SpywareQuake & SpyFalcon Removal Procedure

chaslang · Oct 19, 2006

First, make sure you have followed the steps in this link: How to view hidden, system files & folders!

NOTES:

Even if you do not find some (or all) of the files mentioned or you do not see SpywareQuake (or SpyFalcon....etc) in Add/Remove programs or the folder for it, just continue with ALL steps thru to the end.

In the below instructions the %System32% text is an abbreviation for your either c:\Windows\System32 or c:\Winnt\System32 It depends on how/where you installed your Windows OS. Thus %System32%\stickrep.dll means either C:\Windows\System32\stickrep.dll or C:\Winnt\System32\stickrep.dll

Some of the items being deleted by this procedure are not Smitfraud family related but the fit into the area for removal.

Download the attached fixquake.zip file to your Desktop. Then extract the fixquake.reg file patch from the ZIP file to your Desktop (or anyplace you can find it later to use after the instructions tell you to boot in safe mode).

Now download smitRem.exe written by noahdfear and save the file to your Desktop.

Double click on the smitRem.exe file and click the Start button to extract it to its own folder named SmitRem on the desktop.
(this should be the default selection). Do not run anything else related to the program yet!

Now you will need to print or save these instructions locally (to a text file on your Desktop) for later reference. This is necessary
because you must not have any browers open and must not connect to the internet while following the below steps.

Now disconnect your cable to the internet (physically unplug it).

After saving the instructions, reboot into Safe mode

Now once in safe mode, goto Add/Remove programs and uninstall Spyware Quake and/or SpyFalcon (if they are found).

Also while in Add/Remove programs look for and uninstall any of the below if found

Internet Explorer Security Plugin 2006

Internet Security Add-On

PCODEC 6.0

Now double-click on the fixquake.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to
the Desktop) and when it prompts to Add in to the registry, say yes.

Run Windows Explorer by right clicking Start & Select Explore

Navigate to your %System32% folder C:\Windows\system32 )or C:\Winnt\system32 depending on how/which OS you have installed.)

Look for the following files based upon where you have Windows installed:

%System32%\__delete_on_reboot__stickrep.dll

%System32%\acvgxw.dll

%System32%\adobepnl.dll

%System32%\asxbbx.dll

%System32%\bolnyz.dll

%System32%\cfgmngr32.dll << Be careful, DO NOT DELETE cfgmgr32.dll (notice the missing 'n')

%System32%\dnefhw.dll

%System32%\dvdcap.dll

%System32%\dxmpp.dll

%System32%\erxbx.dll

%System32%\fyhhxw.dll

%System32%\ginuerep.dll

%System32%\guxxa.dll

%System32%\higjxe.dll

%System32%\htey.dll

%System32%\hvcycg.dll

%System32%\hvnwm.dll

%System32%\hzclqhc.dll

%System32%\icima.dll

%System32%\iqzv.dll

%System32%\imfdfcj.dll

%System32%\jevtxpg.dll

%System32%\kkqfb.dll

%System32%\lwpfwjb.dll

%System32%\oerucu.dll

%System32%\ofcukiz.dll

%System32%\oqipt.dll

%System32%\ornzq.dll

%System32%\oybgrql.dll

%System32%\reglogs.dll

%System32%\rmzdzx.dll

%System32%\sbnudh.dll

%System32%\sivudro.dll

%System32%\stickrep.dll

%System32%\suprox.dll

%System32%\tnvocyn.dll

%System32%\twain32.dll

%System32%\vhywj.dll

%System32%\viruxz.dll

%System32%\vjeojhvro.dll

%System32%\ucbrrt.dll

%System32%\ulztc.dll

%System32%\viwpzla.dll

%System32%\vpxnk.dll

%System32%\wfkduei.dll

%System32%\wschtm35.dll

%System32%\xenadot.dll

%System32%\xuefh.dll

%System32%\yfysupa.dll

%System32%\yhbdupd.dll

%System32%\yvvdj.dll

%System32%\ywbicim.dll

%System32%\zlara.dll

When you locate the files, right click on them and select Rename. Change the dll extension to DDD. For example: rename xenadot.dll to xenadot.DDD We will fully delete the files later.

Now open the smitRem folder on your Deskop, double click on it to access the folder, then double click the RunThis.bat file to start
the tool. Follow the prompts on screen. Wait for the tool to complete and disk cleanup to finish. If you cannot get RunThis
.bat to work in safe mode, REBOOT into normal mode (with no internet connection) and repeat the above step from the point of booting in safe
mode.

The tool will create a log named smitfiles.txt in the root of the drive that you ran the batch file on, eg;
Local Disk C: or partition where your operating system is installed. Upload this file later after reboot.

Now reboot your system into normal mode.

Now after reboot relocate the DLL files we renamed with a DDD extension in the above step and delete them. If you have a
problem deleting these files, try rebooting one more time into safe mode and attempt another deletion. If it still does not delete, make sure you tell us later.

Also delete the below files and folders if found (if Windows is not installed on drive C replace the C drive letter used below with the correct drive letter):

C:\Program Files\AdwareSheriff

C:\Program Files\eMedia Codec

C:\Program Files\IntCodec

C:\Program Files\Media-Codec

C:\Program Files\MediaCodec

C:\Program Files\MMediaCodec

C:\Program Files\Spyware Quake

C:\Program Files\SpywareQuake.com

C:\Program Files\SpyQuake2.com

C:\Program Files\SpyFalcon

C:\Program Files\TitanShield Antispyware

C:\Program Files\Trust Cleaner

C:\Windows\System\1024 (or C:\Winnt\System\1024 )

C:\Windows\gxxxxxxx.dll <--- where xxxxxxx is any number of random numbers. There could be many of these files.

%System32%\1024

%System32%\a.exe

%System32%\appmagr.dll

%System32%\asxbbx.dll

%System32%\autodisc32.dll <--- this is TX 4 BrowserAd adware

%System32%\atmclk.exe

%System32%\barseek.dll

%System32%\biasfardihuy.dll

%System32%\birdasfihuy32.dll

%System32%\dcom_14.dll

%System32%\dcom_15.dll

%System32%\dcom_20.dll

%System32%\dcom_21.dll

%System32%\dcomcfg.exe

%System32%\dfrgsrv.exe

%System32%\dnefhw.dll

%System32%\dxole32.exe

%System32%\dxvwpwks.exe

%System32%\dxvwbdds.exe

%System32%\ekvrlfzz.exe

%System32%\ishost.exe

%System32%\ismini.exe

%System32%\ismon.exe

%System32%\isnotify.exe

%System32%\issearch.exe

%System32%\ixt0.dll

%System32%\ixt1.dll

%System32%\hp???.tmp ( where ??? is any 3 random characters

%System32%\hp????.tmp ( where ???? is any 4 random characters)

%System32%\ld??? .tmp ( where ??? is any 3 random characters)

%System32%\ld???? .tmp ( where ???? is any 4 random characters)

%System32%\main.exe

%System32%\mssearchnet.exe

%System32%\msvol.tlb

%System32%\ncompat.tlb

%System32%\nvctrl.exe

%System32%\0mcamcap.exe

%System32%\ot.ico

%System32%\regperf.exe

%System32%\runsrv32.dll

%System32%\runsrv32.exe

%System32%\shdocvn.dll

%System32%\simpole.tlb

%System32%\stdole3.tlb

%System32%\susp.exe

%System32%\svcnt32.exe

%System32%\TheMatrixHasYou.exe

%System32%\ts.ico

%System32%\users32.exe

C:\Documents and Settings\[Current User Account]\Start Menu\Programs\SpywareQuake

C:\Documents and Settings\[Current User Account]\Start Menu\Programs\Trust Cleaner

C:\Documents and Settings\[Current User Account]\Desktop\Cleaner.lnk Trust

C:\Documents and Settings\[Current User Account]\Local Settings\Application Data\TitanShield

C:\Documents and Settings\[Current User Account]\Local Settings\Temp\wschtm35.dll

C:\Documents and Settings\[Current User Account]\Application Data\Microsoft\Internet Explorer\Quick Launch\TitanShield Antispyware.lnk

C:\Documents and Settings\[Current User Account]\Start Menu\Programs\TitanShield Antispyware

C:\Documents and Settings\[Current User Account]\Start Menu\Programs\titanshield.lnk

C:\Documents and Settings\[Current User Account]\Desktop\TitanShield Antispyware.lnk

C:\Documents and Settings\[Current User Account]\Local Settings\Temp <--- delete all files in this folder. Windows will block deletion of a few. This is normal.

In each of the above lines replace the [Current User Account] text with the actual user account name you are logged into.

Reconnect your cable to the internet.

Now attach your smitfiles.txt log to a message and provide information about the steps above and what your
current status is with Spyware Quake . If you need help attaching files see: HOW TO: Attach Items To Your Post

Log in or Sign up

SpywareQuake & SpyFalcon Removal Procedure

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Attached Files:

fixquake.zip

Log in or Sign up

SpywareQuake & SpyFalcon Removal Procedure

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Attached Files:

fixquake.zip

Useful Searches