SpywareBot rouge tool, how do i remove it?

john.c · Oct 5, 2009

Hi there,

I have been going thru the "Read & Run Me First" procedures and following it all to a T. i ran the SAS and MalwareBytes scans and neither found anything. Time to install and run ComboFix, i turned off all my anti-virus software and firewalls and a window warning came up: "ComboFix has detected the following realtime scanners to be active: Superantispyware and SpywareBot."

i went back and opened SAS and checked but the realtime scanner was NOT enabled. So I de-installed the program. Next i looked for SpywareBot in my programs and couldn't find it. I went back and checked the list in READ & RUN ME section about "add/remove" malware and sure enough, there is SpywareBot on the rouge tool list. Problem is it never showed up in the program list for me to simply de-install.

So, where do i find it and what do i do?

thanks,
john

dr.moriarty · Oct 10, 2009

Welcome to MajorGeeks, john.c

Please continue to run the remaining steps in the READ & RUN ME FIRST. Malware Removal Guide and attach the logs you were able to get.

dr.m

john.c · Oct 10, 2009

Dr. Moriarty, thanks for coming to my aid. I realized I should have attached the first two logs after I sent my initial plea for help, but didn't want to "bump" my thread.

I am running RootRepeal, and have been for hours. Hopefully it will be done by morning- rolleyes. I'll send you all the logs tomorrow.

Thanks again!
john

john.c · Oct 11, 2009

Re: RootRepeal scan, 30+ hours?

Hello geekdom.

I have been running a RootRepeal scan for about 30 hours. There is a running log on the screen so it has been working. I check in on it once in a while and it has been on the C:\Windows\winsxs for at least 8 hours today, which is the only thing that makes me wonder if something has stalled.

Can anyone assure me that a scan of this sort can take this long. I thought I was being patient, but at what point do you question thing. I've never witnessed a 30 scan.

Thanks! I'm letting it run until I hear otherwise.

dr.moriarty · Oct 12, 2009

Hello, john.c

Please stop RootRepeal and continue on with the rest of the scanning tools.

dr.m

john.c · Oct 12, 2009

Dr. M, thanks again. I let it run all night and checked again this morning before heading to work, the scan had moved on to a new part of the C: drive so I let it keep going. I will stop it if that is best, and I'll assume I can and should save the log that has been produced thus far?

thanks!
john

dr.moriarty · Oct 12, 2009

Please just move on to the other tools. It is important for us to get those logs as quickly as we can, rather than take the chance of the infection doing further damage before we get them.

dr.m

john.c · Oct 12, 2009

Dr. M,

I stopped the RootRepeal scan, but have attached the log as far as it had gotten before stopping. ComboFix is the one we didn't run, so it isn't here.

Thanks for the help!

John

Kestrel13! · Oct 26, 2009

Hi there, Dr M is away at the moment so I shall be helping you with your problems.

Whilst I review your set of logs, I would like to draw to your attention the fact that the version ofSUPERantispyware that you have installed is out of date:

Important Notice: A new version of SUPERAntiSpyware is available.

Please uninstall your current version (this is necessary).

Then download this SUPERAntiSpyware

Install this new version. It may tell you that you need to reboot to complete the installation. You must reboot at this time.

After the reboot, run SUPERAntiSpyware and immediately click the Check for Updates button to get more updates for the database.

Now run a new full scan of your system. And attach this log later.

I will get back to you with a set of instructions as soon as possible.

Kestrel13! · Oct 27, 2009

Don't forget to attach the log from SAS.

1. Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

F3 - REG:win.ini: load=
F3 - REG:win.ini: run=
Click to expand...

After clicking Fix exit HJT.

2. Were you positive that Combofix reported that spywarebot was detected as a realtime scanner, or was it spybot search and destroy? Either way I see that neither are installed.

3. Why were you running the malware removal procedures in the first place? What got you here requesting help for malware removal besides seeing what combofix reported before you aborted it's scan?

4. Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.

Thanks
kes

john.c · Oct 27, 2009

Kestrel, Thank you for getting to this and for the help.

Attached is the new SAS log and MG log.

I began the READ ME RUN ME for reason most probably do, my system was slow and suspected virus. I probably would have been satisfied that my machine was clean except for that ComboFix notification that spywarebot was detected to be running. Knowing that that is rouge tool I figured that was good reason to request help. I aborted the scan because I was told to here by Dr. Moriarty.

I am sorry if this is not good reason to request help.

I assumed that the spywarebot was the problem I was looking for?

Thanks again for the help.

john

Kestrel13! · Oct 30, 2009

I aborted the scan because I was told to here by Dr. Moriarty.
Click to expand...

He told you to abort the RootRepeal scan.

In any case, your logs are clean

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we used Pocket Killbox during your cleanup, do the below

Run Pocket Killbox and select File, Cleanup, Delete All Backups

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

john.c · Oct 30, 2009

Thank you Kestrel13, et al.

You are correct, I aborted RootRepeal NOT ComboFix (I never started ComboFix because of the scary warning it gave re: spywarebot running and continuing could possibly create problems, etc.)

But I trust the experts here and if you say my machine is clean I will surf on with confidence. But I will seriously considering upgrading my OS from the painful Vista system to Windows 7, though I think it should be a free "upgrade" for Vista sufferers!

Once again, I apologize if my request for help was a less than important use of your time. Know that it was appreciated though.

Thanks again,
john

Kestrel13! · Oct 31, 2009

Not a problem

But I quite like Vista, even though I only get to use it for half of the week, and XP the rest. I would not consider upgrading to Windows 7 yet because I can't justify doing so after only buying this laptop with Vista on it about a year ago.

safe surfing :wave

Log in or Sign up

SpywareBot rouge tool, how do i remove it?

john.c Private E-2

dr.moriarty Malware Super Sleuth Staff Member

john.c Private E-2

john.c Private E-2

dr.moriarty Malware Super Sleuth Staff Member

john.c Private E-2

dr.moriarty Malware Super Sleuth Staff Member

john.c Private E-2

Attached Files:

mbam-log-2009-10-05 (18-54-47).txt

rootrepeal_log.txt

SUPERAntiSpyware Scan Log - 10-05-2009 - 00-22-17.log

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

john.c Private E-2

Attached Files:

SAS Scan Log - 10-26-2009 - 23-27-09.log

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

john.c Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member