How to remove Gphone.exe

Wednesday, January 7th, 2009 at 2:59 am
Home » Backdoor, Worm » Gphone.exe

Gphone.exe description

Gphone.exe is worm which spreads via instant messengers. It usually affects Yahoo! Messenger and Google Talk applications. Gphone.exe send a message and invites victims to visit a website. If clicked upon, the link actually delivers a copy of Gphone.exe infection. The worm delivers the following message:

“There is in the worst of fortune the best of chances for a happy change
There is only one way to happiness and that is to cease worrying about things which are beyond the power of our will
The wisest mind has something yet to learn
The wise man in the storm prays God, not for safety from danger, but for deliverance from fear
Happiness is a choice that requires effort at times
Action may not always bring happiness; but there is no happiness without action
Happiness is not a destination. It is a method of life
The best way to cheer yourself up is to try to cheer somebody else up
If you want truly to understand something, try to change it
I am a strong believer in luck and I find the harder I work the more I have of it
View my webcam (private) [LINK]”

Once it’s on board a computer, Gphone.exe blocks security tools. This enables Gphone.exe to download and install other malwares.

How to manually remove Gphone.exe

To remove Gphone.exe spyware you must block Gphone.exe sites, stop and remove processes, unregister DLL files, search and delete all other Gphone.exe files and registry utility. Follow the Gphone.exe detection and removal instructions below.

The most typical software removal method is to remove Gphone.exe by using "Add or Remove Programs" service. However there may be hidden Gphone.exe files, running processes and registries in your computer, so Gphone.exe may recreate all other files after reboot.

Gphone.exe manual removal instructions

Block Gphone.exe sites:
rnd009.googlepages.com Read more how to block Gphone.exe sites

Stop and remove Gphone.exe processes:
DEFAULT_NOT_SET.exe
New Folder.exe
gphone.exe Read more how to kill Gphone.exe processes

Locate and delete Gphone.exe registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCrawler\Shares\"shared" = "[ROOT FOLDER]\New Folder.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"Yahoo Messengger" = "%System%\gphone.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"Shell" = "Explorer.exe gphone.exe"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Schedule\”AtTaskMaxHours” = "0"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Schedule\"NextAtJobId" = "2"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\"DisableTaskMgr" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\"DisableRegistryTools" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NofolderOptions" = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\"Default_Page_URL" = "http://rnd009.googlepages.com/google.html"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\"Default_Search_URL" = "http://rnd009.googlepages.com/google.html"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\"Search Page" = "http://rnd009.googlepages.com/google.html"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\"Start Page" = "http://rnd009.googlepages.com/google.html"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\"Start Page" = "http://rnd009.googlepages.com/google.html"
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\"HomePage" = "1"
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\"HomePage" = "1" Read more how to delete Gphone.exe registry entries
Download RegistryBooster 2010 to scan errors caused by Gphone.exe

Detect and delete other Gphone.exe files:
%Windir%\gphone.exe
%System%\gphone.exe
%System%\DEFAULT_NOT_SET.exe
C:\Documents and Settings\All Users\Desktop\gphone.exe
%Temp%\gphone.exe
%System%\gphone.exe
%DriveLetter%\New Folder.exe
%DriveLetter%\gphone.exe
[ROOT FOLDER]\New Folder.exe
[ROOT FOLDER]\gphone.exe
%DriveLetter%\autorun.inf
%Windir%\Tasks\At1.job
[ROOT FOLDER]\autorun.inf
C:\disk.txt
%System%\autorun.ini
%System%\setting.ini
%Temp%\log_[TIME AND DATE].txt

We strongly recommend you to use spyware remover to track Gphone.exe and automaticaly remove Gphone.exe processes, registries and files as well as other spyware threats.

Download does not start? Try a mirror download here

Tags:

20 Responses to

Gphone.exe

  1. GA2
    January 22nd, 2009 at 9:48 am

    Hey where to execute the code u have kept the quotes

    can u make it clear how to get rid of it, i am suffering a lot bec of it

    Reply

    Luciana Reply:
    January 23rd, 2009 at 6:03 am

    Hello GA2,

    You don’t need to execute any code. If you’re looking for anti-spyware application, download the gphone.exe removal tool. If you wanna remove this infection manually, follow the manual removal instructions provided above. Block Gphone.exe site using this tutorial; stop and remove Gphone.exe processes using ‘how to kill processes’ tutorial, locate and delete Gphone.exe registry entries using this tutorial and finally delete other Gphone.exe files listed above.

    Reply

  2. kiran kumar
    January 23rd, 2009 at 11:49 pm

    my humble thanks to the people who dsign this,i remove this virus processes,registry entries succesfully, once again thanks for providing good soltuions ,keep provide much more soltuions ,thanq, if any one want any infoamtion
    please mail me

    Reply

  3. Jins2Win
    February 15th, 2009 at 2:08 am

    Hey this gphone virus has disabled my taskmanager as well as registry editor..now i cant stop its processes manually..tell me what should i do

    Reply

    Luciana Reply:
    February 17th, 2009 at 2:08 am

    Start your computer in a safe mode. Most of malicious processes are inactive in the safe mode so you should be able to deal with the Gphone.exe.

    Reply

    jackkk Reply:
    June 17th, 2009 at 6:52 am

    I started my computer in the safe mode but it did not help.This can be rectified by:
    Open the ‘run’ and type
    “REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f”
    in the blank space , then press OK.
    The task mansger can then be accessed in the normal matter(likr ctrl+alt +del)

    Reply

  4. Virendra
    April 25th, 2009 at 10:50 am

    Hey whenever i am trying to open any of my desktop icons or other programs my system prompts the following message
    “windows can notaccess the specified device, path or file. You may not have the appro
    priate permission to access the item.”

    My PC infected by gphone.exe pls help to get rid of it.

    Reply

    Luciana Reply:
    April 26th, 2009 at 10:06 pm

    Hello,
    Please follow the removal instructions provided above. The error message you receive might be unrelated to the Gphone.exe infection.

    Reply

  5. richard
    May 1st, 2009 at 12:06 am

    i used ESET NOD32 anti virus and it deleted the gphone.exe.

    but my problem now is that whenever i start windows, there is a window which says:

    cannot find gphone.exe, if u need to look for this application, use search button

    it goes something like that. its really bothering me alot and it slows down the start up..

    please help me

    Reply

    bryan Reply:
    May 1st, 2009 at 1:52 am

    Richard,
    now you have to delete gphone.exe from your startup files list: start -> run -> msconfig -> go to startup and uncheck gphone. This should help you.

    Reply

    michael Reply:
    August 15th, 2010 at 6:03 am

    please help i do have the same problem.. i have already deleted the gphone.exe but i can’t found it in startup

    Reply

  6. kumar varma
    July 16th, 2009 at 4:51 pm

    Sir, I have this problem since 2 months. I recognise it after using AVG Anti virus free version programme. All my folders have new folder.exe. And in start up there is a run time error “53″:file not found:sysproc.dil. And now windows script Host-Loading scriot “C:\windows\system32\neo.vbe” failed (Acess is denied). After that I downloaded the windows steady state to protect my system. But this virus can’t go away. How can I remove it. I am not aware of knowledge in computers to do it manually. Is there any solution in Online. Please give me reply in a short span of time.

    Reply

    Luciana Reply:
    July 16th, 2009 at 10:35 pm

    Run anti-spyware scan. AVG is anti-virus and it’s designed to deal with different type of infections.

    Reply

  7. Vivek
    August 9th, 2009 at 3:38 am

    Hey my internet is not very fast thats why i cant download your spyware. I am using vista ultimate. So Manual file deletion is not proper. Can u send ideal solution to get rid of gphone.exe

    Reply

    Luciana Reply:
    August 11th, 2009 at 10:36 pm

    Download the anti-spyware on another computer and then copy the install file on the infected PC using USB drive or CD or something like that. The manual removal is more effective in a safe mode because malware may prevent removal in a normal mode.

    Reply

  8. mukhesh
    September 24th, 2009 at 2:11 am

    how to remove this gphone.exe.because lot of files in my pc.and lot of gphone vyrus is in my pc.how to detect manual.this is long process.any one help me .and tell me shortcut method plz….

    regards.
    mukhesh matety
    warangal
    andhrapradesh

    Reply

  9. jaideep roy
    October 24th, 2009 at 8:14 am

    i had the same problem…i have win xp and was using avg free version…
    …from one of the forums i learnt that kaspersky would help…so i uninstalled avg
    free and downloaded kaspersky 2010 trial version and installed it…then updated the virus defination and ran the whole computer scan …it killed the gphone virus along with all the folders that it had created…for other gphone related i carried out the following action…

    1. CTRL+ALT+DEL disabled by virus…

    solution. a. go to RUN…
    b. Type (without the quotes “” ofcourse)

    ” REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f ”

    c. press OK

    2. C and D drive only opens by explore and not double clicking.

    solution. a. go to cmd prompt ( in accessories) and run the following commands.

    c:\> attrib -r -s -h autorun.inf
    c:\> del autorun.inf
    d:\> attrib -r -s -h autorun.inf
    d:\> del autorun.inf

    b. restart computer

    3. “regedit” command disabled by the virus

    solution. a. go to RUN
    b. type

    ” reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /f ”

    c. press ok

    4. folder option not available in tools..

    solution. a. Go to Run, type gpedit.msc then press enter.
    b. Navigate to User Configuration -> Administrative Templates -> Windows Components -> Windows Explorer.
    c. At the right panel, look for “Removes the Folder Options menu
    item from the Tools menu”, right click on it then choose Properties.
    d. Change the setting from Enabled to Not Configured or Disabled.

    this worked for me…i hope it works for you…

    Reply

  10. Manan
    October 24th, 2009 at 11:10 am

    Actually the registry editor is also blocked via this virus so i cannot acces my registry editor without that i cant manually remove the gphone.exe
    so kindly giv me another solution if possible

    Do you have the path in the registry editor to stop the autorun of any removable storage disk..
    kindly respond to my query

    thanks…

    Reply

  11. Ujjan
    December 11th, 2009 at 6:17 am

    Hello,
    My computer was affected by gphone.exe. I’ve removed the virus but different kind of language was displayed on on my clock bar. Does any one have idea about how to solve it.

    Reply

  12. john
    June 29th, 2010 at 8:36 pm

    hellow my computer was affected by gphone.exe and i cannot open my games what should i do?
    pls reply

    Reply

Leave a Reply

Download does not start? Try a mirror download here
«
»