One of the spyware is causing anti-spyware to crash.

[harsha]

Hi,

I wanted to bring to your notice that , today my
system go attacked with one of the spyware with a name
begining with Trojan.The file name detected by MS
AntiSpyware are as follows

1.Trojan.BHO.NameShifter.DW
2.Trojan.Startup.NameShifter.mfcyv
3.Trojan.Startup.NameShifter.crhh32

and the threat level is given as high.

Problem :

When we try to remove this after the scaning , the
MS AntiSpyware is crashing , i tried many time , but when
it says Terminating spyware , it hangs totally and we
need to end the program forcfully.

Requst :

Please suggest me any action that i could take to
terminate these procecess manually (if it is possible) ,
other wise please update the patch for MS AntiSpyware so
that i could get it online.

Thanks for your time . . .Please do reply soon.

Thanks and Regards
Sriharsha

 

[Sriharsha]

Hi Engle,

Thank you very much for your reply.Here is the

status of the problm now.

I tried submitting the suspected spyware
report , but after the report is been created and when i
submit the report , a message saying that "an error
occured while submiting the report , please check your
proxy setting "is displayed , but actually my internet is
quite fine and it's broad band , please let me know what
could be the possible reason for submision failure.

And regarding the problem , i tried deleting the
restoration points as to your suggesion , but that did
not solve the problem , So still my PC is having that
Spyware.

Please let me know if you have got any other
suggetions to be implemented.

Thanks once again for your time.

Thanks and Regards
Sriharsha

 

[Engel]

Have you try to use an anti'trojan scanner. Not all
antivirus can detect malware. You can use any or both:

a-squared, is free.
ewido security suite. This is a 14 days trial, used and
delete before the date (or keep it).

Those programs specialistas on trojans, they work better
on safe mode.

 

[Ron Chamberlin]

Hi Sriharsha,

Boot into Safe Mode (F8) at startup;
Empty your temporary files AND your Temporary Internet Files* C:\Documents
and Settings\Username\Local Settings\Temporary Internet Files folder ;
Run the scan while in safe mode;
If you are running SP2, open IE--->Tools--->Manage Add-ons, and uncheck any
BHO's that you don't recognize.

Ron Chamberlin
MS-MVP



*The .tif are Temporary Internet Files, and are stored in a different barn
than 'normal' temp files.
Here's how I kludge thru to them: Open Windows Explorer--->C:\Documents and
Settings. Then it's to the Tool Bar--->Folder Options--->View--->Hidden
Files and Folders and check the box "Show hidden files and folders" > Now
expand C:\Documents and Settings and under each user you will now see a
folder "Local Settings". Open that puppy and choose Temporary Internet
Files. I am not concerned about the cookies therein, but everything else
can go for now.

 

[Engel]

Sriharsha

On #1, the last 2 letters are DW or DR

 

[Guest]

Hi Ron Chamberlin,

I tried that way , two out of three were removed by
MS AntiSpyware itself.Thank you for your valuble
suggesion.

Thanks and Regards
Sriharsha

 

[Harsha]

Hi Engle,

The last two letters are DW , sure coz i referd
back the scan results again.

Engle Thanks a lot for your suggesions and
support , now i am out of those three spywares.In fact it
worked as mentioned below.

1.I had downloaded the e-squaer trail version as you have
suggested and scaned by it , it detected only first item
what i had mentioned i.e. Trojan.BHO.NameShifter.DW , and
it successfully cleaned that.(Note that it had even
detected other two spywares which were detected by MS
antiSpyware).

2.I had started the system in safe mode and scaned by MS
AntiSpyware , with some difficulty (i.e. it hanged in
between but recovered by it self ) it cleaned up the
other two spywares i.e. Trojan.Startup.NameShifter.mfcyv
and Trojan.Startup.NameShifter.crhh32.

Any ways once again thanks a lot for your
support.Please let me know if you want me to provide any
further information regarding this problem ,So that you
could work on it.


Thanks and Regards
Sriharsha