Spyware problem

  Stevie07 08:31 26 Dec 2004
Locked

I am running XP pro with 4 accounts for each family member. I am also running McAfee internet suite 6 with spyware remover bundles in. When I recently scanned one of the accounts it detected "SQWIRE" but as the account did not have administrator rights McAfee would not let me action it. So, returning to my account with administrator rights I scanned for the spyware again. Nothing all clear, but this spyware is causing the other account loads of grief.
So, I got hold of spybot and blimey loads of spyware that McAfee missed, but did not detect the dreaded SQWIRE.
How can I get rid of this spyware?

  ICF 08:42 26 Dec 2004

Can't you log on as the administrator and delete it then?

  Stevie07 08:45 26 Dec 2004

McAfee dosn't even detetc it when I'm logged on as an administrator. However, if I log on as one of the user accounts it's still there.

  JoeC 09:04 26 Dec 2004
  JoeC 09:17 26 Dec 2004

Program Information
Discovery Date: 05/26/2003
Origin: Unknown
Length: 169,984 Bytes
Type: Program
SubType: Adware
Minimum DAT: 4267 (05/28/2003)
Updated DAT: 4410 (05/28/2003)
Minimum Engine: 4.2.40
Description Added: 11/26/2003
Description Updated: 11/26/2003 7:48 AM (PT)



Program Characteristics
This program is detected as a "potentially unwanted application".

The program installs itself without any user prompt. The installer installs all the files for this program under "C:\Program Files\Sqwire". It will also change the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
"Start Page" " click here"
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search "CustomizeSearch"
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search "SearchAssistant" " click here "

The following will be added to windows favorite directory:

Favorites\Entertainment
Favorites\Finance
Favorites\Free Stuff
Favorites\Gambling
Favorites\Inernet
Favorites\Shopping
The detection of this type of file is not automatically activated. Users who would like to check for the presence of this kind of files on their system should run the command line scanner with the /PROGRAM switch.
Please note that VirusScan 7 has also an option, which enables users to detect this kind of program automatically (see below).


Removal Instructions
For VirusScan 4.x users who would like to detect this program on their system, they can run the command line scanner with the /PROGRAM switch.

Click the START button
Click RUN
Type COMMAND and hit ENTER
Type:

c:\progra~1\common~1\networ~1\viruss~1\4.0.xx\scan.exe c: /program /sub

and hit ENTER.

  Stevie07 09:31 26 Dec 2004

I've tried obtaining the Sqwire uninstaller from click here but when its says you will be presented with a window like this the screen flashes and then nothing other than the original picture of the screen I should get. I wonder if this is also designed to cause problems?

  sidecar sid 10:41 26 Dec 2004

If it's any help here are some instructions to remove it manually

click here

  Fruit Bat /\0/\ 10:43 26 Dec 2004

The spyware is probably in the temporary internet files of the account Mcafee will not access these files durinig a scan from another account but you can manually delete them from the admin account.

  Stevie07 11:41 26 Dec 2004

Thanks everyone for your help. Alas I can find any of the registery keys shown. I'm gona use McAfee support line.

  curlylad 12:03 26 Dec 2004

Have you got the latest virus definition update for your McAfee suite 6 program ? Download the latest update and run a full system scan again.

  curlylad 12:18 26 Dec 2004

I think the registry key it's in is HKEY_CURRENT_USER\Software\SQ

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

AMD Radeon Adrenalin release date, new features, compatible graphics cards

Inside the iMac Pro - Apple's most powerful Mac yet

iMac Pro release date, UK price & specs

Comment nettoyer Windows et optimiser son PC gratuitement ?