Please help me. Spyware Doctor virus won't go away!

Viruses and worms
1

OK. I will try to explain this as best I can. I am not a techinical person, but I can sorta do some things.

First of all, my computer has been running slow. Yes, I have Vista. Yes, I wish I didn’t. Yes, I am low on memory, but not that low…so I tried to fix the perfomrance of my copmuter the other day. I uninstalled programs that I never use and one of them I remember was Spyware Doctor. I have spybot on my computer and have no need for spyware doctor…I have NO idea where it even came from so I uninstalled it.

Then, my computer was going even slower…and when I send an email, it gets stuck on “sending”… I am afraid to think what this computer is doing when it does that.

So I logged off and have ran at least 4 avast tests…two boot time scans…both times it says that Spyware Doctor is infected (which I strongly feel is actually loaded with Spyware and is a lie that it is removing any spyware…I think it is actually putting it ON)…and when I got to the last box, where it has a whole list of files for the virus report, it says they are UNABLE TO SCAN…I have no clue why they are unable to scan. This is my first problem.

My second problem is that during the boot time scan, I kept getting quite a few errors that say error 42126 RAR archive is corrupted, error 42126 exe error, Error 42127, and error 42145 Ole Archive is corrupted…It is safe to say I am clueless about what any of this is or means or what to do about it. I did read that the Archive files are not that important…but I feel it is in relation to other things…My computer is not functioning properly…(aside from the fact that the Windows reports on my VISTA LAPTOP says that two devices are not functioning on my computer…but this is another problem I do not know how to fix.)

The third and main problem is this Spyware Doctor business…I scanned iit in boot time scan and it showed up. I scanned it again individually and attempted to move it to the chest. It says OPERATION NOT SUPPORTED FOR THIS ARCHIVE. Whatever. Then I tried to change the file name and force the move…I had all three check boxes marked, and it said it could not do it…Then one I kept trying to delet it, and then it said it was completed…that it did remove it…but still it never showed up in the virus chest nor in the deleted file list. It kept showing an ERROR on the ending file box.

So, I am under the impression that this virus or malware or whatever it is is being stubborn >:(…and I can’t remove it.
Can someone please, in EASY EXPLANATIONS, tell me how to get this off my computer? I have no idea what to do…I keep running virus checks, but it keeps showing up. When I ran the boot time scan it said this…Spyware Doctor v5.0.5.258.rar\Spyware Doctor v5.0.5.258\Patch\sdpatch.exe That may not be the whole thing, but that was what I wrote down. I hope it makes sense.

Please please help me. I use this computer all day and need to make it work properly.

Thank you so much for your time…

2

I don’t think Spyware Doctor is contaminated… it’s a good security company.
Which application is reporting it is infected? avast?

Don’t worry, really.

Well, this could be the real problem… Which are these devices?

It’s a pity that avast does not shown an option to move all the archive file and not just the file inside of it. Anyway, which is the file path/name and which is the virus name reported?

3

It did not give me a name…I tried to put the path name above, it says spyware doctor v5.0.5.258rar\spyware doctor v5.05.258\patch\sdpatch.exe I HOPE That is the full path, it may not be the full one.
…but it says SPYWARE DOCTOR…and it says that it is infected. At least that is what I am pretty sure of. I cannot find any other problems…and that is what the boot time scan said.

Thank you very much for helping me.
;D

4

So, right now, what more do you want to do? Are you still infected or avast prevent you this?

5

Well, the functioning of my computer is still not good…can you tell me how to fix the devices? And what about the spyware doctor issue? It still is coming up in the boot time scan because
I just ran another boot time scan and found this also…
prog files/alwil software\avast4\data\moved\sdpatch.exe2 is infected by Win 32 adware-gen

These are now in the chest…but all the problems I wrote in the first post of this topic are still showing up on the boot time scan.

What do I do to remove this spyware doctor thing? And if these viruses are held in the chest, do I go in and manually delete them?

Thanks again.
Niki

6

Hi
lets start from the to
first
Spyware Doctor is a legit program have you ever installed it?
if you can navigate to sdpatch.exe and check properties does it look like a pctools/ spyware doctor file?

you can ask at
http://www.pctools.com/contact/support/product/spyware-doctor/
This may be a false positive
pc tools can tell how many bytes the file is supposed to have vs how many properties shows
in case their file has a virus injected into it

In anycase SD v 5 is old so you can ask them about complete removal
If you do want Spyware Doctor you can download the Google toolbar and by unchecking everything else get a fresh copy of only Spyware Doctor full retail

there is also malware called sdpatch.exe, maybe more than one
Avast should have moved any virus hit to the chest- your best option
you already updated avast and did a boot time scan-right?
can you/ did u upload Win 32 adware-gen to virus total?
do not delete viri in chest- they are safe there

Create a folder called Suspect in the C:\ drive, e.g. C:\Suspect.
Now exclude that folder in the Standard Shield, Customize, Advanced, Add, type (or copy and paste) C:\Suspect*
That will stop the standard shield scanning any file you put in that folder. Y
ou should now be able to export any file in the chest to this folder and upload it to VirusTotal without avast alerting.

This virus may regenerate

till we hear back from pc tools let’s try a scan with malware bytes anti malware
quarantine any hits do not remove/ delete

post the mbam log here and anything else suspicious from the Avast boot time scan

7

Control Panel > Add/Remove Programs (or Program Resources)
You can also use RevoUninstaller (I recommend): http://www.revouninstaller.com/revo_uninstaller_free_download.html

8

Wow wyrmrider…That was quite a post there with all those instructions…I have to admit I am fully lost. False postiive? Why do I have to post it somewhere else? I don’t get it.

BUT…I think you touched on my problem…in the last boot time scan, avast did catch the sdpatch.exe viruses you mentioned. I think there was like 8 of them or something…
They are sitting in the chest. The other day I did find some Win 32 thing…not sure what it was…but it is not in the chest now…I think that avast deleted it during the boot time scan.
You said not to delete them?
Not ever? The other day I went into the virus chest and saw tthings that have been sitting in there for months and deleted them. Was that bad??

One very strange thing that is suddenly happening on my computer over the last few days is the ability to write a capital P…weird! now it is working…yesterday it didn’t work. Very bizarre! OK…guess that is fixed…that’s good! When I would type a capital P, windows media player would open…is that some sign of a virus?

Thanks guys!

9

glad you are making some progress
IS this your computer?
Did you ever install Spyware Doctor?
anyway- time to remove it- version on your computer is old
but not a virus

try and identify any hits on SDUPDATE.EXE
what is the complete path
If you can find them (or if they are still in the chest) post back and we’ll show how to upload them to Virus Total or to Avast for analysis
since you say that they are still in the chest here is what to do
Create a NEW Folder called C:\suspicious
copy those 8 potential nasties (only you know where they are so they can’t be easily found)
then go to “virus total” (google if you have to)
upload using the “search” feature to find your new folder
you will have to do it for each file but does not take long
post a link to the results back here
good work :slight_smile:
virus total will report results to Avast

IN General we ask that you rescan files in the chest periodically and before deletion-
no harm in keeping them there till good/ bad is determined- or recheck with virus total
If they have been determined to be “false positive hists” then a later scan will not detect them

10

Generally speaking, you should only delete files in the Infected files section of the Virus Chest after they have been proven to be actually infected. This could also be true of files in the User files section of the Chest depending on why you put those files in the Virus Chest.

You should never delete files found in the System files section of the Virus Chest. These are copies of important computer system files that Avast put there when you first installed avast on your computer. These are for Avast’s use in case of an infection where these files might need to be replaced.

11

I just wanted to say that I also had problems with Spyware Doctor on my old laptop running XP SP3. I hadn’t had any problems whatsoever before I installed it.

After installing it, my laptop froze up. I couldn’t do anything. I tried several times. I booted up in Safe Mode and deleted it. It was okay until the next day when I got BSOD with a bunch of error messages plus saying I needed new video and network adapters.

A coincidence or something else? I don’t know. I’m not an expert. All I know it I didn’t have any problems whatsoever before I installed it. I installed it last month from the PC Tools web site. I haven’t taken it to a repair shop yet to find out the exact problems yet. Decided to go ahead and get another computer instead.

12

I read many other posts saying the Spyware Doctor is actually spyware and other people were having problems similar to the last post.
Thank you for the directions.
I will try to see what I can do.

13

FUD.