Spyware Warrior

[Brent]

I need to vent. The tenacity of this POS! Over the last few days I have been searching and reading and following instructions for its removal. Finally it is, I believe, gone. However I want to point out that nowhere in all the information I looked at did it reference that nasty little red icon in the system tray that looks like a bent (pun intended) tic tac toe grid. Everything I did even the manual removal of registry entries did not whack it. Smitfraud didn't do it completely so I am curious how and even why this has been overlooked. It was only after numerous attempts and then running Ad-Aware and Search and Destroy did it finally vanish. I don't know which because each found something the other didn't. What is even more perplexing is that Ad-Aware missed it in the early stages of this mission yet found a reference after I had gone through the Smitfraud process. During my reading I seem to recall a mention of Spydawn being coupled with a video codec. Low and behold Search and Destroy reported VCodec. I have seen this before and I have warned both my sons to be extremely wary when downloading. It doesn't seem to matter though, they inevitably end up with a problem and compound the problem by allowing their friends access. So...in conclusion I just want to point out to anyone who has been faced with this issue, to those of you who even read this, that if you still have a bent tic tac toe grid in your system tray DON'T TOUCH it. Don't even right click because the only function of the three that works is update and that installs Spydawn. How I wish it were 1969!
_________________
Cheers

Brent

[suzi]

Hi Brent,

Your frustratin is understood. SpyDawn and other smitfraud tyupe infections are a pain for sure. You can post a HijackThis log for review in that forum if you'd like. The helpers will check and make sure you are free of SpyDawn and the junk that come with it.

You might want to think about locking down your security better to prevent future similar infections. The information on this page might help:

http://spywarewarrior.com/sww-help.htm#other

Besides what's on that page, you might want to look at your web surfing behavior (or that of whoever uses your computer).

See this post for some addtional helpful info:

http://www.castlecops.com/postlite7736-.html

Some of it is duplication from the first link, but there is some other good info.

Number 3 is especially important.

Also here is a site where you can post your complaints along with many others.

http://malwarecomplaints.info/index.php

Take care and safe surfing!
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn.

[Brent]

Thank you for your comments. Thankfully it isn't my computer that is the concern. My two sons have their own rig on a seperate line. I will check out your recomendations and pass the information onto them as well. Hopefully they will learn from it.

I posted here mainly in the hope that someone may have an answer to why the system tray icon I mentioned isn't mentioned in the articles that I have read and why Smitfraud didn't deal with it. I looked at five or six different topics on the subject. The key element in all was Smitfraud with a variant for the fix but no mention of this icon; only the flashing question mark and the info bubble. I felt that this curious oversight was important enough to mention and that some far more computer savvy individual would pick up on it.
_________________
Cheers

Brent

[suzi]

The system tray icon is caused by a dll file, usually identified by antivirus and anti-spyware programs as FakeAlert, DesktopScam, Renos or Hoax.Win32.Renos.

See the info here:

http://research.sunbelt-software.com/threatdisplay.aspx?name=Trojan.FakeAlert&threatid=43521

http://www.pctools.com/mrc/infections/id/Trojan.Desktopscam/

http://www.f-secure.com/sw-desc/renos.shtml

The malware writers periodically release new dll files that are not yet detected and removed by Smitfraud fix or anti-spyware and AV programs. Evidently you were dealing with a new version of the dll file, which is why it wasn't removed.

Hope that helps.
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn.