Malware: How To Remove Monster Marketplace

Threat Name:

Monstermarketplace Cookie (Monster Marketplace, Malware.Monster.DX)

Affected Operating Systems:

Win32 (Windows 9x, Windows XP, Windows Vista, Windows Seven)

Related files:

QWProtect.dll, abest.exe, svchost.exe, installer.exe, AntivirusBEST.lnk, uninstall.lnk, ABEST.CAB[/Warning_Box]

What is Monster Marketplace?

Monster Marketplace (Malware.Monster.DX) is a fake security threat used by rogue anti-spyware applications to convince users that their computer has been infected with malware. If you are infected by Monster Marketplace because of AntivirusBEST a blue screen (“of death” they call it) or Windows crash warning will apear which states that this infection happened because of Malware.Monster.DX. Other fake spyware removers use this same or similar fake threat as well. Other programs display fake security alerts about serious infections including Malware.Monster.DX.
To solve this problem you must remove rogue security applications and related malware, mostly trojans. In this case you must firstly remove AntivirusBEST from your computer (or whichever rogue progam you are using), otherwise these fake notifications will reoccur.

How to remove Monster Marketplace

To compltely remove Monster Marketplace (Malware.Monster.DX) follow each instruction below.
[Info]Bypass Manual Removal: Recommended Monstermarketplace removal software and tools, Restore[/Info]

1. Kill processes:
  • abest.exe
  • svchost.exe
  • installer.exe

1. Start Windows Task Manager

CTRL+ALT+DEL or CTRL+SHIFT+ESC. Press the Start button and click on the Run… option. This will start the Run tool. Type in taskmgr and press OK or enter. This will start the Windows Task Manager as well.

2. Find and terminate the process

Click on the Processes tab on Windows Task Manager. Find each process 1 by 1 under “Image Name”, abest.exe, svchost.exe, installer.exe. Select each onewith your mouse or keyboard and click on the End Process button. This will kill the process for each one you select.

2. Delete registry values:
  • HKEY_CLASSES_ROOT\AppID\{296A8A7F-B5AC-4789-9B33-F32C2F9A6ABD}
  • HKEY_CLASSES_ROOT\CLSID\{44B2C9F5-608D-46de-82E1-26C5BCB85193}
  • HKEY_CLASSES_ROOT\Interface\{296A8A7F-B5AC-4789-9B33-F32C2F9A6ABD}
  • HKEY_CLASSES_ROOT\TypeLib\{684A7904-2593-4BBE-A90E-CDAF2AC606AE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{44B2C9F5-608D-46de-82E1-26C5BCB85193}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “AntivirusBEST”

  Type regedit in the search query on your start menu, press enter.
A registry screen will pop up with 2 window panes.
You will want to check each tab on the left. (Folders open in the left tab. Follow the location, and delete)

3. Unregister DLLs:


1. Open the Command Prompt

Access Window’s start menu, enter CMD in the search field and press enter. (This will open Microsoft Window’s command prompt)

2. Navigate to the exact DLL location

Change the directory to exact DLL location path. Type the cd command (it is used to change the current directories), put space and enter the full path to the DLL. Press enter. This will change the current directory to that you have entered. (To display directory contents use the dir command.)
If you are not successful following these steps, in the command prompt enter: qwprotect.dll
Remove Monstermarketplace

3. Unregister the DLL

Within the same directory type this regsvr32 /u [dll name here] and press enter.
(If you have accidentally unregistered a necessary DLL, you can register it again by invoking regsvr32 command without the /u key: regsvr32 [dll name here]. This will undo any changes.)

4. Delete files:
  • qwprotect.dll
  • abest.exe
  • svchost.exe
  • installer.exe
  • AntivirusBEST.lnk
  • Uninstall.lnk

The easiest way to delete these files is to simply “search” for them and manually delete them.

5. Delete directories:
  • c:\documents and settings\All Users\Start Menu\Programs\AntiVirusBEST
  • c:\Documents and Settings\All Users\Application Data\AB

Follow each to their locations and manually delete the AB and AntiVirusBEST (or other rogue anti-spyware program)[/Normal_Box]

Sean Doyle

Sean Doyle is an engineer from Los Angeles, California. Sean's primary focuses include Internet Security, Web Spam, and Online Marketing.

Comments ( 20 )

  1. Monstermarketplace adware | Adcosmos
    [...] How To Remove Monster Marketplace Malware (Monster.DX …May 14, 2012 … DX, Monstermarketplace) is a fake security threat used by rogue anti-spyware … This entry was posted in Malware, Blog and tagged Adware, … [...]