Expert: Doug Woodall - 4/11/2008

Question
Hi there,

I am having a virus problem with my computer.  I have Windows XP installed on my PC.  The issue is that my computer encountered some kind a virus/bug/trojan where I see a samll incon at the bottom of my status bar next to the speakphone icon.  Whenever I restart my computer this virus also come up on the windows screen and have the following details.....
I see two windows show up one on the top of the other.  The title for the first window is "AntiSpywareShield EVALUATION VERSION WARNING".  It gives me three options (i)Purchase license (ii)Continue Evaluating (iii)Activate Anitspywareshiled Now.

The title for the second window is "AntiSpywareShield 201".  It has various options like "start scan", Current progress etc.

The issue is the first window i.e. AntiSpywareShield EVALUATION VERSION WARNING forced me to choose one of the three options as mentioned above.  When I clik on any of the option the next window starts scanning and shows me "Malware threats found...." with multiple virus with names as ....Trojan VX Downloader.  Then it gives me the message "Your system is infected!scan found 6 threats. Run threat removal now." with "YES" or "NO" options.  When I clik either of the option it takes me back to the first window with three options i.e. purchase license, continue evaluating and activate spywareshield.  I encounter this everytime I turn my computer on.  

I also tried to find by right clicking on its icon at the bottom of my status bar.  But it does not give me any properties from where I can locate where exactly this file is sitting so I can remove it.

Further, I have also checked this within my "Add/Remove programs".  However, I don't this this program installed in that "Add/Remove program" window.

Would you be able to help?

Thanks in advance.

Answer
Hi Irfan,
What AntiVirus were you using when you picked up this infection?
Im sorry you have been infected with this one, its a nasty.
The last issue I ran across with this was at a good help Forum.

http://forums.techguy.org/malware-removal-hijackthis-logs/627782-antispywareshie...

You can check out the results and follow the instructions that were provided for the user and try to remove it yourself or,
Register at the Forum, download the Hijack This program and run it.
Save the logs and submit them to the help Forum in the Malware Removal section.
They are good people there and will help you.
The thing to remember is that these are fake Virus warnings. Its to get you to buy the Rogue product.

Also Carolyn Meinel answered this question last year here with this solution.

http://en.allexperts.com/q/Computer-Security-Viruses-1737/antispywareshield-2-1....

Hope this helps.