Posted 03 March 2006 - 03:45 PM
I became infected with spy falcon a couple of days ago. Found this forum and the thread about removing it. I followed the instructions pretty well I thought and everything seemed okay. At least the nuisance screen and blinking warning icon were gone. Well, I noticed in the start menu it looked as though I had a couple of new options, one was "internet security.net" or something like that. The other was something like "malware remover" I really can't remember exactly.
Anyway I right clicked on one of them to see a properties or remove and immediately spy falcon opened again. The warning icon was back as well. I got my instructions out and proceeded to go through them again. The first thing I noticed that when booted in safe mode the file folder wasn't in programs as it was before. In fact I couldn't find it all. I also couldn't find dxmpp.dll anywhere. I searched hidden folders, system folders, etc, etc. I rebooted to command prompt and couldn't find it that way either.
Adaware would tell me it had removed the infection but as soon as I rebooted it was back. I did that at least a dozen times over the past couple of days. I tried the trend micro, spybot, avast scan, and sbc yahoo anti spy all with the same results. The A.S. programs would identify and remove spy falcon but it always came back.
My Son In Law told me to search for a DLL that had been modified in the last couple of days, I found four, 3 of them I was pretty sure what they were. One I didn't recognize is "ginuerep.dll" I searched a couple of dll libraries and couldn't find it listed so I renamed it, moved it and rebooted. As of right now, I have no sign of spy falcon. I hope it's for good this time. Has this ever happened to anyone before? Is it gone, or am I on borrowed time again?