[ad]
Today I’m removing (from an Acer laptop) a trojan called Win32.Renos. It causes false alerts on the desktop purporting to be from Windows. If you click on the alert, the trojan then downloads a rogue anti-spyware called Win SpyControl, AntiSpy Kit, and Virus Ranger.
The alert looks like this or some other warning: 
The rogue anti-spyware seems to be associated with the Zlob download trojan too and a web address http://www.safestarts.com/test/?c=440785. (Warning, don’t go to that site!!)
I removed it using Spy bot and Spyware Doctor.
Here’s what Microsoft says about this spyware. Microsoft associates Win32.renos with SpySheriff group of rogue anti-spyware products.
Whichever rogue anti-spyware Win32.renos is linked to, they all do the same thing. They attempt to get you to download and pay for bogus anti-spyware that is really spyware itself. This is fraud. It also infests your computer with lots of dangerous spyware.
Ducktoes to the rescue!! Please leave a comment if you have more to add about this problem or any questions.
4 Responses
I had exactly this problem with Safestart hijacking my Windefender icon. It was totally invisible to AVG Spyware, but Spybot got it. Thanks for the tip.
Rob
How do I get rid of this spyware….I have safestarts.com links on my desktop that say online security guide…I’ve used spybot but there is still a flashing shield on my task bar….how do I get rid of that?
It sounds as if you might have another spyware Spybot didn’t get. Also did you try restarting your computer after running Spybot?
Unfortunately there is so much malware out there, no one program can get them all. I recommend buying Spyware Doctor. It really works well, is probably the best anti-spyware out there. Spy Sweeper is also good.
Read this my page on removing spyware. https://www.ducktoes.com/blog/about
Let me know how it goes.
I’ve just tried installing all of the spyware removal software and am unable to remove – it seems to prevent me from installing anything…..anyone else come across this problem?