entirely.

  36. Rick

    Spyware Doctor cured it for me.

  37. velyn

    Please help. I also can not see any of the listed processes in the registry.

    Pressing and holding the Shift Key did not work

    The Antivirus Soft icon is in the bottom right of my desktop
    I don’t see anything strange under MSCONFIG I tried SAFE Mode and using another logon profile.

    AVG is disabled, as is Mcafee Scan because I can not connect to the internet.
    I disabled the proxy that was added and I restored the IE 8 default settings for the browser.

    I’m not working right now and can’t pay for Spyware Doctor (the free trial download protects from new threats but does not remove any threats that it finds already on your system)
    is there any other free option that will fix this without me losing all of my files?

    Thanks for your help

    Luciana Reply:

    Here’s detailed Antivirus Soft removal guide.

  38. Rhett Starr

    The system restore seems to work – did for me. I ran scan & picked up nothing, searched hidden files for file names, found nothing. I’m wondering if using the system restore erases files subsequent to the restore date. ? ? ?

  39. person

    dmsnhaetssd.exe was the culprit process name that when I ended, it stopped this Bankerfox.A thing. I was able to open up task manager by pressing ctl-alt-dlt just after turning on computer. I’m still in process of removing this thing entirely.

  40. Max

    Started in safe mode – thanks for that advice of how to get there with Ctrl alt delete immediately afer startup; it’s a different windows. Then found system restore. I will now go through every other little bit I can find to get rid of these rotten b’s and keep this thread open till I’ve found every one.

    Thank you.

    regedit and msconfig for min in the morning.

  41. dave

    I am trying all the tricks above and got stuck trying to start my computer in safe mode. When my computer boots up it starts

    checking file system on c:
    The type of the file system is NTFS.
    Volume mabel is HP_Pavilion

    One of your disks needs to be check for consistency. You may cancel the disk check, but it is strongly recommended that you continue. Windows will now check the disk.

    CHKDSK is verifying files (stage 1 of 3)…
    File verification completed
    CHKDSK is verifying indexes (stage 2 of 3)…

    Then it gets stuck. What do I do?

  42. Cory

    Do system restore in safe mode. Worked for me.

Comments are closed.

Download does not start? Try a mirror download here