Comments on: Spywarequake sucks!

Question: Spywarequake sucks!

jimmythefish — Sat, 25 Mar 2006 17:18:24 -0800

Grrrr...blinking Virus Alert! icon and popup message in my taskbar tray and undead SpyWareQuake software keeps reinstalling itself. Help! Done a search for every possible solution, AVG doesn't pick it up, nothing I can find or do will help. Any ideas?

By: juv3nal

juv3nal — Sat, 25 Mar 2006 17:46:34 -0800

assuming windows machine?
have you tried the usual suspects?

by which i mean, on another, uninfected computer grab updated definitions for spybot, adaware, avg put em on a usb key or something.

reboot machine in safe mode with the ethernet unplugged/wifi off.

update spybot/adaware/avg and run the scans
check start->run->msconfig
under services & startup, google anything that doesnt look familiar and disable it if google shows its not benign.

also [insert editing registry disclaimer]
start->run->regedit
google anything that shows up under

HKEY_CURRENT_USER->Software->Microsoft->Windows->CurrentVersion->Run
HKEY_CURRENT_USER->Software->Microsoft->Windows->CurrentVersion->RunOnce
HKEY_LOCAL_MACHINE->Software->Microsoft->Windows->CurrentVersion->Run
HKEY_LOCAL_MACHINE->Software->Microsoft->Windows->CurrentVersion->Run

and delete anything that google shows as not benign

By: Dipsomaniac

Dipsomaniac — Sat, 25 Mar 2006 17:47:18 -0800

Dslreports has a page on it here.

By: Steven C. Den Beste

Steven C. Den Beste — Sat, 25 Mar 2006 17:48:58 -0800

If you haven't run Windows Update for a while, go visit. Once a month Windows Update has Microsoft's latest version of its malware removal program on it. (There's actually a URLyou can visit where you can manually run it, but I don't remember it. Sorry.)

By: juv3nal

juv3nal — Sat, 25 Mar 2006 17:50:53 -0800

the second
HKEY_LOCAL_MACHINE->Software->Microsoft->Windows->CurrentVersion->Run

should be

HKEY_LOCAL_MACHINE->Software->Microsoft->Windows->CurrentVersion->RunOnce

By: jimmythefish

jimmythefish — Sat, 25 Mar 2006 22:42:42 -0800

Thanks guys....used Dipsomaniac's link and seemed to work. Appreciate the posts.

By: flabdablet

flabdablet — Sat, 25 Mar 2006 22:54:33 -0800

According to Dipsomaniac's link, it's a Smitfraud variant. Spybot Search & Destroy has had Smitfraud on its shitlist for at least a year, so I'd be surprised if that didn't do a good job of getting rid of it.

One gotcha with the current SS&D (version 1.4): exit and restart it right after downloading updates, otherwise it doesn't always start a scan when you tell it to.

Obligatory broken-record barn-door-after-horse-bolted advice: if you use Firefox instead of Internet Explorer, crap like this will no longer infect your Windows box. And if you install the Adblock Plus and Adblock Filterset.G Updater extensions into Firefox, even the most clueless of your Windows box's users are unlikely to even see those shiny shiny click-me banners that cause most of the trouble.

By: theora55

theora55 — Sun, 26 Mar 2006 08:58:24 -0800

If you edit the registry, I recommend you edit any of the items in CurrentVersion->Run/RunOnce instead of deleting, just in case something is useful. Edit it ro read rem C:\path\executable.exe, which makes it a remark, and it will not be run, and you won't get an error message.