In cruising the spyware removal foums I have
noticed more and more people having problems removing incredifind.
Interesting fact incredifind was one of the first pieces of spyware I
worked to remove and I found it then and still a decpetive and
malicious piece of software that employs every trick possible to keep
itself from being removed. So if you are having problems with read on
for instructions how to remove it.
To remove SpyFalcon:
Download and run hijackthis
,
in hijackthis check off the boxes next to the following and click remove
R3 - URLSearchHook: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL
Using my SSQKit
kill the following processes
delupdat.exe
sui.exe
wupdater.exe
Next copy the following and paste in notepad and save as killap.reg
**after you have saved the killap.reg file double click the file to add the changes to the registry
REGEDIT 4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
"CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="Search Bar"="http://search.msn.com/intl/searchpane/en-au/prov2.htm"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
""="http://home.microsoft.com/access/autosearch.asp?p=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://search.msn.com/spbasic.htm"
"Use Custom Search URL"= dword:00000000
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix]
@="http://"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes]
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\updater
[-HKEY_LOCAL_MACHINE\Software\IncrediFind]
[-HKEY_LOCAL_MACHINE\Software\updater]
[-HKEY_CLASSES_ROOT\BHO.IncrediFindBHO]
[-HKEY_CLASSES_ROOT\BHO.IncrediFindBHO.1]
[- HKEY_CLASSES_ROOT\CLSID\{5D60FF48-95BE-4956-B4C6-6BB168A70310}
[- HKEY_CLASSES_ROOT\Interface\{8B8F6968-2F24-41E3-B653-E9613226F14D}
[- HKEY_CLASSES_ROOT\TypeLib\{DE289BFA-737B-4ABB-A4EC-F8753551B875}
[ HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\]
"{5D60FF48-95BE-4956-B4C6-6BB168A70310}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\]
"{5D60FF48-95BE-4956-B4C6-6BB168A70310}"=-
Next using the SSQKit search for and unregister the following dll*
incfindbho.dll
In the find section type the name of the dll and then right click on it once
found and choose unregister
Finally using the ssqkit find and delete the following files and folders
delupdat.exe
sui.exe
wupdater.exe
incfindbho.dll
C:\Program Files\IncrediFind
C:\Program Files\Common Files\updater
After you are all done restart your computer and once satisfied delete the
backup files from c:\killit