Worm.Rbot variant / spoolvs.exe

[StarshipUK]

Hi,

I have purchased a subscription of Superantispyware. I now have some spyware and superantispyware is not removing it.

In the windows toolbar I am getting a yellow triangle with an explanation mark in it and says "Windows Security Allert." when the mouse is placed over it. It is displaying the message:

Windows antivirus.

Windows has detected spyware infection!

It is recommended to use dpecial antispyware tools to prevent data loss. Windows will now download and install the most up-to-date antispyware for you

Click here to protect your computer from spyware!

Superantispyware is detecting:

Unclassified.unknown origin [1 items]

Registry Keys

HKU\S-1-5-21-1715567821-725345543-1801674531-1003\software\microsoft\windows\currentversion\run#spoolsv [c]

Worm.Rbot variant [2 items]

Files

c:\windows\system32\spoolvs.exe

Windows Startup

[spoolsv] c:\windows\system32\spoolvs.exe

I am then telling superantivirus to quarintine the spyware, but everytime I reboot it comes back and superantispyware informs me again it has blocked this.

Does anyone know how I can remove this completely?

Thanks,

Steve.

[Seth]

Hi Starship.

Some malware such as that can be removed from running the scan in Safe Mode. Make sure you have SuperAntiSpyware fully updated, then run a Complete (not Quick) scan from Safe Mode.

If that doesn't help, then submit a support request here and the company will run a diagnostic:

https://www.superantispyware.com/precreateticket.html

[StarshipUK]

[Seth]

There is no one antimalware product that is 100% effective.

Smitfraud Fix differs from SAS in that Smitfix only targets specific types of infections. SAS detects a much broader range of infections including most of the smitfraud "family".