Safer Networking

An important point to remember when removing PurityScan is to delete all parts of the PurityScan code. This is a must as PurityScan will rebuild itself and will result in further spreading of the spyware parasite.

Visit our tools page for some very good programs to remove PurityScan or any other spyware that your machine may have simply picked up.



PurityScan Description
PurityScan is a free tool that checks your computer for objectionable adult content. PurityScan scans your computer files and Internet history for keywords that may hint at pornographic material. When it locates questionable content, it displays the URL, word, or file name in a display table so you may delete it. After installation, when you connect to the Internet PurityScan may also launch advertisements, and automatically update itself. PurityScan upgrades may include the automatic installation of third party applications.

www.PurityScan.com

PurityScan Removal Instructions

If installed directly from purityscan.com or virtuescope.com there may be a corresponding entry in the Control Panel's Add/Remove Software list which can be used to remove the software.

Manual removal

For Winservs variant:

Click the Start button, open the Programs menu and the Startup menu inside it. Right-click on the 'Winservs' icon and choose Delete.

For WinservN variant:

Open the registry (click 'Start', choose 'Run', then enter the command 'regedit') and select the key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. On the right-hand side, right-click the entry named 'Content Service' pointing at winservn.exe, and choose 'Delete'.

Restart the computer and you should be able to delete the 'winservn.exe' file inside the System folder (which is inside the Windows folder, called 'System32' on Windows NT/2000/XP/2003).

For WRnd variant:

Open the registry (click 'Start', choose 'Run', then enter the command 'regedit') and select the key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.
One of the entries on the right-hand-side will be a four-capital-letter entry pointing to a file in the System folder with a name beginning with 'w'. These are chosen by by sticking together bits of filename seemingly at random; known filenames are shown here with their corresponding entry names.

WAPI wtscc.exe, wtsit.exe, wtssu.exe, wtstr.exe, wtssvcc.exe, wtssvit.exe, wtssvsu.exe, wtssvtr.exe
WCPC wintsvcc.exe
WCPI wintsvit.exe
WCPS wintcc.exe, wintit.exe, wintsu.exe, winttr.exe, wintsvsu.exe
WCPT wintsvtr.exe
WINT wcpcc.exe, wcpit.exe, wcpsu.exe, wcptr.exe, wcpsvcc.exe, scpsvit.exe, wcpsvsu.exe, scpsvtr.exe
WNSA wnstscc.exe, wnstsit.exe, wnstssu.exe, wnststr.exe, wnstssv.exe
WNSC wnsintcc.exe, wnsintit.exe, wnsintsu.exe, wnsinttr.exe, wnsintsv.exe
WNSI wnscpcc.exe, wnscpit.exe, wnscpsu.exe, wnscptr.exe, wnscpsv.exe
WNST wnsapicc.exe, wnsapiit.exe, wnsapisu.exe, wnsapitr.exe, wnsapisv.exe
WTSC wapisvcc.exe
WTSI wapisvit.exe
WTSS wapicc.exe, wapiit.exe, wapisu.exe, wapitr.exe, wapisvsu.exe
WTST wapisvtr.exe

Remember the filename and delete the entry. Restart the computer and you should be able to delete this file from the System folder (which is inside the Windows folder, and called 'System32' under Windows NT/2000/XP/2003).

PurityScan/WRnd is typically delivered with the Mendware or M2 variant; check for these to stop it reinstalling.

For NDrv variant:

Open a Command Prompt window (from the Accessories submenu in the Programs menu on the Start button) and enter the following commands:
cd %WinDir%\System
regsvr32 /u ..\
Drv.dll"

Next, open the registry (click 'Start', choose 'Run', then enter the command 'regedit') and select the key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. On the right-hand side, right-click the 'NDrv' entry pointing to 'NDrv.exe' and choose 'Delete'.

Restart the computer and you should be able to delete the files 'NDrv.exe' and 'NDrv.dll' from the System folder (inside the Windows folder, called 'System32' under Windows NT/2000/XP/2003).

PurityScan/NDrv is typically delivered with the Mendware or M2 variant; check for these to stop it reinstalling.

For NRnd variant:

Due to the random elements, removing PurityScan/NRnd by hand is tricky. Open the registry (click 'Start', choose 'Run', then enter the command 'regedit') and select the key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.

On the right, you should find an entry comprising 3-6 random letters (the first in capital, the rest lower-case) pointing to what appears to be a valid system file in the System32 folder. Note the filename and delete the entry.

Next, open the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects and look at the list of class IDs listed as subkeys. For each of these, open the subkey of the same name inside HKEY_CLASSES_ROOT\CLSID and select the InprocServer32 subkey. On the right, look for a (Default) entry pointing at a random-nonsense filename inside System32. Note the filename and delete the entire {...number...} subkey.

Restart the machine and you should be able to delete both the noted filenames from the
System32 folder (inside the Windows folder; called just 'System' on Windows 95/98/Me). Be very careful deleting the .EXE file because its name will look the same as a valid system file. The 'bad' file should be about 364KB long, and will be hidden (so to see it at all you will have to go to the Folder Options and turn off the 'Do not show hidden files and folder' and 'Hide protected system files' options). If you are not sure, don't delete the file; as long as the registry entries are gone it should be harmless.

For Mendware, M2 variants:

Open the registry (click 'Start', choose 'Run', then enter the command 'regedit') and select the key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.

On the right-hand side, there should be an entry whose name is four random letters (the first one capitalised), pointing to a .exe file whose name is another four different random letters (all lower-case) in the Application Data folder. If you have the M2 variant, some of the filename's letters may be replaced by question marks.

Right-click this entry and choose 'Delete'.

Reboot the computer and you should be able to delete this file, and an likely-empty folder whose name is another four different random letters, from the Application Data folder.

The Application Data folder can be found inside the Windows folder under Windows 95/98/Me, inside the user's Profile folder inside Windows under Windows NT, or in the user's Documents and Settings folder under Windows 2000/XP/2003.

Note that Application Data is usually hidden, and the M2 variant's EXE file is also set up to be a hidden system file. Make sure you can see everything by going to Folder Options (Tools->Options on an Explorer window), opening the View tab, turning on the 'Show hidden files and folder' and turning off the 'Hide protected operating system files' option.

For All variants:

You can also delete the registry key and HKEY_LOCAL_MACHINE\Software\ClickSpring to clean
up if you like. If the software was installed with the porn-scanner component you can also delete
the key HKEY_CURRENT_USER\Software\PurityScan and the 'PurityScan' folder inside Program Files.

or Visit our Tools Page for programs that can help


Related Files: adware purityscan  purityscan remove  purityscan  purity scan  purity scan spyware