Privacy & Security
Kill spyfalcon Free removal tool
| The removal tool/procedure for SpyFalcon on this page has been replaced by Roguefix.
A new comprehensive scan and delete utility for the family of rogue scanners and their installing/accompanying trojans
Roguefix, click here
Spyfalcon is one of a series of sub-standard scanners that users are tricked into installing to repair non-existent malware infections or system errors. The errors are generated by a CoolWebSearch trojan that has been change slightly to ensure the Smitrem tool that was used to remove its predecessors is not so effective, so here are the additional steps required.
Visible signs of infection
A warning will appear from near your clock. It has the appearance of being generated by your Windows system.
If you click on the balloon, you will be directed to the Spyfalcon website, and the scanner will be installed.
The scanner will run each time your computer starts and suggest you have many spyware infections and you should buy a license to allow spyfalcon to clean your system.
I have written a small program that will look for, and delete if found, files and registry keys associated with this infection.
It is designed for use on the Windows XP operating system, if you have a different version of Windows, contact me at .
Download Free Spyfalcon removal tool, save to your desktop.
Last updated 6th June 2006
KillSF.bat.Note - This removal tool will no longer be updated for newer variants, instead you should use its replacement Roguefix.
You will also need-
Ewidow To remove any additional Malware that has installed. A free version and free online scan is available
Ace Utilities, a comprehensive disk and registry cleaner. (Free trial)
Cautionary note : This collection of cleaning tools includes Remove Duplicate files, Remove Empty folders and Auto-Start manager. these options should not be attempted unless you are fully able to understand and investigate the output. Acting on a misinterpretation of the results could result in damage to your System.
1) Restart your PC in Safe Mode How to.
2) Double click on KillSQ.bat follow the onscreen prompts
When the tool has completed, it will create a text log of any actions taken. You will find KillSQ.txt on your desktop.
3) Run a complete System scan with ewido malware scanner
4) Restart your PC normally.
4) Open Ace Utilities
Perform the following scans, whilst we are targeting spyfalcon this cleaner will remove many other redundant or obsolete files and registry keys.
Click clean up , select remove Junk Files.
Scan and delete everything found. Close the remove junk files box.
Select Clean system registry.
Click options and select Thorough. Scan and delete everything found. Close the Clean system registry box.
Select Erase History, click the Windows tab and select the following-
Empty the Windows Prefetch Folder.
Delete empty folders on the Windows Temp folder.
Erase Folder streams in the Windows registry.
Clear past icon history of system tray
Click Execute Now
Click the internet Explorer/MSN tab and select the following-
Delete locked URL cache file.
Clear typed URL's of Address bar
Clear Browser History
Delete Cache (Files in temporary Internet folder)
Click Execute Now.
If any icons remain on your desktop or start menu, use the Fix invalid shortcuts option or right click on the icon and select delete from the menu that appears.
If your Homepage has been changed-
right click on the Internet explorer icon on your desktop or Start menu to open the internet properties box. Select the Programs tab and click the Reset Web settings button.
Click Apply then OK
if your desktop has not reverted back to normal-
Click Start > Control panel > Display to open the Display properties box..
Click the Desktop tab and then the Customize Desktop button to open the Desktop Items box.
Click the Web tab, to disable Active Desktop uncheck all checkboxes in this window, if any of the following are present, you should delete them-
Desktop Uninstall, Security Desktop, Security Info, Warning Homepage, Warning Message.
Click Apply then OK
Back in the Display Properties box, select your preferred background and click OK
Your computer should now be free of Spyfalcon.
To protect yourself against future infections, make sure you have all Windows critical updates and the latest version of java Update
This information is provided free of charge/subscription/registration and without warranty.
However, if this page has helped resolve your problems without having the expense of taking your PC to a repair shop or the hassle of reformatting, you may like to support our efforts with a small donation towards the maintenance ,further development of this site and the research to create more pages like this for future malware, even £1, $1, €1 can help make sure we are still here should you ever need us again.
Privacy & Security
hackers, crackers & firewalls
BHO's & Hijackers
Drive by downloads
Scams & Hoaxes
Free pest scan
Clean up/repair after malware infection
Prevent malware installing
Start in Safe mode
Show hidden files/folders
enable/disable Active X controls
Disable Messenger service pop-ups
Use the Host file
Kill PSGuard, spysheriff, spytrooper, AntivirusGold, RazeSpyware, smitfraud-c
Kill seeve.exe / mediamotors pop ups
Kill Sdbot-ADD / lockx.exe
Kill Aurora pop ups
The hype and Facts about the February 3rd attacks
The real cost of Free security software