Spy Falcon?? Virus/Trojan/Dialer?? HELP!

Hey all, The other day I got this little popup balloon on my winxp lappy that said my computer is infected. I was half asleep and not thinking clearly so I clicked on it.
I was next greeted with a "NEW??" application that looks very nice called spy falcon. Only it is non functional and turns out to be some kind of nasty new trojan that is replicating itself faster than I can remove it.

It is slowing my productivity down to a halt and I need to get back to work. I even thought I had it removed once, even wrote a PM to allenb1963 bragging about it... time to eat crow and ask for your HELP!!!

Have you tried safe mode...???

MLF

Can you go back via System Restore to just before you clicked on the app?, if so after you have done that, then you should do some scanning in safe mode, and disable system restore to flush out any infected systemvolumeinformation restore points.


Grab Stinger from McAfee and run it, it's a trojan scanner.

Some extra tips...Spy Falcon Removal

Hi, AE~

Please try this site:

http://www.2-spyware.com/remove-spyf...FS64EAodiA2kKQ

:)

Found this.....



http://www.spyware-removal-guideline...falcon-removal

MLF

Hey all thanks for the links and suggestions.

Yes I have even booted to dos via a bootdisk and removed it manually, or at least it seemed that way, I spent over 8 hours doing this. I have tried the restore, I have disabled file protection and run adaware and AVG several times. Just when I think its gone I start back to doing what I do and its suddenly back.

I will check these links... I'll be right back ;)

Just dealt with that one last week. Used the script on morganlefay's link. The trick with this one, for me, was getting that rogue .dll out of c:\windows\system32. Spybot will remove Spy Falcon but it goes to seed when you reboot.

The tutorial lists the offending .dll's as dxmpp.dll and/or ginuerep.dll. The thing is reseeding the trojan via this .dll. I searched for any .dll's modified in the last week to find it. It was the ginuerep.dll file. Probably will only be one .dll, not two.

I deleted it by booting into safe mode w/ command prompt.

HTH

Quote:

---

Originally posted here by aeallison
Hey all thanks for the links and suggestions.

Yes I have even booted to dos via a bootdisk and removed it manually, or at least it seemed that way, I spent over 8 hours doing this. I have tried the restore, I have disabled file protection and run adaware and AVG several times. Just when I think its gone I start back to doing what I do and its suddenly back.

I will check these links... I'll be right back ;)

---

Hi

You might want to actually flush out your restore points.

Flush the restore points...Kellys Corner System Restore Info

one of my friends got SF just this morning......nasty little bugger it is....

Quote:

---

one of my friends got SF just this morning......nasty little bugger it is....

---

Yes it is my friend, I am going to get drunk tonight as celebration of this (*&%(%(&^% things removal.

nihil? tip up a Guiness in my honor ;)