# SpyFalcon?



## baggytheo (Aug 1, 2004)

I recently had an instance of malware called SpyFalcon pop up in my face, pre-installed without even having to ask me and immediately spurting fake virus warnings with two separate taskbar prompts.

One of the prompts (the cause for this thread, as it remains when I have already taken the necessary steps to delete it all) reads:

"Critical System Error! System detected virus activities. They may cause critical system failure. Pleause, use antimalware software to clean and protect your system from parasite programs. Click here to get all available software."

The message displays whenever the icon on my taskbar (flashing between the green handicap symbol similar to "Accessability" in the Control Pannel, and a 'negative symbol'--the red circle with a slash through it. When I click on the message, I'm brought to http://www.bleepingcomputer.com/forums/topic47826.html, so I'm sure its a remnant of the SpyFalcon infestation. I tried to remove it in its entirity with the instructions found here: http://www.bleepingcomputer.com/forums/topic47826.html (and, if it's at all important, many of the dll's the manual removal instructions said to delete from system32 were simply not there...)

My Panda Activescan.txt (apparently dependant upon the "text wrap" feature in notepad, so, I must ask you to paste it into notepad for clarity):

Incident Status Location 

Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\Cache\3EFBEAA3d01[smitRem/Process.exe] 
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.advertising.com/] 
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.overture.com/] 
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.advertising.com/] 
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.atdmt.com/] 
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.doubleclick.net/] 
Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.z1.adserver.com/] 
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.fastclick.net/] 
Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.z1.adserver.com/] 
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.fastclick.net/] 
Spyware:Cookie/Spyfalcon Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[www.spyfalcon.com/] 
Spyware:Cookie/SexList Not disinfected  C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.sexlist.com/] 
Spyware:Cookie/cs.sexcounter Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.cs.sexcounter.com/] 
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.adultfriendfinder.com/] 
Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[counter9.sextracker.com/] 
Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.sextracker.com/] 
Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[counter9.sextracker.com/] 
Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.sextracker.com/] 
Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[counter4.sextracker.com/] 
Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[stats1.reliablestats.com/] 
Spyware:Cookie/WinFixer Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.winfixer.com/] 
Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[stats1.reliablestats.com/] 
Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[counter10.sextracker.com/] 
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.toplist.cz/] 
Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[counter7.sextracker.com/] 
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.trafficmp.com/] 
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.casalemedia.com/] 
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[servedby.advertising.com/] 
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.belnk.com/] 
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.tribalfusion.com/] 
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.com.com/] 
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.2o7.net/] 
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.atwola.com/] 
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.2o7.net/] 
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.serving-sys.com/] 
Spyware:Cookie/MediaTickets Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.kinghost.com/] 
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.ads.pointroll.com/] 
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.statcounter.com/] 
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.hitbox.com/] 
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[ad.yieldmanager.com/] 
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.realmedia.com/] 
Spyware:Cookie/PayCounter Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.paycounter.com/] 
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.xiti.com/] 
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[statse.webtrendslive.com/] 
Spyware:Cookie/WebtrendsLive  Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[statse.webtrendslive.com/dcsbqpqko10000chtrutcszcp_1c8d] 
Spyware:Cookie/360i Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.ct.360i.com/] 
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.as-us.falkag.net/] 
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.questionmarket.com/] 
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.zedo.com/] 
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.mediaplex.com/] 
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.perf.overture.com/] 
Spyware:Cookie/Entrepreneur Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.entrepreneur.com/] 
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.247realmedia.com/] 
Spyware:Cookie/WebPower Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.webpower.com/] 
Spyware:Cookie/888 Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.888.com/] 
Spyware:Cookie/Falkag  Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.as-eu.falkag.net/] 
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[sel.as-eu.falkag.net/] 
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.as-eu.falkag.net/] 
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.tradedoubler.com/] 
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.ehg-sonycomputer.hitbox.com/] 
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Ted Wray\Application Data\Mozilla\Firefox\Profiles\xi6ncdzd.default\cookies.txt[.adrevolver.com/] 
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][1].txt 
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][2].txt 
Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][2].txt 
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][1].txt 
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][2].txt 
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][2].txt 
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][2].txt 
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][2].txt 
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][1].txt 
Spyware:Cookie/Banner Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][2].txt 
Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][1].txt 
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][2].txt 
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][2].txt 
Spyware:Cookie/CentrPort Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][1].txt 
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted w[email protected][2].txt 
Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][1].txt 
Spyware:Cookie/FortuneCity Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][2].txt 
Spyware:Cookie/DomainSponsor Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][1].txt 
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][1].txt 
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][1].txt 
Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][2].txt 
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][2].txt 
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][2].txt 
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][1].txt 
Spyware:Cookie/BurstBeacon Not disinfected  C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][2].txt 
Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][1].txt 
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Ted Wray\Cookies\ted [email protected][2].txt 
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Ted Wray\Desktop\smitRem\Process.exe 
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Ted Wray\Desktop\smitRem.exe[smitRem/Process.exe] 
Adware:Adware/ClockSync Not disinfected C:\Various Downloads\GDiVXZen1.2.exe[²ÜÇ\VVSNInst.exe] 
Potentially unwanted tool:Application/RealSpy Not disinfected C:\WINDOWS\system32\actskn45.ocx


----------



## tsSecure (Feb 5, 2006)

Download SpyBot Search and Destroy with TeaTimer and SD Helper Enabled.
Since the TeaTimer has a problem with is sizing go to the link below for a fix to that problem: http://forums.spybot.info/showthread.php?t=122


----------



## baggytheo (Aug 1, 2004)

I already use SpyBot, and I've run it several times (updated as well) since the problem. It's no help.

Edit: It DOES remove the firefox tracking cookies of spyfalcon, but does nothing to get rid of the taskbar bug or any other remnants of the install.


----------



## tsSecure (Feb 5, 2006)

Do you have Ad-Aware SE? If so and it is no help try posting your log in the HJT forum section.


----------



## baggytheo (Aug 1, 2004)

I've heard time and time again that Ad-Aware installs its own spy/adware on your computer. Is this true?


----------



## baggytheo (Aug 1, 2004)

I got Ad-Aware and it detected an entry for SpyFalcon, but dealing with it didn't remove the taskbar bug. I've also tried System Restore, but it hasn't worked--I think on account of the fact that the taskbar bug was part of a software install.


----------



## tsSecure (Feb 5, 2006)

*Reply*

either buy Spy Sweeper or post your HJT log in the HJT Forum Section


----------



## MicroBell (Sep 21, 2004)

baggytheo,

I'm not quite sure why your posting here since your issue is malware related concerning "Spyfalcon". Please follow the removal instructions I posted here..
http://www.techsupportforum.com//se...s//91954-users-self-help-malware-removal.html

**Note** Use the instructions in the *"SmitFraud and It's Varients Removal Instructions"* thread.


If your still having issues after you run that fix..then follow the advice in this thread...http://www.techsupportforum.com//se...68-please-read-before-posting-hijackthis.html

Once complete....post your hijackthis log in the hijackthis forum and we will address this issue with you.

*Note* Automatic scanners like Adaware, Spy Sweeper..etc can detect SOME of this infections files and entrys but CAN NOT remove it. I also see in your log you used the smitRem tool. This tool hasn't been updated to remove the newer version of this infection.


----------

