Printable Version of Topic

Posted by: admin Mar 25 2006, 12:37 PM

How-to remove SpywareQuake

SpywareQuake Screenshot:


credit Grinler, Miekiemoes and Flrman1:

SpywareQuake looks like a legitimate application for removal of spyware, but it's installed by a trojan in an attempt to trick you into buying it. SpywareQuake will also pop-up fake alerts that resemble system alerts in another attempt to get you to buy it. Do not buy SpywareQuake. Remove it. To get SpywareQuake completely and properly removed, smitRem needs to be run from the user account that is infected.

Removal Instructions:

Step 1:

• http://www.geekstogo.com/forum/index.php?act=Print&client=printer&f=99&t=104439 out these instructions as we will need to close every window that is open later in the fix.
• Download http://noahdfear.geekstogo.com/click%20counter/click.php?id=1 ©noahdfear, and save the file to your desktop.
  • Double click on the file to extract it to it's own folder on the desktop.
  • If you look on your desktop you will now see a folder called smitRem.

Step 2:

• Next, please reboot your computer into http://www.bleepingcomputer.com/forums/tut61.html by doing the following:
  • Restart your computer.
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  • Select the first option, to run Windows in Safe Mode.
  • When you are at the logon prompt, log in as an Administrator.
• When your computer has started in SafeMode and you see the desktop.
• Click on Start > Control Panel > Double-click on the Add or Remove Programs icon.
• Find the entry for SpywareQuake and double-click on it. Follow the prompts to uninstall the program, but do not allow it to reboot the computer if it asks.
• Delete the following folder (Do not be concerned if this folder does not exist):
  • C:\Program Files\SpywareQuake <-- Folder
• Close all Windows.

Step 3: (while still in SafeMode)

• Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
• If there is an uninstaller present for an infection that smitRem removes it will start this uninstaller.
• Simply click on the Uninstall button and allow the uninstaller to finish. When it is completed, it will close automatically and smitRem will prompt you to continue. Now you should press any key to continue.
• Wait for the tool to complete and Disk Cleanup to finish.
• The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed.
• Next go to Control Panel click Display > Desktop > Customize Desktop > Web > Uncheck "Security Info" if present.

Optional: Use this step only if your computer still seems infected:

Step 4:

• Reboot your system back into Normal Mode and perform an online scan with http://www.pandasoftware.com/products/activescan.htm
  • Once you are on the Panda site click the Scan your PC button.
  • A new window will open...click the Check Now button.[list]
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• When the download is complete, click on Local Disks to start the scan
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
  
  To confirm that SpywareQuake is removed from your computer

Post the contents of the Panda ActiveScan report, along with a new HijackThis Log, the contents of smitfiles.txt in a new Topic in the http://www.geekstogo.com/forum/index.php?showforum=37

=====================================================================
This is a self-help guide. Use at your own risk.

Important Note: If you need assistance with SpywareQuake, please start a new topic in our http://www.geekstogo.com/forum/Malware-Removal-HiJackThis-Logs-Go-Here-f37.html.

Posted by: admin Jul 12 2007, 04:16 PM

This topic has been left open to allow specific questions and comments related ONLY to this guide. It's NOT for posting HJT logs, links to your logs, or any other general malware help. Replies not following these rules will be deleted. Thanks for your cooperation.