CrackSpider

[user]

hello,

I seem to be cursed with the Crackspider malware.

I have tried using MS Antispyware, Adaware and Spyb ot, but cannot rid
my system of this.

Can anyone help?

Thanks in advance

User

[Stephen Howe]

> I have tried using MS Antispyware, Adaware and Spybot, but cannot rid
> my system of this.
>
> Can anyone help?

Did you run all of the above in Safe Mode?

- press F8 on Windows Start up, choose Safe Mode and run anti-spyware
- then reboot normally and rerun anti-spyware to make sure clean

SH

[siljaline]

"user" wrote:
> hello,
>
> I seem to be cursed with the Crackspider malware.
>
> I have tried using MS Antispyware, Adaware and Spyb ot, but cannot rid
> my system of this.

http://www.sarc.com/avcenter/venc/da...an.favadd.html

Silj

--
siljaline

[user]

On Wed, 13 Apr 2005 03:34:00 +0100, "Stephen Howe"
<sjhoweATdialDOTpipexDOTcom> wrote:

>> I have tried using MS Antispyware, Adaware and Spybot, but cannot rid
>> my system of this.
>>
>> Can anyone help?
>
>Did you run all of the above in Safe Mode?
>
>- press F8 on Windows Start up, choose Safe Mode and run anti-spyware
>- then reboot normally and rerun anti-spyware to make sure clean
>
>SH
>
thank you. I will try this out and report back.

cheers

user

[user]

On Wed, 13 Apr 2005 10:16:09 -0400, user <user@user.com> wrote:

>On Wed, 13 Apr 2005 03:34:00 +0100, "Stephen Howe"
><sjhoweATdialDOTpipexDOTcom> wrote:
>
>>> I have tried using MS Antispyware, Adaware and Spybot, but cannot rid
>>> my system of this.
>>>
>>> Can anyone help?
>>
>>Did you run all of the above in Safe Mode?
>>
>>- press F8 on Windows Start up, choose Safe Mode and run anti-spyware
>>- then reboot normally and rerun anti-spyware to make sure clean
>>
>>SH
>>
>thank you. I will try this out and report back.
>
>cheers
>
>user


Hi Stephen,

I followed your suggestion and was able to delete the offending files
while in safe mode. Upon reboot in normal mode, I ran MS Antispyware
again and found the same files evident. I ran the cleaner again in
safe mode and they were there again.

I also repeated the process with Ad Aware respectively and had the
same outcome.

I have run the latest virus definitions from NAV as well. Results are
clean.

Siljaline (thank you!) posted a site in response
http://www.sarc.com/avcenter/venc/da...an.favadd.html, which i
went to and followed the directions posted. No luck

So this malware won't go away. Ideas?

Thanks in advance for your help.

User

[Uncle Jean]

"siljaline" told the uncle and all the others:

» http://www.sarc.com/avcenter/venc/da...an.favadd.html
»
» Silj

Or this:

<http://www.sophos.com/virusinfo/analyses/trojfavaddd.html>

UJ

[user]

On Wed, 13 Apr 2005 14:43:31 -0400, user <user@user.com> wrote:

>On Wed, 13 Apr 2005 10:16:09 -0400, user <user@user.com> wrote:
>
>>On Wed, 13 Apr 2005 03:34:00 +0100, "Stephen Howe"
>><sjhoweATdialDOTpipexDOTcom> wrote:
>>
>>>> I have tried using MS Antispyware, Adaware and Spybot, but cannot rid
>>>> my system of this.
>>>>
>>>> Can anyone help?
>>>
>>>Did you run all of the above in Safe Mode?
>>>
>>>- press F8 on Windows Start up, choose Safe Mode and run anti-spyware
>>>- then reboot normally and rerun anti-spyware to make sure clean
>>>
>>>SH
>>>
>>thank you. I will try this out and report back.
>>
>>cheers
>>
>>user
>
>
>Hi Stephen,
>
>I followed your suggestion and was able to delete the offending files
>while in safe mode. Upon reboot in normal mode, I ran MS Antispyware
>again and found the same files evident. I ran the cleaner again in
>safe mode and they were there again.
>
>I also repeated the process with Ad Aware respectively and had the
>same outcome.
>
>I have run the latest virus definitions from NAV as well. Results are
>clean.
>
>Siljaline (thank you!) posted a site in response
>http://www.sarc.com/avcenter/venc/da...an.favadd.html, which i
>went to and followed the directions posted. No luck
>
> So this malware won't go away. Ideas?
>
>Thanks in advance for your help.
>
>User


A further addendum for those that may be interested:

I removed the contents of the favorites directory an saved them to a
floppy.

Ran the scan again, in safe mode and thought all was done. Even ran
Spy sweeper which came up clean and also ran NAV 2005 again.

I rebooted and found that my favorites had been populated again and
that MS Antispy again recognized Crackspider in the registry.

I am stumped. Can anyone help?

Thanks in advance,
User

[siljaline]

"Uncle Jean" wrote:
> "siljaline" told the uncle and all the others:
>
> » http://www.sarc.com/avcenter/venc/da...an.favadd.html
> »
> » Silj
>
> Or this:
>
> <http://www.sophos.com/virusinfo/analyses/trojfavaddd.html>

Thanks, Jean - appreciate the link!

Silj

--
siljaline

[Uncle Jean]

"siljaline" told the uncle and all the others:

» Thanks, Jean - appreciate the link!
»
» Silj

You're welcome, Silj. )

UJ