General discussion

Locked

Fake message Spybot has blocked download

By lmayeda ·
One of my users has a virus or worm that I'm having difficulty cleaning. Using Windows 2000, Symantec Anivirus Corp 9.1, Spybot S&D, Adaware. First I emptied all of the Temporary Internet files and cookies and all TEMP files, and emptied the Recycle Bin. Ran Adaware and Spybot till it was clean, then ran Symantic with the latest definition files (had to reinstall since it had been disabled by a virus. Detected download.trojan, quarantined and deleted. I searched through the registry for names of some processes that looked suspicious and found in HK_USERS\Software\Microsoft\Internet Explorer\Explorer bars\filesNamedMRU whose right panel included about 20 entries of obvious spyware entries. I deleted the entire entry. I ran Symantec (clean). When I then started IE, I got the message "Spybot has blocked the download of "avenue A, Inc"! At first I said "OK". When I then checked the Temporary Internet File folders, it was full of a bunch of porn images. I then deleted the folders, got out of IE and ran it again. When I got the same message "spybot has blocked ...", I exited and checked the Temporary Internet folders ... no porn. Question: Which virus exactly am I dealing with and how can I clean it? A couple of days ago when I first worked on this PC, I had gone through the spyware and virus cleaning in SAFE MODE so something is still not being caught here. Any ideas? Thanks in advance.

This conversation is currently closed to new comments.

7 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

by Info-Safety, LLC In reply to Fake message Spybot has b ...

Try using webroot spysweeper. Currently, it has signatures for nearly 85,000 spyware traces. After you download it and get the latest updates, run it. If you get a notice that it couldn't remove certain files, boot into safe mode and delete them. Repeat the process until it reports a clean scan.

Good luck.

Craig Herberg

Collapse -

by lmayeda In reply to

I thought I had already accepted the first two answers and closed the question. I tried the Spysweeper Antispyware software first as well as uninstalled and re-installed Spybot (which I think had gotten corrupted). It seems to have stopped the immediate regeneration of porn being downloaded. I have another user who has a different spyware whose service keeps re-starting as soon as I disable it. Hopefully Spysweeper will be as successful with it. Thanks a lot!

Collapse -

by rhantson In reply to Fake message Spybot has b ...

I've had alot of great success utilizing CounterSpy and the Microsoft Beta Anti-Spyware... (yeah, the microsoft one...)

CounterSpy has been great on our network in removing just about everything... and I highly suggest it to anyone... personally, I've had too many recurring nightmares in the past from SpyBot and Adaware...

Hope these two help... (another one to try is Pest Patrol - another one that I've had alot of success with... but run both of these in SAFE MODE with ADMINISTRATOR RIGHTS) otherwise you are just defeating the purpose...

Collapse -

by lmayeda In reply to

To Rhantson and Kalaivanan, I have had MS Antispyware installed on my PC for a couple of weeks (in conjunction with a switch to Mozilla's Foxfire). The combination of the two seems to keep spyware down to a minimum although I don't usually pickup too many. I will give my next "problem child" a taste of the MS Antispyware to see if it is effective. Thank you for responding!

Collapse -

by kalaivanan.vvelan In reply to Fake message Spybot has b ...

I too will go with Microsoft Antispyware. I have had good luck with that. Thats the best free Antispyware product you can get.
Also download sysclean from trend micro at "http://www.trendmicro.com/download/dcs.asp" and run the scan in safe mode. This should remove any virus, worm or trojan. Of course this would require administrator access.

Collapse -

by lmayeda In reply to

Poster rated this answer.

Collapse -

by lmayeda In reply to Fake message Spybot has b ...

This question was closed by the author

Back to Security Forum
7 total posts (Page 1 of 1)  

Related Discussions

Related Forums