Malware Removal: Win.32.TrojanDownloader.Swizzor.br

Dan the Man or any other technical gods out there... any tips on how to get rid of this thing?

I know exactly where it came from... an upgrade to MSN Messenger Plus which is an enhancement program for MSN Messenger. I've used earlier versions for a long time with no problem. This upgrade sent me a little something extra. :mad:

Partly my fault, I may have forgotten to choose to install without the banner bundle. So I upgrade and I end up with this inch wide baby blue search bar at the bottom of my browser, and a new silver taskbar at the top... like I needed another one of those :rolleyes: I can disable the taskbar and remove the search bar by right clicking on it and clicking on "backwards link" or something like that, but it always returns when I reboot. Plus now I have constant popups that I can't get rid of!!!

So, I go to the add/remove programs function in my control panel and uninstall it. But I really like MSN Plus, so I reinstall it making sure I eliminate the ads during installation.

The damn malware is still in there. I've run my AVG virus scan. It finds it but doesn't get rid of it. I've run Spybot, A Squared, Adware, and a couple of tests you can run from various web sites and adware is the only one that finds it.... but it can't get rid of it. I go through the process of deleting it and the program freezes up during the delete process every time. (yes, I've tried to do it more than once).

This package of trouble is a product of lop.com. According to some articles that I've come across, it says you can go to lop.com and use their removal tool to take this off your comp, but when I go to run it, I get a warning that it is something to do with DirectX which scared me off from going any farther with that tool.

Has anyone else encountered this or know how to get rid of it easily? I'm not very adept with the technical side of the computer so I don't want to have to go in and try to change the registry myself or anything else that complicated.

thx

Acccording to something I just read, one of the updates from October for Ad-Aware SE should get rid of it...

Flytrapp, have you tried booting into safe mode first and then running Ad-Aware while you're in safemode? Alot of this crap starts when you bootup and once it's loaded into memory and running, it's hard to get out. By booting into safemode, it keeps it from loading up usually...

If you haven't tried that...give it a go. If that doesn't work, let me know and I'll see what else I can come up.

~Dan

Thanks for the fast reply Dan. I'll give that a try the next time I reboot. I may have to download ad-aware again because now it seems to be crashing every time I try to open it. :(

maybe the malware ate it :confused:

No problem Flytrapp. When you reboot, the Ad-Aware may work again. It just may be temporarily messed up because of the freezing.

Sorry Dan, that didn't work. I upgraded my definitions. I ran AdAware in safe mode, all it did was pick up a bunch of tracking cookies. It removed those with no problem.

Then I ran it again in full windows mode and once again it found Swizzor along with a couple of minor things, attempted to delete, and froze before completing the job :(

Okay Flytrapp....

Sorry that didn't get rid of it. Once I get situated at work, I'll do some research and see what I can find...and will post later today.

~Dan

Hello again...

i'm still searching for some info about this...

Okay, you tried running ad-aware when you were in safemode.

Have you run the anti-virus in safe mode?

Another thing to try...is go here: http://housecall.trendmicro.com/

They have a free online virus scan tool. You could try running it, see if it detects it and then see if it will delete it out of your system.

Dan,

Can you give us any tips on how to get rid of this thing? It's really nasty. Subratam's "VX2 finder" utility doesn't recognize it at all on my system, and Spybot S&D is blind to it as well (current recognition files on both). Ad-aware SE Pro finds parts of it, but not the registry value resposible for generating the new .dll. I can "clean" some of the files with Ad-aware but it won't touch the .dll (and their "VX2 cleaner" plug-in is inaffective against this version as well). I can zap the remaining .dll with Cyberscrub during re-boot...but VX2 immediately creates another (if you watch closely, you can actually see this happen right after you delete).

Checking back... I had already tried the housecall site, no luck. I'll try running the anti-virus in safe mode soon, it's just been a bit hectic lately.

Sorry, been extremely busy at work...

Here are some things you can try...if you've gone through the usual virus scans and spyware cleaning programs...

If you haven't already, uninstall the Messenger Plus stuff. It's a third party program and contains spyware...

Check in Add/Remove programs for something called "Win Tools"...if it's there, uninstall it...

If something happens and you can't get it to uninstall that way...try these:

http://lop.com/new_uninstall.exe
http://lop.com/toolbar_uninstall.exe

And in case those don't work...try this:

http://members.rogers.com/rjmac/toolbar_uninstall.exe
http://members.rogers.com/rjmac/new_uninstall.exe

Then, try downloading something called CWShredder. It can be found here:

http://www.pcworld.com/downloads/file_description/0,fid,23551,RSS,RSS,00.asp

It's a small program. Download it, run it and see what it can clean.

Run Adaware in safemode...

Also, when you are doing these things, make sure you are not connected to the internet. If you have broadband, pull your network cable.

Try these things if you've still got it. And let me know how they work and if it's helped your problem any.

~Dan