Click here to monitor SSC

Bart

Software Engineer - Red Gate Software

Nasty error: 'svchost' has been built with an evaluation version of {smartassembly}, which has expired...

Published Thursday, January 21, 2010 8:11 PM

There are a few other versions of this error doing the rounds, such as:

  • 'svchost' has been built with an evaluation version of {smartassembly}, which has expired on Wednesday, 20 January 2010. You need to purchase a license of {smartassembly}.
  • This application has been built with an evaluation version of {smartassembly}.
  • Etc.

The dates vary, and aren't always reported in English, although that very much depends upon where you are, but the message probably appeared in a dialog box looking a bit like the one in Figure 1 below:

{smartassembly} svchost error dialog box.

Figure 1. The error dialog showing that there's trouble at mill.

You've probably already worked out by now that this isn't a good thing, but first, let me assure you that you, as an end-user, most certainly do not need to buy {smartassembly}. We make it and we ought to know.

The bad news is that this means that your computer is infected with some sort of malware. How do I know this? Because svchost is a part of the Windows operating system; it's a common system process and, because of this, some malware will try to disguise itself by using the process name "svchost". For various technical reasons I also know for a fact that Microsoft don't use {smartassembly} on it. If you want to know a little more, take a look at this Wikipedia article:

http://en.wikipedia.org/wiki/Svchost

The individual or group who wrote the malware now residing on your computer were, not surprisingly, too cheap to pay for a license for {smartassembly}, and too inept to spot that using the evaluation version would pop up this message and thus conveniently blow their cover. Hmm. why is it that criminals are besmirched with this reputation for stupidity? Oh, it's just too taxing. I might need to go for a lie down in a darkened room whilst I ruminate on this terrifying conundrum. Yes, and bring me a cup of tea, would you please?

OK, end of rant. The great news here is that it should be pretty straightforward to fix, unless you've got some really exotic brand of malware, which seems unlikely given that the criminals involved couldn't even be bothered with the most basic testing before they unleashed their creation upon the world. right, sorry, I'm really going to stop that now.

In most cases all you need to do is download and run a spyware removal tool. You should also make sure you've got some top quality, up to date antivirus software installed. For simplicity's sake, I'd just go for a big name like Norton, Symantec, or ESET NOD32, which is what we use (and it's been great). There are free and open source alternatives but, frankly, if you consider yourself a novice user, or you simply don't want to be bored with the details, just shell out for something big, well-known, and well-trusted.

Anyway, back to the spyware removal tool. I'd recommend Spybot Search and Destory (Spybot from here in), which is free, pretty easy to use, and has always served me well. I have tried others, such as AdAware, in the past, but Spybot has always seemed to do the best job of getting rid of even the most tenacious infestations.

I'm not going to give you detailed instructions on how to use Spybot to clean up your computer, partly because I'm a bit short on time right now, but mainly because the product comes with plenty of its own documentation. I will give you a quick outline of the process.

But first I'm going to give you fairly detailed instructions on how to safely download the thing because, be warned, there are hacked versions and lookalikes out there that will cheerfully infect your computer with even more (probably much nastier) malware, so you need to be sure you download and install the real thing.

So.

The only safe place to download this tool is from the Safer Networking site at:

http://www.safer-networking.org/index2.html

Do not, I repeat DO NOT, download this tool from anywhere that isn't a file hosting mirror directly linked from this site. Definitely do not even think about using bittorrent or any other p2p network to download this software. If you do download it from anywhere else, as I've already said, your computer is practically guaranteed to be infected with more (probably much nastier) malware.

Once you've gone to the Safer Networking homepage, just click on one of the links on the right for a page in your preferred language (figure 2).

Pick a page in your preferred language on the Safer Networking homepage.

Figure 2. Choose a page in the language of your choice.

Now click the Download link at the top right of the page (has an icon that looks like a 3.5 inch floppy disk above it - figure 3).

sandddownloadlink

Figure 3. Here are the links at the top right of the Spybot main page.

Now, scroll down past the donation and "Important Information" sections, to the "Download" section. Now click the Download link for the latest version of Spybot, which should be the first link in the list (figure 4).

Download the program.

Figure 4. Click the link to download the product itself - don't worry about the detection updates, because you can get Spybot to download them itself later.

Now you need to pick a mirror using one of the "Download here" buttons on the right of the page (figure 5), but be warned: it's an unfortunate fact that most of these sites carry adverts from companies who are just about unscrupulous enough to try to trick you into downloading the wrong piece of software. It's very annoying so don't be too hasty about clicking any download links, once you're past the list of mirrors, but if you read the page content carefully you should be able to figure out which is the right link easily enough. To illustrate the problem I'm talking about, take a look at figure 6, which is a shot of the download page on the fileforum.betanews.com mirror.

pickamirror

Figure 5. Pick a mirror site from which to download Spybot. You can pick one of the main mirrors, or scroll down the page for other mirror sites. Whichever site you choose, from this point onwards, proceed with caution.

downloadtherightsoftware

Figure 6. A typical download page for Spybot S&D on one of the mirror sites. Don't get me wrong, I'm not saying there's anything wrong with "Advanced Registry Optimizer" as a piece of software, and I'm definitely not going to even imply that it contains malware but, even if I were being charitable, I might use a phrase like "more than a little bit cheeky" to describe the fact that they've made their ad look like it contains a download button for the software you're really interested in. If I were to be less charitable, I might just get a little bit Bill Hicks about their marketing department. Don't be fooled.

OK, once you click this download link the file should actually start to download. I know, a bit of a voyage, right? If there'll usually be some text on the page that says something like, "Downloading spybotsd162.exe. If your download does not start soon, click here." Give it a few moments, but if it doesn't kick off automatically you can safely click that link - watch out for even more unscrupulous ads on this page though.

Now you've safely downloaded it, this is where the detailed instructions end. What you need to do next is:

  • Install the software you've just downloaded by running spybotsd162.exe. You'll probably get one or more security warnings, but it's fine to continue.
  • Run Spybot, either by starting it directly after installation, or via the Start menu.
  • Have Spybot update itself.
  • Now have it make a backup of your registry just in case something goes wrong (don't worry, it probably won't - if it does you can restore the registry backup and all should be hunky dory again).
  • Get it to run a scan.
  • Once it's done, you can choose the problems you want to fix - generally I just choose to fix everything.
  • It'll probably need you to restart your machine to fix some of the problems. Do this. You'll be asked if you're happy for Spybot to run again on start-up.
  • Restart your computer.
  • Spybot will run another scan and fix any other problems you choose.
  • Congratulations! Your computer should be clean.

A couple of things. Firstly, if you're in any doubt about how to use Spybot, start it up, then just read the Help until you're sure. It's not difficult to use, but it's better to be safe than sorry. Secondly, Spybot is not absolutely guaranteed to find and fix all problems, so you might want somebody who knows what they're doing to take a look at your PC anyway.

Hopefully you're now spyware free, and the {smartassembly} evaluation version message has disappeared.

by Bart Read
Filed Under: ,

Comments

 

arasmin said:

I never rely on one tool.

Currently I use a quadruple approach: antivirus (these seem to vary in quality over time), the latest MSRT, Spybot, and perhaps just as good if not more thorough MBAM.

I have seen a couple of cases where Spybot picked up something MBAM missed but far more often it's the other way around. Recently I had a machine get infected with the Internet Security 2010 crapware and MBAM picked up that active desktop had been turned on with an HTML file as the background (to aid in re-infection) which Spybot completely missed on it's run through.
January 22, 2010 2:23 PM
 

Bart Read said:

Thanks for posting. You're absolutely right: the combination approach is definitely best. A few years ago I used to use Adaware/Spybot, but became fed up of Adaware because of the amount of stuff it missed or, on one notable occasion, it knew there was a problem, but was unable to fix it, whereas Spybot dealt with it easily on the reboot.

For anyone who wants to try MBAM (I've not done so yet), you can get it from here:

http://www.malwarebytes.org/mbam.php

There's a free version for personal use.

I'd also forgotten completely about MSRT.

One other piece of advice: if you're using IE as a browser, probably ditch it. If you're still using IE6, well that's like painting a massive bullseye on your computer: at least upgrade to version 8:

http://www.microsoft.com/windows/Internet-explorer/default.aspx

And once you've done this, only use it for sites that absolutely require it (fortunately this is very few nowadays).

I use Firefox, and haven't suffered a spyware infection on my personal computer for 7 years as a result, but I believe Google's chrome would work just as well. You can get them from:

http://www.mozilla.com/en-US/
http://www.google.co.uk/chrome
January 25, 2010 4:47 AM
You need to sign in to comment on this blog

About Bart Read

Bart has done many things since he started work at Red Gate Software Ltd in August 2004, but nowadays he's (mainly) the product manager for the .NET Developer Tools. He still feels like this is a bit like admitting you were cheering for the Empire whilst watching Star Wars, but for now he's along for the ride. In a previous incarnation he was a project manager leading the .NET Reflector Pro, ANTS Memory Profiler 5, ANTS Performance Profiler 4 & 5, and SQL Prompt 3.0 - 3.6 projects. He still occasionally writes some code and, in the past, has touched the code for most of the Red Gate SQL developer tools... some of them still haven't recovered from the shock. He was born and grew up in Dorset, was educated in Nottingham and London, and likes music and real ale. His photo is extremely misleading.
<January 2010>
SuMoTuWeThFrSa
272829303112
3456789
10111213141516
17181920212223
24252627282930
31123456
Migrating from OCS 2007 R2 to Lync: Part 4
 Having migrated the rest of our users and legacy resources across, and start getting ready to... Read more...

Automated Script-generation with Powershell and SMO
 In the first of a series of articles on automating the process of building, modifying and copying SQL... Read more...

Seth Godin: Big in the IT Business
 Seth Godin has transformed our understanding of marketing in IT. He invented the concept of 'permission... Read more...

Using SQL Test Database Unit Testing with TeamCity Continuous Integration
 With database applications, the process of test and integration can be frustratingly slow because so... Read more...

Converting String Data to XML and XML to String Data
 We all appreciate that, in general, XML documents or fragments are held in strings as text markup. In... Read more...