Have a problem and would like to ask us for help? To learn how to ask your question Click Here! Do you have popups or other malware infecting your computer? If so, Start Here! Are you having trouble using this site? Then you should visit the New User Orientation Center!
AntiSpyCheck is the latest rogue anti-spyware advertised
and installed through the Zlob Trojan. The Zlob Trojan is a malware that masquerades
as a video or audio codec required to be installed in order to watch a movie
on the Internet. In reality, though, when this Trojan is installed, it will
install a variety of malware that displays advertisements and fake alerts stating
that you are infected with various security risks. It will also advertise, and
install, the AntiSpyCheck program on your computer without permission.
Once installed, AntiSpyCheck will automatically start scanning your computer
and list various security risks that are supposedly present. In order to remove
any of these risks, though, you must first purchase the program. These supposed
infections are in fact not real. They are instead legitimate programs and directories
being falsely marked as infections in order to scare you into purchasing AntiSpyCheck.
AntiSpyCheck screen shot For more screen shots of this infection click on the image above. There are a total of 7 images you can view.
This guide will walk you through removing the AntiSpyCheck, the Zlob Trojan,
any associated malware.
06/11/08 - Initial guide creation.
06/24/08 - Added more SharedTaskScheduler infectors.
06/26/08 - Added more SharedTaskScheduler infectors.
07/02/08 - Added more SharedTaskScheduler infectors.
07/07/08 - Updated for new folder name, infectors, and file names.
07/08/08 - Updated for new infector
07/15/08 - Updated for new infectors
07/20/08 - Updated for new infectors
07/29/08 - Updated for new infectors and version.
Once downloaded, close all programs and Windows on your computer, including
this one.
Double-click on the icon on your desktop named mbam-setup.exe.
This will start the installation of MBAM onto your computer.
When the installation begins, keep following the prompts in order to continue
with the installation process. Do not make any changes to default settings
and when the program has finished installing, make sure you leave both the
Update Malwarebytes' Anti-Malware and Launch
Malwarebytes' Anti-Malware checked. Then click on the Finish
button.
MBAM will now automatically start and you will see a message stating that
you should update the program before performing a scan. As MBAM will automatically
update itself after the install, you can press the OK button
to close that box and you will now be at the main program as shown below.
On the Scanner tab, make sure the the Perform
quick scan option is selected and then click on the Scan
button to start scanning your computer for AntiSpyCheck related
files.
MBAM will now start scanning your computer for malware. This process can
take quite a while, so we suggest you go and do something else and periodically
check on the status of the scan. When MBAM is scanning it will look like the
image below.
When the scan is finished a message box will appear as shown in the image
below.
You should click on the OK button to close the message box and continue with
the AntiSpyCheck removal process.
You will now be back at the main Scanner screen. At this point you should
click on the Show Results button.
A screen displaying all the malware that the program found will be shown
as seen in the image below. Please note that the infections found may be different than what is shown in the image.
You should now click on the Remove Selected button to remove
all the listed malware. MBAM will now delete all of the files and registry
keys and add them to the programs quarantine. When removing the files, MBAM
may require a reboot in order to remove some of them. If it displays a message
stating that it needs to reboot, please allow it to do so. Once your computer
has rebooted, and you are logged in, please continue with the rest of the
steps.
When MBAM has finished removing the malware, it will open the scan log and
display it in Notepad. Review the log as desired, and then close the Notepad
window.
You can now exit the MBAM program.
Your computer should now be free of the AntiSpyCheck program. If your current anti-virus solution let this infection through, you may want to consider purchasing the PRO version of Malwarebytes' Anti-Malware to protect against these types of threats in the future.
If you are still having problems with your computer after completing these instructions, then please follow the steps outlined in the topic linked below:
Confirm that the file SmitfraudFix.exe now resides
on your desktop, but do not double-click on the icon as of yet. We will use
it in later steps. The icon will look like the one below:
Next, please reboot your computer into Safe
Mode by doing the following:
Restart your computer
After hearing your computer beep once during startup, but before the
Windows icon appears, press F8.
Instead of Windows loading as normal, a menu should appear
Select the first option, to run Windows in Safe Mode.
When you are at the logon prompt, log in as the same user that you had
performed the previous steps as.
When your computer has started in safe mode, and you see the desktop, close
all open Windows.
Now, double-click on the SmitFraudfix icon that should be residing on your
desktop.The icon will look like the one below:
When the tool first starts you will see a credits screen. Simply press
any key on your keyboard to get to the next screen.
You will now see a menu as shown in the image below. Press the number 2
on your keyboard and the press the enter key to choose the
option Clean (safe mode recommended).
The program will start cleaning your computer and go through a series of
cleanup processes. When it is done, it will automatically start the Disk Cleanup
program as shown by the image below.
This program will remove all Temp, Temporary Internet Files, and other files
that may be leftover files from this infection. This process can take up to
a few hours depending on your computer, so please be patient. When it is complete,
it will close automatically and you will should continue with step 11.
When Disk Cleanup is finished, you will be presented with an option asking
Do you want to clean the registry ? (y/n). At this
screen you should press the Y button on your keyboard and
then press the enter key.
When this last routine is finished, you will be presented with a red screen
stating Computer will reboot now. Close all applications.You should now press the spacebar on your computer. A counter will appear
stating that the computer will reboot in 15 seconds. Do not cancel this countdown
and allow your computer to reboot.
Once the computer has rebooted, you will be presented with a Notepad screen
containing a log of all the files removed from your computer. Examine this
log, and when you are done, close the Notepad screen.
Your computer should now be free of the AntiSpyCheck
infection.
If you are still having problems with your computer after completing these instructions, then please follow the steps outlined in the topic linked below:
BleepingComputer.com can not be held responsible for problems that may occur by using this information. If you would like help with any of these fixes, you can post a HijackThis log in our HijackThis Logs and Analysis forum.
Have a problem and would like to ask us for help? To learn how to ask your question Click Here!
Do you have popups or other malware infecting your computer? If so, Start Here!
Are you having trouble using this site? Then you should visit the New User Orientation Center!
RSS
