UNSOLVED
RA
ron.allencts.ed
1 Rookie
•
70 Posts
0
2374
July 3rd, 2007 03:00
Spylocked won't go away: help needed
I was recently visited by Spylocked. It took over my browser so that every time I opened, I got a garish screen saying that my computer is over run with spyware and that a certain download would fix it. This was accompanied by a little icon on the lover right hand tray of the screen from which periodically pops a little bubble with a similar message. "System alert: System has detected, etc." With Spy Sweeper, Ad Aware, Spy Bot and McAfee anti-virus, I thought I had gotten rid of Mr. Spyblocked. The browser screen is now, indeed, gone. But the icon and the bubble remain.
I have looked in misconfig and regedit, but have not been able to find suspcious files to delete. Through Internet Properties I have deleted past history, cookies, etc. I have run Spy Sweeper in Safe Mode, but Mr. Spylocked persists.
I would welcome suggestions as to what to try.
ron.allencts.ed
1 Rookie
•
70 Posts
783
0
Posted July 3rd, 2007 08:00
At www.pchell.com/support/spylocked.shtml I found a series of programs that seem to have fixed the problem--SmitRem, SmitFraudFix, RogueRemover, CCleaner, and they suggested running HijackThis, but the problem disappeared before I did that . I ran the first four. Things seem ok now.BeTheReason
16 Posts
783
0
Posted July 3rd, 2007 12:00
The easiest fix for a virus/spyware problem is a complete OS reinstall. This should be my new moto.- For anyone using this thread for research, one of the tools that was run is obsolete and does not work on Spylocked or newer variants. Many Do-It-Yourself fixes rely on overkill because they cannot see exactly what components of which infections are involved in each case, so having a user run more tools than would be necessary is what happens. Please note that the information on the page referred to is several months old. These infections change daily.
By following the instructions posted by 1972vet, the problem could have been fixed without using four tools.
BeTheReason, thank you for the input. Some people feel that a reformat is the most complete way and quickest way to clean malware, but for many users, that is not the "easiest fix".
Edit: ky331, I had this page open for a while and did not realize you had already replied to it. Thanks! You said it in better detail than I did.
Message Edited by Bugbatter on 07-03-2007 10:22 AM ron.allencts.ed
1 Rookie
•
70 Posts
783
0
Posted July 3rd, 2007 13:00
Very full and easy to follow. I am greatly enlightened by your remarks about using some of these programs under guidance.- BeTheReason:You're certainly entitled to your motto/belief. But it stands in direct contradiction to what we advise here in the virus/spyware [and HiJackThis] forum : Reformatting a PC, and/or reinstalling Windows, should only be done as an absolute last-resort, when all other viable options have been exhausted.
- Ron,Good to hear that the pchell procedure worked for you. But unless I'm mistaken [and I would like for the HJT experts to comment freely here], much of what was outlined there was redundant and overkill --- and I think the general public reading this thread should be advised as such.The pchell page suggested running the following (in safe mode), in this order:1) SmitRem (by NoahdFear)2) SmitFraudFix (by S!ri)3) RogueRemover4) CCleaner5) HiJackThisComments:Spylocked is one of many "SmitFraud variants" (and I choose to refer to this more general classification).a) SmitFraudFix [item (2) in the above list] is the current "tool of choice" by the HJT experts. It is best run under advice/supervision of the HJT experts (in the HJT forum). To the best of my knowledge, SmitFraudFix, on its own, should have handled your problem, without needing any of the other tools. Caveat: see comment (c) below.b) SmitRem [item (1) in the above list] used to be the "tool of choice". However, as I understand it, NoahdFear no longer "maintains" the program --- it has not been updated in over a year. [This is due to the overwhelming popularity and success of SmitFraudFix].c) As part of the repair process, both SmitRem and SmitFraudFix will reset the user's background/WallPaper. This will happen even if SmitRem or SmitFraudFix try to repair a "clean" system (i.e., one not infected with a SmitFraud variant). As such, the general public should take great care against indiscriminately running these tools on their own!d) In contrast, RogueRemover is a "safer" approach for the general public to try using: If no SmitFraud variant is found, it will advise you as such, and not attempt any further action (such as re-setting the WallPaper). However, several members in these forums have reported only limited success in using RogueRemover when actually infected by a SmitFraud variant. [Note: SuperAntiSpyware (which is not mentioned on the pchell page) seems to do a better job in combating SmitFraud variants, than does RogueRemover (at least, in terms of "user-friendly" scanners)].e) I don't know that CCleaner actually "targets" Smitfraud variants. [It may clean-up a lot of other garbage, but...]f) HiJackThis is highly technical/personalized. The particular symptoms that appear in one person's log --- for example, the log offered on the pchell page --- may not correspond to what another infected user might find in their HJT log. As such, fixing things with HJT should only be done under advice/supervision of HJT experts.
Message Edited by ky331 on 07-03-2007 10:08 AM - As was recently discovered, removing some of these malware problems can be akin to chasing one's tail if not done in specific order.
Along with most any trojan downloaded, comes many other cousins of the malware...and some of these malware programs are designed to hide other malware programs. To insure a successful "fix", removing them must be done in a supervised environment unless the victim is confident that he/she KNOWS what steps to take and fully trusts their own security setup.
Depending on what security applications one has on board (or doesn't have), and what steps had already been taken prior to using any sort of "Self Help" tutorial, these removal attempts could turn out to be futile.
If there are any casual forum readers perusing this thread who consider themselves novice users, then your best plan to attack your malware issues would be to post a hijackthis log and wait for one of our expert volunteers to guide you through the process. Doing this on your own may well amount to a waste of your time and effort.
1972vet
3305 Posts
783
0
Posted July 3rd, 2007 04:00