SpywareQuake
SpywareQuake Description
SpywareQuake is a trojan that displays an icon in the system tray. SpywareQuake looks like a legitimate application for removal of spyware, but it installs a trojan in an attempt to trick you into buying the software. The SpywareQuake trojan is able to change the Internet Explorer default home page and redirect the web browser to malicious web sites. SpywareQuake will also pop-up fake alerts that resemble system alerts in another attempt to get you to buy it.
Aliases
Trojan.Dldr.Alphabet.LH1 [Webwasher-Gateway]VIPRE.Suspicious [Sunbelt]Troj/Nonaco-Gen [Sophos]Suspicious file [Panda]probably unknown NewHeur_PE virus [NOD32v2]TrojanDownloader:Win32/Nonaco.A [Microsoft]Suspicious Trojan/Worm [eSafe]Trojan.DownLoader.25873 [DrWeb](Suspicious) - DNAScan [CAT-QuickHeal]Generic.Drop.Alpha.3CEE6CC4 [BitDefender]
More aliases (12)
SpywareQuake Automatic Detection Tool (Recommended)
Is your PC infected with SpywareQuake? To safely & quickly detect SpywareQuake, we highly recommend you run the malware scanner listed below.
Download SpyHunter's* Malware Scanner to detect SpywareQuake
What happens if SpywareQuake does not let you open SpyHunter or blocks the Internet?
Technical Details
File System Modifications
Tutorials: If you wish to learn how to remove malware components manually, you can read
the tutorials on how to find malware,
kill unwanted processes,
remove malicious DLLs and
delete other harmful files. Always be
sure to back up your PC before making any changes.
- The following files were created in the system:
# File Name Detection Count 1 winB471.tmp.exe 658 2 win15.tmp.exe 630 3 SpywareQuake.exe 534 4 SpywareQuakeInstaller[1].exe 468 5 SpywareQuakeInstaller.exe 454 6 ref.dat 372 7 win3.tmp.exe 300 8 win35.tmp.exe 155 9 fccbx.dll 80 10 ixt0.dll N/A
More files
Registry Modifications
Tutorial: To edit and delete registry entries manually, read the tutorial on
how to remove malicious registry entries.
Tip & Warning: Editing and removing the wrong registry keys can severely damage your PC, so remember to backup your Windows Registry! To optimize your Windows Registry and speed up your PC, download RegHunter's registry cleaner.
Tip & Warning: Editing and removing the wrong registry keys can severely damage your PC, so remember to backup your Windows Registry! To optimize your Windows Registry and speed up your PC, download RegHunter's registry cleaner.
- The following newly produced Registry Values are:
HKEY..\..\{Value}Software\Microsoft\Internet Explorer\Toolbar, value: {052b12f7-86fa-4921-8482-26c42316b522}SOFTWARE\Microsoft\Internet Explorer\Toolbar, value: {fbea0445-4c4a-4136-864a-c72a4a182a84}Software\Microsoft\Internet Explorer\Toolbar\WebBrowser, value: {052B12F7-86FA-4921-8482-26C42316B522}SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler, value: {EA26CE12-DE64-A1C5-9A4F-FC1A64E6AC2E}SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler, value: {AC1B4DA2-12FA-31F2-1A7D-CD2B14E6AD4E}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}SpywareQuake.exewin26.tmp.exeHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}SafetyBarSpywareQuake - The following CLSID's were detected:
HKEY..\..\{CLSID Path} {052b12f7-86fa-4921-8482-26c42316b522}{411F83B1-A0EC-4155-AF99-0137F5EFB270}{66189AF2-7726-46E8-8628-0F95AB854792}{61032A65-2371-4C89-B5BB-DF73090FB5EA}{9989A9BC-9828-467E-AF06-E3B279E6E97B}{82C6C396-DD7B-4CE5-B668-C0087D1F3A1F}{5B55C4E3-C179-BA0B-B4FD-F2DB862D6202}{94786C47-EB3F-4BD5-A66B-0D49E2C90541}{C1C56112-2B2E-4D3C-8CFC-7E10C77FACEF}{E5AD5BD5-C710-45E0-ABD3-E770FE85DAE8}{DDB0D689-FAE0-4165-9F7C-877602F9DD66}{89e4aaba-3b21-49b3-b922-8ca35193c68e}{EA26CE12-DE64-A1C5-9A4F-FC1A64E6AC2E}{AC1B4DA2-12FA-31F2-1A7D-CD2B14E6AD4E}{BEC8A83D-01D4-4F15-B8A9-4B4AB24253A7}{BA397E39-F67F-423F-BC6E-65939450093A}{9283DAC1-43F5-4580-BF86-841F22AF2335}{86C7E6C3-EC47-44E5-AA08-EE0D0A25895F}{23D627FE-3F02-44CF-9EE1-7B9E44BD9E13}{C4EEDC19-992D-409A-B323-ED57D511AFA5}{5D42DDF4-81EB-4668-9951-819A1D5BEFC8}{DD90F677-D205-4F70-9014-659614AABCB2}{661173EE-FA31-4769-97D4-B556B5D09BDA}{AE90CAFC-09D4-47F0-9E11-CE621C424F08}{5790B963-23C5-43C1-BCF5-01C9B5A3E44E}{D5A9F682-4A26-4920-90D2-72AD8CF3442B}{39f25b12-74ff-4079-a51f-1d70f5b08b84}{a43385f0-7113-496d-96d7-b9b550e3fcca}
Additional Information
- The following cookies were detected:
spywarequake
Posted: May 30, 2006 | By SpywareRemove
MoreThreat Level: 10/10
(No Ratings Yet)
Loading ...Rate this article:
Detection Count: 52
Security Shield is a virus and won’t let me off without a credit card. It keeps popping up to make me accept their so-called “Protection” for $79.99 or something. IT IS A VIRUS