spy falcon

Question

i got and i've tried to get rid of it using ad-aware se, avast! and avg and i cant get rid of the durn thing.   what should my first step be to getting rid of it?     thanks, bones

hc4 · Answer

If nothing helped, try removing SpyFalcon manually. Instructions here.

CHCarriersLLC · Answer

i appreciate the link, but i dont think im qualified enough to try to manually remove it.   is there any spyware program that will recognize it and remove it with me doing it?   thanks, bones     ps...as of now, i've run avast, avg, ad-aware and search and destroy and have had no luck. and they are all current on updates except s&d because it wont go thru for some reason.

CHCarriersLLC · Answer

ok, i slept last night so i forgot all my details. ad-aware actually did detect it and it is in quarantine right now, but the effects of the falcon still are present. should i delete it out of quarantine?

it says all this about it in quarantine so im not sure if any of this is the actual falcon or not.

thanks for you help,

bones

obj[18]=Regkey : software\microsoft\windows\currentversion\app paths\spyfalcon.exe
obj[19]=Regkey : software\microsoft\windows\currentversion\uninstall\spyfalcon
obj[20]=RegValue : software\microsoft\windows\currentversion\uninstall\spyfalcon "UninstallString"
obj[21]=RegValue : software\microsoft\windows\currentversion\uninstall\spyfalcon "DisplayIcon"
obj[22]=RegValue : software\microsoft\windows\currentversion\uninstall\spyfalcon "DisplayVersion"
obj[23]=RegValue : software\microsoft\windows\currentversion\uninstall\spyfalcon "NSIS:StartMenuDir"
obj[24]=RegValue : software\microsoft\windows\currentversion\uninstall\spyfalcon "URLInfoAbout"
obj[25]=RegValue : software\microsoft\windows\currentversion\uninstall\spyfalcon "Publisher"
obj[26]=Regkey : software\spyfalcon
obj[27]=Folder : C:\Program Files\SpyFalcon
obj[28]=Folder : c:\documents and settings\administrator\start menu\programs\SpyFalcon
obj[29]=Folder : C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\awtmp
obj[30]=File : c:\documents and settings\administrator\application data\microsoft\internet explorer\quick launch\SpyFalcon 2.0.lnk
obj[31]=File : c:\documents and settings\administrator\desktop\SpyFalcon.lnk
obj[32]=File : C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\507B8750.TMP
obj[33]=File : C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\SFLanguage.ini

wee.alex · Answer

http://www.2-spyware.com/remove-spyfalcon.html?gclid=CK7Tjv7ds4MCFRZPEgodQHb9Yg

CHCarriersLLC · Answer

thanks for the link, but is there no free way to get rid of it, other than manually removing it?  ad-aware is free and found it, but it wont make it go away.  i downloaded that link and scanned and it found the falcon, but who's to say after i pay that it wont remove it either, ya know?     thanks again, bones

wee.alex · Answer

@CHCarriersLLC wrote:

thanks for the link, but is there no free way to get rid of it, other than manually removing it?

ad-aware is free and found it, but it wont make it go away. i downloaded that link and scanned and it found the falcon, but who's to say after i pay that it wont remove it either, ya know?

thanks again,

bones

Sorry about that Bones, didn't realise it was a pay for service :smileysad: Saw this site posted on one of the AV forums http://www.ewido.net/en/download/ one of the posters said it removed SpyFalcon from his pc (14 day trial) another has posted that Windows Defender has removed it from his. Have you tried Trend Micro's new online spyware removal tool http://www.trendmicro.com/spyware-scan/ (Free)

CHCarriersLLC · Answer

ewido did the trick!:smileywink:   thank you very much!   bones

wee.alex · Answer

@CHCarriersLLC wrote: ewido did the trick!:smileywink:   thank you very much! bones Great, glad you got rid of it :smileyhappy:

dave0102 · Answer

Spyfalcon is tagged as rouge antispyware like spyaxe and spywarestrike. You can download spyfalcon removal and thoroughly scan your system in SafeMode. Just follow the procedures and for sure it will be gone in minutes.

Bunzzz · Answer

oh my god!!! thank you SOOOOOO much - i dont do 'forums' but I had the spy falcon thing going on and nothing would get rid of it... until I downloaded ewido! You have no idea how annoying that thing was... thanks again!!! (I only registered to say thanks!) ;-)

Amy (aussie girl with enormous gratitude for american forums now hahaha) ;)

wee.alex · Answer

@Bunzzz wrote:

oh my god!!! thank you SOOOOOO much - i dont do 'forums' but I had the spy falcon thing going on and nothing would get rid of it... until I downloaded ewido! You have no idea how annoying that thing was... thanks again!!! (I only registered to say thanks!) ;-)

Amy (aussie girl with enormous gratitude for american forums now hahaha) ;)

Agreed, great forum this but we're not all American :smileyhappy:

novablink · Answer

So i have the virus to and I am in a big bind......My ie doesnt work so I cant get to that site to get rid of falcon, and now I have a prompt that says   Files that are required to run windows have been replaced by unrecognized ones, to maintain system stability windows must restore the original versions of these files,   insert disc now, and I dont have a windows disc?  any ideas how I can get rid of it, even if I have to buy a spyware removal from the store...?

wee.alex · Answer

novablink,

Have you access to another pc where you can download the program (ewido) and save it to a disc/memory stick ? You could then try installing it in the infected pc from there. The program setup is less than 8mb. Possibly some of the more knowledgeable posters on the Windows XP board can help you with your missing files. Might be worthwhile running Check Disk with both options ticked.

tschrock · Answer

I did a Google search and found an online tutorial at http://www.schrockinnovations.com/removespyfalcon.php that walks you through the removal process.   Its a 4 page tutorial, and it looks pretty thorough.  Aparently it is difficult to remove Spy Falcon because it hijacks some Windows Operating System files.  The tutorial says you have to remove items in safe and regular modes.

ChrisRLG · Answer

Try Nick's removal instructions.

http://malwareremoval.com/plog/index.php?op=ViewArticle&articleId=85&blogId=3

He is a teacher at The Malware Removal School at MWR (see link below in my signature for that).

After following those instructions please post a HJT log (in the HJT board) so that an expert can advise if you are now clean. Details for the HJT board below.

=====================

It would be best to follow the Hijackthis instructions from :-

http://forums.us.dell.com/supportforums/board/message?board.id=si_hijack&message.id=4987

then post a HJT log in :-

http://forums.us.dell.com/supportforums/board?board.id=si_hijack

the experts in that room will then give you detailed advice.

Virus & Spyware

Was this post helpful?