adaware and spywareno

Lizard

unread,

Feb 13, 2006, 4:11:27 PM2/13/06

to

ever since i downloaded the latest deffinitions i have been getting two
hits of spyware named SpywareNo! i let adaware clean it but it keeps
comming back. i googled for a fix and found instruction for removal
manually. it still came back.

has anyone run into this? any other fixes?

ArchiveData(spywareno.bckp)
Referencefile : SE1R91 08.02.2006
======================================================

SPYWARENO
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[0]=Regkey : S-1-5-21-1923653786-2536883754-323391154-1004\software
\microsoft\windows\currentversion\ext\stats\{72267f6a-a6f9-11d0-bc94-
00c04fb67863}
obj[1]=RegData : software\microsoft\internet explorer\desktop\components
"GeneralFlags"

tia

jm...@webace.com.au

unread,

Feb 13, 2006, 7:15:32 PM2/13/06

to

No, but Google has.
http://www.google.com.au/search?hl=en&q=SPYWARENO+&btnG=Search&meta=

Lizard

unread,

Feb 13, 2006, 7:41:14 PM2/13/06

to

thanks for the response but been there, done that. the program says its
innocent of spyware, others say no. the next question is why does it come
back after using the remove instructions. btw, it does not show up when i
use hijackthis. it is found only with adaware.

tia

jm...@webace.com.au wrote in news:1139876132.020227.230410
@z14g2000cwz.googlegroups.com:

> http://www.google.com.au/search?hl=en&q=SPYWARENO+&btnG=Search&meta=

Sharktbbtfy

unread,

Feb 13, 2006, 7:45:30 PM2/13/06

to

Hi,

Are you running WindowsMe or XP? If so, have you turned off system restore?

Sharktbbtfy

Lizard

unread,

Feb 13, 2006, 10:06:07 PM2/13/06

to

yes, xpsp2. all updated. turned off restore, ran adaware and spybot in
safe mode, deleted prefetched files, even tried manually deleteing registry
keys shown in adaware log manually and still comes back.

thanks, any more ideas?

Sharktbbtfy <sha...@tw.net.co.uk> wrote in
news:VK9If.146236$vH5.1...@news.xtra.co.nz:

> Lizard wrote:
>> ever since i downloaded the latest deffinitions i have been getting
>> two hits of spyware named SpywareNo! i let adaware clean it but it
>> keeps comming back. i googled for a fix and found instruction for
>> removal manually. it still came back.
>>

snip..

Steven Burn

unread,

Feb 13, 2006, 10:56:07 PM2/13/06

to

"Lizard" <dra...@lizardnews.hawaii.rr.com> wrote in message
news:Xns9769ADF74B...@66.75.164.120...

> yes, xpsp2. all updated. turned off restore, ran adaware and spybot in
> safe mode, deleted prefetched files, even tried manually deleteing
registry
> keys shown in adaware log manually and still comes back.
>
> thanks, any more ideas?

http://www.wilderssecurity.com/showthread.php?t=120219

--
Regards

Steven Burn
Ur I.T. Mate Group
www.it-mate.co.uk

Keeping it FREE!

Lizard

unread,

Feb 13, 2006, 11:58:06 PM2/13/06

to

steve,

thanks for the research. i suspected i had a false positive since i could
not find the entries mentioned in the spywareno/sherrif revoval guides.
i'm still puzzled as to how to get rid the fp's, something is generating
this. no scans find the "Win32.TrojanDownloader.Small.awa" dropper that
could be reinstalling the two reg entries when i delete them, unless they
are regular entries to begin with.

thanks again

"Steven Burn" <some...@in-time.invalid> wrote in news:43f154ba$0$9230
$ed26...@ptn-nntp-reader01.plus.net:

bambam

unread,

Feb 14, 2006, 12:53:43 AM2/14/06

to

Lizard <dra...@lizardnews.hawaii.rr.com> wrote in
news:Xns97699566CB...@66.75.164.119:

> thanks for the response but been there, done that. the program says
> its innocent of spyware, others say no. the next question is why does
> it come back after using the remove instructions. btw, it does not
> show up when i use hijackthis. it is found only with adaware.

Post your hijackthis log, it will be there somewhere.

jm...@webace.com.au

unread,

Feb 14, 2006, 1:54:53 AM2/14/06

to

If you want to go down the HiJackThis path, here is the info.

Download HiJackThis, install & run to get a log file. Don't fix
anything yet.
Important: Create a specific folder on your hard drive called
HijackThis to keep its backups.
You can do this by going to My Computer (Windows key+e) then double
click on C: then right click and select New then Folder and name it
HijackThis. Download and unzip HijackThis.exe into this folder.
You then post the log file at a site provided below & it will tell you
what to fix.
http://www.merijn.org/downloads.html
http://tomcoyote.com/hjt/
Securing Your Computer: Temporarily Disable Real Time Monitoring
Programs
http://wiki.castlecops.com/Securing_Your_Computer:_Temporarily_Disable_Real_Time_Monitoring_Programs
Some security programs with active monitoring processes are known to
interfere with automatic scanners and can actually prevent HJT fixes
from taking effect.
Please turn off or disable any of the following programs you may have,
before running your preliminary scans and for the duration of your HJT
cleanup (should you post a log). To do disable these programs, please
follow the instructions provided in the respective sections. (After
your cleanup is complete, you should reactivate these protective
programs.) :
HJT Tutorials
http://www.bleepingcomputer.com/forums/tutorial42.html
http://www.spywareinfo.com/~merijn/htlogtutorial.html#r
http://www.spywareinfo.com/~merijn/htlogtutorial.html
http://castlecops.com/HijackThis.html

HijackThis log file analysis ( online )
http://hijackthis.de/index.php?langselect=english
Or,
http://startup.networktechs.com/page-68.html
http://hjt.iamnotageek.com/

bambam

unread,

Feb 14, 2006, 1:56:43 AM2/14/06

to

On Tue, 14 Feb 2006 05:53:43 +0000, bambam wrote:

> Post your hijackthis log, it will be there somewhere.

Forget that, I see Steven has found your answer.