The BullGuard products and services are part of NortonLifeLock Inc., a global leader in consumer Cyber Safety with a portofolio of brands including Norton, Avira and more. Learn more at

Spyware Quake Removal from SYSTRAY

Posted 4/19/2006 6:42 PM
User avatar

cashbagg Member

Date Joined Nov 2016
Total Posts: 1
Hi. I recently caught the SPYWARE QUAKE virus. Long story short, I was able to remove it by the following method:

My homepage is ok now, computer runs fine, and virus seems to be gone BUT I cannot get rid of the annoying "Virus Alert" icon in my systray (it blinks between a handicap sympbol a no access symbol) and every few mins a get a little box popup in corner that says something like "your computer is infected blah blah blah..." VERY ANNOYING! I've looked in startup, nothing shows, i've ran msconfig, and diabled all unknown processes, still shows up on reboot. All I can do is hide the icon, but I still get the corner popup. Can anyone tell me how i can delete this annoyance???? Thx!!!
Posted 5/2/2006 7:19 PM
User avatar

Twistah Member

Date Joined Nov 2016
Total Posts: 1
Spyware Quake is a trojan that displays an icon in the system tray. SpywareQuake looks like a legitimate application for removal of spyware, but it's installed by a trojan in an attempt to trick you into buying it. The trojan is able to change the Internet Explorer default home page and redirect the web browser to malicious web sites. SpywareQuake will also pop-up fake alerts that resemble system alerts in another attempt to get you to buy it.

Your best defense to remove Spyware Quake, or any other spyware, is to detect and delete Spyware Quake processes, registry keys, DLL files, and other hazardous Spyware Quake files from your computer.

Note: This manual removal process is difficult and you run the risk of destroying your computer.

At least it is good to try to understand what is going on in your computer:

Remove Spyware Quake processes:

Remove Spyware Quake registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowserHelper Objects\{4DA4616D-7E6E-4FD9-A2D5-B6C535733E22}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareQuake HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\App Paths\SpywareQuake.exe\: "%programfiles%\SpywareQuake\SpywareQuake.exe"
CurrentVersion\Run\SpywareQuake: "%program files%\SpywareQuake\SpywareQuake.exe /h"
CurrentVersion\Uninstall\SpywareQuake\DisplayName: "SpywareQuake 2.0"
CurrentVersion\Uninstall\SpywareQuake\UninstallString: "%programfiles%\SpywareQuake\uninst.exe"
CurrentVersion\Uninstall\SpywareQuake\DisplayIcon: "%programfiles%\SpywareQuake\SpywareQuake.exe"
CurrentVersion\Uninstall\SpywareQuake\DisplayVersion: "2.0"
CurrentVersion\Uninstall\SpywareQuake\NSIS:StartMenuDir: "SpywareQuake"
CurrentVersion\Uninstall\SpywareQuake\URLInfoAbout: ""
CurrentVersion\Uninstall\SpywareQuake\Publisher: ""
HKEY_LOCAL_MACHINE\SOFTWARE\SpywareQuake\Language: "1033"

Unregister Spyware Quake DLL files:

Detect and Delete these Spyware Quake files:
spywarequake 2.0 website.lnk
spywarequake 2.0.lnk
uninstall spywarequake 2.0.lnk
spywarequake 2.0.lnk

Our Recommendation

To avoid the unnecessary risk of damaging your computer, we highly recommend you use a good spyware cleaner/remover to track Spyware Quake and automatically find and remove other spyware, adware, trojans, and viruses in your PC.

Spyware Quake Automatic Remover
Download Spyware Quake remover software.

[red] [/red][black] [/black]
Posted 5/9/2006 5:18 PM
User avatar

FordJenn Member

Date Joined Nov 2016
Total Posts: 2
We have seen this piece of cr*ap more than a dozen times in the past week in our service center. SpywareQuake is a new variant of the SpyFalcon and SpySherriff infections. I think a new variant has been released because all of a sudden customers started reporting that our free online removal tutorial stopped working. It seems that three new files have been appearing on the hard drives we have looked at. The files are all located in the System32 folder and they are msvcp71.dll, msvcr71.dll, and stdole3.tlb.

We have updated our tutorial at to include these files, and now it seems to be working again. If anyone knows about a completely automated (and free) tool to remove this, post about it because it would save me a boatload of time.


Thor Schrock
Schrock Innovations, Inc.
Posted 6/1/2006 5:13 AM
User avatar

nim52 Member

Date Joined Nov 2016
Total Posts: 2
I tried the above link and it didn't work. It listed three processes that needed to be shudown. None where there, but the trojan appeared to be running since we were still getting the virus alert pop-ups that resemble the MSN Messenger new mail pop-ups from the icon on the system tray. It looked like the trojan has somehow hidden itself from the task manager because there was very few processes running and all looked legit. I went through and tried to close them anyways (had to use shutdown -a), except for explorer.exe and still couldn't get rid of the icon in the system tray.
Posted 6/1/2006 10:13 AM
User avatar

without a cause Member

Date Joined Nov 2016
Total Posts: 1
it seemed o work for me try linking from here and follow the direcions exactly
Posted 6/1/2006 8:27 PM
User avatar

nim52 Member

Date Joined Nov 2016
Total Posts: 2
Went through the whole routine again and still had the same problem. I ran the .reg file and the .bat file in Safe Mode and I tried deleting msvcp71.dll and msvcr71.dll but Windows said that they were in use. The icon was still there giving pop-ups. And the processes were nowhere to be found in the task manager.
Posted 6/26/2006 2:29 PM
User avatar

planas1 Member

Date Joined Nov 2016
Total Posts: 2
What gets rid of that annoying pop-up thingy is to delete Viwpzla.dll from sytem32 folder.
Posted 8/4/2006 6:52 PM
User avatar

AKULA Member

Date Joined Nov 2016
Total Posts: 1
Dude I know exactly how you feel. I had the exact same problem and I removed it like most of the instructions out there said and the icon was still there. My problem was exactly like yours sooooo... Here is what I did to remove it.

After removing it following all the instructions and finding that de!!!!e the fact that the Spyware Quake software 'looks' like it is gone the icon with that goddamm annoying warning was still there. I found this sight

And got to step 10. On a hunch I checked to see if that annoying icon was gone and IT WAS!!!! :)

Did a restart and then shut down and re boot. Both times the icon was gone so I am assuming it is no longer there. This should do the trick for you. Good luck.
  • Unread posts or replies
  • No unread posts or replies
  • Unread Posts (Read Only Forum)
  • No Unread Posts (Read Only Forum)

Forum Information

Currently it is Tuesday, May 17, 2022, 5:49 AM (GMT +2)
There are a total of 61,972 posts in 13,696 threads.
In the last 3 days there were 0 new threads and 0 reply posts.

Who's online

This forum has 38,682 registered members. Please welcome our newest member, frosty.
67 Guest(s), 0 Registered Member(s) are currently online.