Expert: Lorry - 3/25/2008

Question
Hi Lorry! My brother has a virus on his computer that constantly acts as a antivirus by scanning his computer and then when you click on it takes you to the same webpage for a program called "spymax' time and time again wanting you to buy the program! It is driving him crazy. I ran norton antivirus on his computer but it didn't find anything and even tried to find the program in safe mode and running norton but nothing! It even turned off his task manager so i couldn't locate it. I had this problem years ago with my computer and fixed it but for the life of me i cannot remember how i did it? If you can help me i would really appreciate it. Thank You  Douglas

Answer
Hi Douglas,

Spymax is a clone of AntiSpyStorm. Symantec has removal instructions at:

http://www.symantec.com/security_response/writeup.jsp?docid=2007-073009-3058-99&...

To verify that this is the same threat, using Internet Explorer, go to:

http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym

Click the GO button, then under Virus Detection, click Start. You might be told that you need to download and install ActiveX Controls for the scan to work, answer Yes.

Write down exactly anything it finds, then go to: http://www.symantec.com/search/  and do a search for what was found. Symantec usually has a removal tool and/or directions for removing manually. Make sure that you follow the instructions for removal, step by step, especially the part regarding disabling System Restore.

Once Windows is clean, free of viruses, install an anti-virus program, keep it up to date and run a virus scan once a week.

Hope this helps!
Lorry