Black Friday

Big Savings, No Waiting

Spyware Quake Removal from SYSTRAY

Posted 4/19/2006 6:42 PM
#30047
User avatar

cashbagg Member

Date Joined Nov 2016
Total Posts: 1
Hi. I recently caught the SPYWARE QUAKE virus. Long story short, I was able to remove it by the following method: https://forums.pcworld.co.nz/showpos...458&postcount=5

My homepage is ok now, computer runs fine, and virus seems to be gone BUT I cannot get rid of the annoying "Virus Alert" icon in my systray (it blinks between a handicap sympbol a no access symbol) and every few mins a get a little box popup in corner that says something like "your computer is infected blah blah blah..." VERY ANNOYING! I've looked in startup, nothing shows, i've ran msconfig, and diabled all unknown processes, still shows up on reboot. All I can do is hide the icon, but I still get the corner popup. Can anyone tell me how i can delete this annoyance???? Thx!!!
Posted 5/2/2006 7:19 PM
#30308
User avatar

Twistah Member

Date Joined Nov 2016
Total Posts: 1
Spyware Quake is a trojan that displays an icon in the system tray. SpywareQuake looks like a legitimate application for removal of spyware, but it's installed by a trojan in an attempt to trick you into buying it. The trojan is able to change the Internet Explorer default home page and redirect the web browser to malicious web sites. SpywareQuake will also pop-up fake alerts that resemble system alerts in another attempt to get you to buy it.

Your best defense to remove Spyware Quake, or any other spyware, is to detect and delete Spyware Quake processes, registry keys, DLL files, and other hazardous Spyware Quake files from your computer.

Note: This manual removal process is difficult and you run the risk of destroying your computer.

At least it is good to try to understand what is going on in your computer:

Remove Spyware Quake processes:
spywarequakeinstaller.exe
spywarequake.exe
uninst.exe

Remove Spyware Quake registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpywareQuake
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
SharedTaskScheduler\{E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D}
HKEY_CLASSES_ROOT\Typelib\{661173EE-FA31-4769-97D4-B556B5D09BDA}
HKEY_CURRENT_USER\Software\Classes\CLSID\{E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowserHelper Objects\{4DA4616D-7E6E-4FD9-A2D5-B6C535733E22}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareQuake HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\App Paths\SpywareQuake.exe\: "%programfiles%\SpywareQuake\SpywareQuake.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run\SpywareQuake: "%program files%\SpywareQuake\SpywareQuake.exe /h"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall\SpywareQuake\DisplayName: "SpywareQuake 2.0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall\SpywareQuake\UninstallString: "%programfiles%\SpywareQuake\uninst.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall\SpywareQuake\DisplayIcon: "%programfiles%\SpywareQuake\SpywareQuake.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall\SpywareQuake\DisplayVersion: "2.0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall\SpywareQuake\NSIS:StartMenuDir: "SpywareQuake"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall\SpywareQuake\URLInfoAbout: "https://www.spywarequake.com"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall\SpywareQuake\Publisher: "SpywareQuake.com"
HKEY_LOCAL_MACHINE\SOFTWARE\SpywareQuake\refid: "1"
HKEY_LOCAL_MACHINE\SOFTWARE\SpywareQuake\Language: "1033"

Unregister Spyware Quake DLL files:
stickrep.dll
msvcp71.dll
msvcr71.dll

Detect and Delete these Spyware Quake files:
dfrgsrv.exe
mssearchnet.exe
nvctrl.exe
spywarequake 2.0 website.lnk
spywarequake 2.0.lnk
uninstall spywarequake 2.0.lnk
spywarequake 2.0.lnk
blacklist.txt
ref.dat
spywarequake.url
sq.ini
english.ini
hp[X].tmp
ld[X].tmp

Our Recommendation

To avoid the unnecessary risk of damaging your computer, we highly recommend you use a good spyware cleaner/remover to track Spyware Quake and automatically find and remove other spyware, adware, trojans, and viruses in your PC.

Spyware Quake Automatic Remover
Download Spyware Quake remover software.

https://www.spywareremove.com/removeSpyware_Quake.html



[red] [/red][black] [/black]
Posted 5/9/2006 5:18 PM
#30505
User avatar

FordJenn Member

Date Joined Nov 2016
Total Posts: 2
We have seen this piece of cr*ap more than a dozen times in the past week in our service center. SpywareQuake is a new variant of the SpyFalcon and SpySherriff infections. I think a new variant has been released because all of a sudden customers started reporting that our free online removal tutorial stopped working. It seems that three new files have been appearing on the hard drives we have looked at. The files are all located in the System32 folder and they are msvcp71.dll, msvcr71.dll, and stdole3.tlb.

We have updated our tutorial at https://www.schrockinnovations.com/removespywarequake.php to include these files, and now it seems to be working again. If anyone knows about a completely automated (and free) tool to remove this, post about it because it would save me a boatload of time.

Sincerely,

Thor Schrock
Schrock Innovations, Inc.
https://www.schrockinnovations.com
866-496-8772
Posted 6/1/2006 5:13 AM
#31203
User avatar

nim52 Member

Date Joined Nov 2016
Total Posts: 2
I tried the above link and it didn't work. It listed three processes that needed to be shudown. None where there, but the trojan appeared to be running since we were still getting the virus alert pop-ups that resemble the MSN Messenger new mail pop-ups from the icon on the system tray. It looked like the trojan has somehow hidden itself from the task manager because there was very few processes running and all looked legit. I went through and tried to close them anyways (had to use shutdown -a), except for explorer.exe and still couldn't get rid of the icon in the system tray.
Posted 6/1/2006 10:13 AM
#31210
User avatar

without a cause Member

Date Joined Nov 2016
Total Posts: 1
it seemed o work for me try linking from here https://www.schrockinnovations.com/removespywarequake.php and follow the direcions exactly
Posted 6/1/2006 8:27 PM
#31216
User avatar

nim52 Member

Date Joined Nov 2016
Total Posts: 2
Went through the whole routine again and still had the same problem. I ran the .reg file and the .bat file in Safe Mode and I tried deleting msvcp71.dll and msvcr71.dll but Windows said that they were in use. The icon was still there giving pop-ups. And the processes were nowhere to be found in the task manager.
Posted 6/26/2006 2:29 PM
#32450
User avatar

planas1 Member

Date Joined Nov 2016
Total Posts: 2
What gets rid of that annoying pop-up thingy is to delete Viwpzla.dll from sytem32 folder.
Posted 8/4/2006 6:52 PM
#34596
User avatar

AKULA Member

Date Joined Nov 2016
Total Posts: 1
Dude I know exactly how you feel. I had the exact same problem and I removed it like most of the instructions out there said and the icon was still there. My problem was exactly like yours sooooo... Here is what I did to remove it.

After removing it following all the instructions and finding that de!!!!e the fact that the Spyware Quake software 'looks' like it is gone the icon with that goddamm annoying warning was still there. I found this sight

https://www.bleepingcomputer.com/forums/topic47826.html#automated




And got to step 10. On a hunch I checked to see if that annoying icon was gone and IT WAS!!!! :)




Did a restart and then shut down and re boot. Both times the icon was gone so I am assuming it is no longer there. This should do the trick for you. Good luck.
  • Unread posts or replies
  • No unread posts or replies
  • Unread Posts (Read Only Forum)
  • No Unread Posts (Read Only Forum)

Forum Information

Currently it is Saturday, November 27, 2021, 6:28 AM (GMT +1)
There are a total of 61,939 posts in 13,683 threads.
In the last 3 days there were 0 new threads and 0 reply posts.

Who's online

This forum has 38,655 registered members. Please welcome our newest member, Vina.
74 Guest(s), 0 Registered Member(s) are currently online.
×

Just a minute

Privacy has never been so important.

Nearly 50% of online users are now using a VPN to protect their privacy.

Find out why

…and if it grabs you bag yourself a VPN bargain.