Smart Wrapper OR ICSW_abcdef12345.exe downloaded and installed automatically

[niketu99]

I was trying to download the latest copy of FileZilla ftp client on my Windows 7 computer this afternoon, when I noticed a strange and never before seen notification icon in the notifications area next to where the date and time are, in the bottom right hand corner. It was called Smart Wrapper and had a download progress bar next to it. There was no option to exit it or close it, only to open it.

To uninstall this unwanted software, I tried looking for Smart Wrapper in the Uninstall Programs section in Control Panel, but could not find anything despite checking for newest software installed by date. I tried searching for this online and could only find "Smart Ad-Wrapper" not "Smart Wrapper" anywhere. I tried to do a manual search for Smart Wrapper on my computer but had a lot of unrelated entries, possibly due to the Smart keyword in the search.

Next, I looked up the Notification Area Icons section in Control Panel. I found that the "Smart Wrapper" was actually a subtext under the main title of "ICSW_0S1F2Y1C1R1P0F1F1C1N1P.exe". Never seen this before, and it looks very strange.

I couldn't find much by way of an online search, although searching for the exe file by name did tell me that it is not necessarilly a proven malicious software, but is definitely not something that users ask for. For mine, I would rather not have it on my computer than have it.

Can someone help by pointing out how to remove this exe please?

I have started a Full Microsoft Security Essentials scan, and will do a Malwarebytes scan next.

Thanks in advance.

[Train]

Where did you get your download?
I am darn careful where I get my downloads as a lot of sites get paid to add garbage to their downloads.

When I get Filezilla I get it from
http://sourceforge.net/projects/filezilla/

Sourseforge and Major Geeks are my 2 main sites for downloads.

[fink]

If malwarebytes doesn't get it then you may want to start a thread in our intensive care forum for it's removal.

http://discussions.virtualdr.com/for...e-Care-Unit&s=

[HAN]

It's possible there are 2 things going on. First, Filezilla is tired of not getting enough freewill donations. And second, SourceForge sold to Dice Holdings.

What this means is that Filezilla is wanting to make serious money from their free program. And Dice Holdings is willing to bundle Filezilla (and many, many other good programs) with unwanted crap.

So, if you downloaded Filezilla from SourceForge (which always was the legit source), it's an unfortunate likelihood you got your unwanted guest there.

There are ways to avoid the crap but it's not obvious. Here's the sad truth...
https://forum.filezilla-project.org/...ic.php?t=30240

[Midknyte]

I haven't used Filezilla in years. I use WinSCP now. There is even a portable version.
http://winscp.net/eng/index.php

[niketu99]

Thanks for the input all.

So the MS Security Essentials did not detect anything. While the MS Security Essentials scan was running, Malwarebytes detected a potential threat which was a file called CloudBackup3000.exe in my Users\xxxx\Appdata\Local or similar folder. I quarantined that threat, restarted my computer and then rescanned using Malwarebytes. At this point in time, I have not found any threats. On checking the notifications list, the Smart Wrapper is still present.

I am taking this to the Intensive Care Forum next.

[Alveoli]

Hi new member here, nice to meet you all.

I wanted to post in the Intensive Care Forum thread niketu99 started but couldn't - I guess it was closed.

[Alveoli]

So I have a very similar sounding issue today. I downloaded software form Sourceforge (CamStudio) and highly suspect that came bundled with spyware/malware. I had a new notification icon that looked like an evil eye (seriously!) appear after installation. If you right-click on it, you even get a smallish window that looks like a colourful banner ad appear, with the words "Smart Wrapper". Spookie.

I immediately tried to identify it with ProcessExplorer (from sysinternals) and it disappeared!!! It felt like it knew it was being watched, and promptly disappeared from the notification window. Now the only trace left is a Windows registry folder (empty) and a historic entry in the Notification Area Icons manager called "ICSW1.8_0S1F2Y1C1R1P0F1F1C1N1P1.8.exe", "Smart Wrapper".

With a generated name like that, it's clearly malware trying to hide.

I have run MalwareBytes and it found nothing.

I am very worried it's still watching me...

What do you think it was in the end? Any further info? Should I nuke my PC?

Thank you in advance.

[Midknyte]

If you suspect you are infected, please read the following thread to create your own thread in the ICU.
http://discussions.virtualdr.com/sho...d.php?t=167915