Windows Firewall has detected activity of harmful software. Do you want to block this software from sending data over the internet ? – a Trojan !!

guys, have you got this pop-up in your windows ?

Trojan-Spy.Win32.GreenScreen is a hacker’s Trojan that appears in popups, security scans, and websites by fake antispyware. Trojan-Spy.Win32.GreenScreen popups read:

Description: This is spy trojan that installs itself to the system, hides itself and then captures screen images and saves them to disk files in encrypted form. Thus it allows to a hacker to watch screen images.
Windows Firewall has detected unauthorized activity, but unfortunately it cannot help you to remove viruses, keyloggers and other spyware threats that steal your personal information from your computer, including your Credit card data and access passwords to the online recources you use

i got this attack last night T…………T

so, let’s find how to remove it :

How to remove Trojan-Spy.Win32.GreenScreen registry keys:

Your Windows registry is the core of your Windows operating system, storing information about user settings, system preferences, and software, including which applications automatically launch at start up. Because of this, spyware, malware, and adware will often bury their own files into your Windows registry so that they automatically launch every time your start up your PC.

Registry Repair Warning for Trojan-Spy.Win32.GreenScreen Because your registry is such a key piece of your Windows system, you should always backup your registry before you make any changes to it. Editing your registry can be intimidating if you’re not a computer expert, and when you change or a delete a critical registry key or registry value, there’s a chance you may need to reinstall your entire Windows operating system. Make sure your backup your registry before editing it.

  1. Select your Windows menu “Start,” and click “Run.” An “Open” field will appear. Type “regedit” and click “OK” to open up your Registry Editor.
  2. Registry Editor will open as a window with two panes. The left side Registry Editor’s window lets you select various registry keys, and the right side displays the registry values of the registry key you select.
  3. To find a registry key, such as any Trojan-Spy.Win32.GreenScreen registry keys, select “Edit,” then select “Find,” and in the search bar type any of Trojan-Spy.Win32.GreenScreen’s registry keys.
  4. As soon as Trojan-Spy.Win32.GreenScreen registry key appears, you can delete the Trojan-Spy.Win32.GreenScreen registry key by right-clicking it and selecting “Modify,” then clicking “Delete.”

Computer acting funny after you’ve edited your registry and deleted Trojan-Spy.Win32.GreenScreen registry keys? Just restore your registry with your backup.

How to remove Trojan-Spy.Win32.GreenScreen DLL files:

Like most any software, spyware, adware, and malware may also use DLL files. DLL is short for “dynamically linked library,” and Trojan-Spy.Win32.GreenScreen DLL files, like other DLLs, carryout predetermined tasks. To manually delete Trojan-Spy.Win32.GreenScreen DLL files, you’ll use Regsver32, a Windows tool designed to help you remove DLL and other files.

  1. First you’ll locate Trojan-Spy.Win32.GreenScreen DLL files you want to delete. Open your Windows Start menu, then click “Run.” Type “cmd” in Run, and click “OK.”
  2. To change your current directory, type “cd” in the command box, press your “Space” key, and enter the full directory where the Trojan-Spy.Win32.GreenScreen DLL file is located. If you’re not sure if the Trojan-Spy.Win32.GreenScreen DLL file is located in a particular directory, enter “dir” in the command box to display a directory’s contents. To go one directory back, enter “cd ..” in the command box and press “Enter.”
  3. When you’ve located the Trojan-Spy.Win32.GreenScreen DLL file you want to remove, type “regsvr32 /u SampleDLLName.dll” (e.g., “regsvr32 /u jl27script.dll”) and press your “Enter” key.

That’s it. If you want to restore Trojan-Spy.Win32.GreenScreen DLL file you removed, enter “regsvr32 DLLJustDeleted.dll” (e.g., “regsvr32 jl27script.dll”) into your command box, and press your “Enter” key.

or do you want any simpler method ?

just go to google and download SUPER anti spyware for full scan^^

taken from :

^^ hope this is usefull for you guys..




  1. October 8, 2008 at 7:15 am

    Hi there,

    I looked over your blog and it looks really good. Do you ever do link exchanges on your blog roll? If you do, I’d like to exchange links with you.

    Let me know if you’re interested.


  2. Grant said,

    January 22, 2009 at 12:06 am

    Thank you for this post. I found it somewhat uninformative, but appreciate the time you took anyway. Here are some specifics that can help remove this false warning generated by a true virus.

    No registry editing necessary.

    For many, this works:
    – Go to C:\documents and settings\*username*\application data\google\
    – Look for an oddly named .exe file (example: ggg98797839.exe)
    – If the pop-up is currently up, use the Task Manager to kill the window
    – Switch the the folder above and immediately delete the .exe file (you can’t delete it without killing it first)
    – Update and run SUPER Anti-Spyware – remove all bad entries
    – Update and run Malwarebytes’ Anti-Spyware – remove all bad entries
    – done!

    Hope this helps…

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: