Help! Spyware on my home computer...I am completely fucked!

[Roy Munson]

So, last night my home computer got anally raped by something called "SpyFalcon." If you don't know what it is, it's actually supposed to be a legitimate Spyware program like AdAware, Spybot, etc. The problem is that it attaches itself deep within your hard drive with hard to find file name and folders. It wants you to BUY the SpyFalcon software and tries to trick you into it by inundating your screen with a bazillion pop-ups saying that you have virus's and if you buy SpyFalcon those virus's will be fixed. It attaches itself to your browser as well...it is one of the most ruthless pieces of Spyware that I have ever seen.

I have gone through every internet chat forum there is and found out how to get rid of it but it's not working for me for some reason. The problem I'm having is that I am unable to find the stated files that I need to delete. I followed the instructions to a T, but it appears that Spyfalcon may have changed their file names that make up the virus.

This is a nasty one...BEWARE!!! I'm just wondering if any of you have come across this one yet. I believe it's rather new...a few weeks old.

[Roy Munson]

I want to add that at this point I am considering formatting and starting over. It's that bad.


I'd love to round the fuckers who do this shit up and hit them each upside the head with a fucking Louisville Slugger.

[Satan]

Originally posted by Roy Munson
I want to add that at this point I am considering formatting and starting over. It's that bad.


I'd love to round the fuckers who do this shit up and hit them each upside the head with a fucking Louisville Slugger.

I think these are the bastards that Microsoft is going after for their fraudulent advertising.

Worst thing about spyware is that it often plants files in about 50 different places on your hard drive, and unless you find and destroy the source files first, they re-generate themselves again.

Best place to start is to go to Control Panel -> Administrative Tools -> Services and disable any "service" that doesn't have a description of what it does (unless you know for a fact that the service is part of a legitimate program. All of Microsoft's services have descritptions as do many major software vendors)

If you aren't sure about a service, google it. Someone's asked the question before and the answer will be there.

You of course should also google the name of this program if you haven't already, and siomewhere out in cyberspace should be a list of the corrupt files you would need to delete in order to kill this thing.

If the time you have to spend killing this thing is worth more than the data you would lose by a reformat, I'd go ahead and wipe the thing, because that is the only way you will be 100% sure that it's gone. You could always back up saome data, but not your Windows or system directories, as they're almost certainly filled with the corrupt files.

[Nickdfresh]

I've been to told that some of these bugs take advantage of the "System Restore" function. My brother had a difficult time when he couldn't even ACCESS his system restore due to spyware...

He reformatted, but some spyware actually use system restore to regenerate after file deletion, so you may need to turn it off...

[Roy Munson]

Originally posted by Satan
I think these are the bastards that Microsoft is going after for their fraudulent advertising.

Worst thing about spyware is that it often plants files in about 50 different places on your hard drive, and unless you find and destroy the source files first, they re-generate themselves again.

Best place to start is to go to Control Panel -> Administrative Tools -> Services and disable any "service" that doesn't have a description of what it does (unless you know for a fact that the service is part of a legitimate program. All of Microsoft's services have descritptions as do many major software vendors)

If you aren't sure about a service, google it. Someone's asked the question before and the answer will be there.

You of course should also google the name of this program if you haven't already, and siomewhere out in cyberspace should be a list of the corrupt files you would need to delete in order to kill this thing.

If the time you have to spend killing this thing is worth more than the data you would lose by a reformat, I'd go ahead and wipe the thing, because that is the only way you will be 100% sure that it's gone. You could always back up saome data, but not your Windows or system directories, as they're almost certainly filled with the corrupt files.

I already Google'd and Goggle'd but I will look again.

Thanks, Satan! You are the best!

[Roy Munson]

Originally posted by Nickdfresh
I've been to told that some of these bugs take advantage of the "System Restore" function. My brother had a difficult time when he couldn't even ACCESS his system restore due to spyware...

He reformatted, but some spyware actually use system restore to regenerate after file deletion, so you may need to turn it off...

You mean turn off the system restore?

[Nickdfresh]

YUP!!

Get this if you don't have it.

http://www.rotharmy.com/forums/showthread.php?s=&postid=882432#post882432

It may help, or not...

[Roy Munson]

Originally posted by Nickdfresh
YUP!!

Get this if you don't have it.

http://www.rotharmy.com/forums/showthread.php?s=&postid=882432#post882432

It may help, or not...

Ok. Gotcha.

So, when I am reloading my Windows I will need to shut off the system restore during the boot process? Sorry, I'm a greenhorn with this shit.

[Nickdfresh]

Originally posted by Roy Munson
Ok. Gotcha.

So, when I am reloading my Windows I will need to shut off the system restore during the boot process? Sorry, I'm a greenhorn with this shit.

Well, you can try to get rid of the malware files AFTER:

A.) turning system restore off

B.) and going into "SAFE MODE" (to cutoff any communication between the spyware and the web).

That's how it regenerates itself or prevents you from deleting...

[Satan]

You can shut the System Restore function down from within Windows by going to Control Panel ->System->System Restore.

This is assuming the spyware doesn't prevent you from executing this function.

And like Nick says, booting into Safe Mode is probably the best thing to do when deleting files.

[Hardrock69]

Then hire a lawyer and sue the developers...


Info on removing Spy Falcon:

http://www.bleepingcomputer.com/forums/topic43659.html

A word to the wise:

Get the following programs for Spyware:


AdAware:

http://www.lavasoft.nu/software/adaware/

Spybot Search & Destroy:

http://www.safer-networking.org/en/download/index.html

The above two programs are widely recognized as the very best in adware/spyware detection and removal.

There are other programs that are like SpyFalcon.

Spyware Doctor used to give false positives. I know because I installed it, and it told me I had adware/spyware on my machine....and after doing some research (uninstalled the program after deleting the supposed spyware...installed the software again, and all the supposed "spyware/adware" programs had magically reappeared) I deleted that piece of shit.

However supposedly they cleaned up their act, and have been winning some awards as of late.


Here is a page dedicated to fighting "rogue" adware/spyware programs which has a HUGE current list of rogue apps. Many of them have been sued, or have been santioned by the FTC for false & deceptive practices:

http://www.spywarewarrior.com/rogue_anti-spyware.htm

[flappo]

just get a mac

no spyware , viruses , trojans or any other crap

at all

[Satan]

Originally posted by flappo
just get a mac

no spyware , viruses , trojans or any other crap

at all

Or my personal favorite UNIX derivative, BSD.

I even do their advertising......

http://www.freebsd.org/

[Full Bug]

I dont know if it will help you Roy, but I find this site is really good at offering tech support, they have helped me out a few times, you may want to start a thread in the support forum and give it a shot....

http://www.daniweb.com/techtalkforums/index.php?

[Roy Munson]

Originally posted by Hardrock69
Then hire a lawyer and sue the developers...


Info on removing Spy Falcon:

http://www.bleepingcomputer.com/forums/topic43659.html

A word to the wise:

Get the following programs for Spyware:


AdAware:

http://www.lavasoft.nu/software/adaware/

Spybot Search & Destroy:

http://www.safer-networking.org/en/download/index.html

The above two programs are widely recognized as the very best in adware/spyware detection and removal.

There are other programs that are like SpyFalcon.

Spyware Doctor used to give false positives. I know because I installed it, and it told me I had adware/spyware on my machine....and after doing some research (uninstalled the program after deleting the supposed spyware...installed the software again, and all the supposed "spyware/adware" programs had magically reappeared) I deleted that piece of shit.

However supposedly they cleaned up their act, and have been winning some awards as of late.


Here is a page dedicated to fighting "rogue" adware/spyware programs which has a HUGE current list of rogue apps. Many of them have been sued, or have been santioned by the FTC for false & deceptive practices:

http://www.spywarewarrior.com/rogue_anti-spyware.htm

Thanks for the info. I already have AdAware and Spybot but they do NOTHING with this SpyFalcon. The problem I am having is that I only found one of the files that are supposed to be deleted. I did it in safe mode. The other problem is that when in safe mode I cannot see or use the two little programs you need to fix/get rid of SpyFalcon..."FixIt" and "semtrim."

I also know about SpyDoctor...it's a load of shit. No better than this SpyFalcon virus.

I tried the things that FORD and Nick said to do when I was home for lunch but I couldn't really find anything funny looking. I can't find the source of this bug anywhere because it has apparently used a surname that would be extremely unassuming.

I dunno what to do at this point.

I would love to sue these fuckers but is it worth the time and money?