internetinspiration logo
             
Home Internet Guides Privacy & Security Must have software Internet Shopping Earn Money Fun & Games Freebies

Privacy & Security
Kill spyfalcon Free removal tool

The removal tool/procedure for SpyFalcon on this page has been replaced by Roguefix.
A new comprehensive scan and delete utility for the family of rogue scanners and their installing/accompanying trojans
Roguefix, click here


Spyfalcon is one of a series of sub-standard scanners that users are tricked into installing to repair non-existent malware infections or system errors. The errors are generated by a CoolWebSearch trojan that has been change slightly to ensure the Smitrem tool that was used to remove its predecessors is not so effective, so here are the additional steps required.

Visible signs of infection

A warning will appear from near your clock. It has the appearance of being generated by your Windows system.

If you click on the balloon, you will be directed to the Spyfalcon website, and the scanner will be installed.

The scanner will run each time your computer starts and suggest you have many spyware infections and you should buy a license to allow spyfalcon to clean your system.

I have written a small program that will look for, and delete if found, files and registry keys associated with this infection.
It is designed for use on the Windows XP operating system, if you have a different version of Windows, contact me at .

Download Free Spyfalcon removal tool, save to your desktop.
Last updated 6th June 2006

KillSF.bat.

Note - This removal tool will no longer be updated for newer variants, instead you should use its replacement Roguefix.

You will also need-

Ewidow To remove any additional Malware that has installed. A free version and free online scan is available

Ace Utilities, a comprehensive disk and registry cleaner. (Free trial)
Cautionary note : This collection of cleaning tools includes Remove Duplicate files, Remove Empty folders and Auto-Start manager. these options should not be attempted unless you are fully able to understand and investigate the output. Acting on a misinterpretation of the results could result in damage to your System.

Removal proceedure

1) Restart your PC in Safe Mode How to.

2) Double click on KillSQ.bat follow the onscreen prompts

When the tool has completed, it will create a text log of any actions taken. You will find KillSQ.txt on your desktop.

3) Run a complete System scan with ewido malware scanner

4) Restart your PC normally.

4) Open Ace Utilities

Perform the following scans, whilst we are targeting spyfalcon this cleaner will remove many other redundant or obsolete files and registry keys.

Click clean up , select remove Junk Files.
Scan and delete everything found. Close the remove junk files box.

Select Clean system registry.
Click options and select Thorough. Scan and delete everything found. Close the Clean system registry box.

Select Erase History, click the Windows tab and select the following-
Empty the Windows Prefetch Folder.
Delete empty folders on the Windows Temp folder.
Erase Folder streams in the Windows registry.
Clear past icon history of system tray

Click Execute Now

Click the internet Explorer/MSN tab and select the following-
Delete cookies
Delete locked URL cache file.
Clear typed URL's of Address bar
Clear Browser History
Delete Cache (Files in temporary Internet folder)

Click Execute Now.

If any icons remain on your desktop or start menu, use the Fix invalid shortcuts option or right click on the icon and select delete from the menu that appears.

If your Homepage has been changed-
right click on the Internet explorer icon on your desktop or Start menu to open the internet properties box. Select the Programs tab and click the Reset Web settings button.
Click Apply then OK

if your desktop has not reverted back to normal-
Click Start > Control panel > Display to open the Display properties box..
Click the Desktop tab and then the Customize Desktop button to open the Desktop Items box.
Click the Web tab, to disable Active Desktop uncheck all checkboxes in this window, if any of the following are present, you should delete them-
Desktop Uninstall, Security Desktop, Security Info, Warning Homepage, Warning Message.
Click Apply then OK
Back in the Display Properties box, select your preferred background and click OK

Your computer should now be free of Spyfalcon.

To protect yourself against future infections, make sure you have all Windows critical updates and the latest version of java Update


This information is provided free of charge/subscription/registration and without warranty.
However, if this page has helped resolve your problems without having the expense of taking your PC to a repair shop or the hassle of reformatting, you may like to support our efforts with a small donation towards the maintenance ,further development of this site and the research to create more pages like this for future malware, even £1, $1, €1 can help make sure we are still here should you ever need us again.
Privacy & Security

Information

E-mail

Viruses

hackers, crackers & firewalls

Trojans

Spyware

Keyloggers

Cookies

BHO's & Hijackers

Drive by downloads

diallers

Scams & Hoaxes

Hijack this-
automatic analysis


Free pest scan

Unwanted processes

How to-Tutorials

Clean up/repair after malware infection

Prevent malware installing

Install Hijackthis

Start in Safe mode

Show hidden files/folders

enable/disable Active X controls

Disable Messenger service pop-ups

Use the Host file

Kill PSGuard, spysheriff, spytrooper, AntivirusGold, RazeSpyware, smitfraud-c

Kill Winfixer2005

Kill seeve.exe / mediamotors pop ups

Kill Sdbot-ADD / lockx.exe

Kill Spyaxe

Kill Spyfalcon

Kill SpywareStrike

Kill Aurora pop ups

Kill MySearch

News/Articles

The hype and Facts about the February 3rd attacks

The real cost of Free security software

About us Contact us FAQ Links Privacy Statement Site Map Webmasters
Click here to add this page to your favorites
©Internet Inspiration, 2003.      All registered trademarks are observed and respected.
If you receive advertising pop ups whilst viewing this site, you are infected with an ad-serving parasite, because we don't use pop ups.