Subscribe To

Home

Spyware Database

"SpywareQuake Removal Guide"

SpywareQuake Removal Guide

SpywareQuake Description

SpywareQuake is a trojan that displays an icon in the system tray. SpywareQuake looks like a legitimate application for removal of spyware, but it installs a trojan in an attempt to trick you into buying the software. The SpywareQuake trojan is able to change the Internet Explorer default home page and redirect the web browser to malicious web sites. SpywareQuake will also pop-up fake alerts that resemble system alerts in another attempt to get you to buy it.

SpywareQuake Automatic Detection (Recommended)

Is your PC infected with SpywareQuake? To safely & quickly detect SpywareQuake, we highly recommend you...

Download SpyHunter's Malware Scanner.

SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware removal tool to remove the malware threats.

SpywareQuake Manual Removal Instructions

Backup Reminder: Always be sure to back up your PC before making any changes.

Step 1 : Use Windows Task Manager to Remove SpywareQuake Processes

Remove the "SpywareQuake" processes files:

Read more about How to kill SpywareQuake Processes

Step 2 : Use Registry Editor to Remove SpywareQuake Registry Values

Locate and delete "SpywareQuake" registry entries:

MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\jkkhhfg
MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\fccbx
D5A9F682-4A26-4920-90D2-72AD8CF3442B
fbea0445-4c4a-4136-864a-c72a4a182a84
SOFTWARE\Microsoft\Internet Explorer\Toolbar\fbea0445-4c4a-4136-864a-c72a4a182a84
Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\FBEA0445-4C4A-4136-864A-C72A4A182A84
Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\052B12F7-86FA-4921-8482-26C42316B522
755bbd1a-aa59-456c-afeb-b4c42c4dcb6f
39f25b12-74ff-4079-a51f-1d70f5b08b84
052b12f7-86fa-4921-8482-26c42316b522
Software\Microsoft\Internet Explorer\Toolbar\052b12f7-86fa-4921-8482-26c42316b522
a43385f0-7113-496d-96d7-b9b550e3fcca
SpywareQuake
Microsoft\Windows\CurrentVersion\App Paths\SpywareQuake.exe
FC4EDF66-0547-4F1A-AE96-7CFCAD711C90
F459EADB-5903-48D5-864C-2B7B46AB1424
E3DF91F3-F24F-441E-9001-D61F36024322
DD90F677-D205-4F70-9014-659614AABCB2
C4EEDC19-992D-409A-B323-ED57D511AFA5
BEC8A83D-01D4-4F15-B8A9-4B4AB24253A7
BA397E39-F67F-423F-BC6E-65939450093A
AE90CAFC-09D4-47F0-9E11-CE621C424F08
9283DAC1-43F5-4580-BF86-841F22AF2335
86C7E6C3-EC47-44E5-AA08-EE0D0A25895F
76D06077-D5D3-40CA-B32D-6A67A7FF3F06
5D42DDF4-81EB-4668-9951-819A1D5BEFC8
5790B963-23C5-43C1-BCF5-01C9B5A3E44E
43CFEFBE-8AE4-400E-BBE4-A2B61BB140FB
23D627FE-3F02-44CF-9EE1-7B9E44BD9E13
189518DF-7EBA-4D31-A7E1-73B5BB60E8D5
AC1B4DA2-12FA-31F2-1A7D-CD2B14E6AD4E
EA26CE12-DE64-A1C5-9A4F-FC1A64E6AC2E
210b4043-35ca-4aa0-8796-191f9663dfb3
89e4aaba-3b21-49b3-b922-8ca35193c68e
SpyQuake2.com
Microsoft\Windows\CurrentVersion\App Paths\Spy-Quake2.exe
5E05EA9F-1EA7-4D0B-A09B-D5E29EC758B9
EB5CA3AF-26C1-467B-9A55-2820E0451AAB
E5AD5BD5-C710-45E0-ABD3-E770FE85DAE8
DDB0D689-FAE0-4165-9F7C-877602F9DD66
D01D4AAB-22C5-427F-A941-C4B65A3D8A23
C1C56112-2B2E-4D3C-8CFC-7E10C77FACEF
B2B3702A-5425-489E-A3AF-EDCCAFEBA019
9989A9BC-9828-467E-AF06-E3B279E6E97B
94786C47-EB3F-4BD5-A66B-0D49E2C90541
853E0D78-F4C2-47CB-A3F5-A774DA60DFCD
82C6C396-DD7B-4CE5-B668-C0087D1F3A1F
7A2F6251-6C99-4DA5-9827-954EB45DCB82
66189AF2-7726-46E8-8628-0F95AB854792
61032A65-2371-4C89-B5BB-DF73090FB5EA
4E3645AF-7A81-4F83-9B8C-1E4F930D873F
411F83B1-A0EC-4155-AF99-0137F5EFB270
2DD8D482-8F1C-4180-AA8E-9D5819E5F2EA
5B55C4E3-C179-BA0B-B4FD-F2DB862D6202
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\AC1B4DA2-12FA-31F2-1A7D-CD2B14E6AD4E
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\EA26CE12-DE64-A1C5-9A4F-FC1A64E6AC2E
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpyQuake2.com
HKEY_LOCAL_MACHINE\SOFTWARE\SpywareQuake\Language:"1033"
HKEY_LOCAL_MACHINE\SOFTWARE\SpywareQuake\refid:"1"
CurrentVersion\Uninstall\SpywareQuake\Publisher:"SpywareQuake.com"
CurrentVersion\Uninstall\SpywareQuake\URLInfoAbout:"http://www.spywarequake.com"
CurrentVersion\Uninstall\SpywareQuake\NSIS:StartMenuDir:"SpywareQuake"
CurrentVersion\Uninstall\SpywareQuake\DisplayVersion:"2.0"
CurrentVersion\Uninstall\SpywareQuake\DisplayIcon:"%programfiles%\SpywareQuake\SpywareQuake.exe"
CurrentVersion\Uninstall\SpywareQuake\UninstallString:"%programfiles%\SpywareQuake\uninst.exe"
CurrentVersion\Uninstall\SpywareQuake\DisplayName:"SpywareQuake2.0"
CurrentVersion\Run\SpywareQuake:"%programfiles%\SpywareQuake\SpywareQuake.exe/h"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\AppPaths\SpywareQuake.exe\:"%programfiles%\SpywareQuake\SpywareQuake.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareQuake
4DA4616D-7E6E-4FD9-A2D5-B6C535733E22
661173EE-FA31-4769-97D4-B556B5D09BDA
E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
HKEY_LOCAL_MACHINE\SOFTWARE\SpywareQuake\Language: "1033" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpywareQuake
HKEY_LOCAL_MACHINE\SOFTWARE\SpywareQuake\refid: "1" 
CurrentVersion\Uninstall\SpywareQuake\Publisher: "SpywareQuake.com" 
CurrentVersion\Uninstall\SpywareQuake\URLInfoAbout: "http://www.spywarequake.com" 
CurrentVersion\Uninstall\SpywareQuake\NSIS:StartMenuDir: "SpywareQuake" 
CurrentVersion\Uninstall\SpywareQuake\DisplayVersion: "2.0" 
CurrentVersion\Uninstall\SpywareQuake\DisplayIcon: "%programfiles%\SpywareQuake\SpywareQuake.exe" 
CurrentVersion\Uninstall\SpywareQuake\UninstallString: "%programfiles%\SpywareQuake\uninst.exe" 
CurrentVersion\Uninstall\SpywareQuake\DisplayName: "SpywareQuake 2.0" 
CurrentVersion\Run\SpywareQuake: "%program files%\SpywareQuake\SpywareQuake.exe /h" 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ 
CurrentVersion\App Paths\SpywareQuake.exe\: "%programfiles%\SpywareQuake\SpywareQuake.exe" 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareQuake HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowserHelper Objects\{4DA4616D-7E6E-4FD9-A2D5-B6C535733E22} 
HKEY_CURRENT_USER\Software\Classes\CLSID\{E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D} 
HKEY_CLASSES_ROOT\Typelib\{661173EE-FA31-4769-97D4-B556B5D09BDA} 
SharedTaskScheduler\{E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D} 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpywareQuake

Step 3 : Use Windows Command Prompt to Unregister SpywareQuake DLL Files

Search and unregister "SpywareQuake" DLL files:

Read more about How to Remove SpywareQuake DLL Files

Step 4 : Detect and Delete Other SpywareQuake Files

Remove the "SpywareQuake" processes files:

winB471.tmp.exe
win15.tmp.exe
win35.tmp.exe
win26.tmp.exe
avp
fccbx.dll
win13.tmp.exe
win18.tmp.exe
9.tmp.exe
win7.tmp.exe
win6.tmp.exe
win12.tmp.exe
flx3.dll
win8.tmp.exe
win17.tmp.exe
ixt0.dll
SafetyBar.dll
Winwcd.dll
urroxtl.dll
winF.tmp.exe
win5.tmp.exe
SpywareQuake.lnk
SpywareQuakeInstaller[1].exe
win9.tmp.exe
win3.tmp.exe
Uninstall SpyQuake2.com 2.3.lnk
SpyQuake2.com 2.3 Website.lnk
SpyQuake2.com.lnk
SpyQuake2.com 2.3.lnk
SpywareQuake
SpyQuake2.com
vwlummc.dll 
viruxz.dll
jpqet.dll
fhmfes.dll 
spy-quake2.exe
issearch.exe 
isnotify.exe
ismon.exe 
ishost.exe 
zlara.dll
yvvdj.dll  
yephk.dll 
yfysupa.dll
xuefh.dll 
vpxnk.dll 
viwpzla.dll
vhywj.dll 
qrucmr.dll
tnvocyn.dll
rmzdzx.dll 
pmnqguh.dll 
oybgrql.dll 
ornzq.dll 
ofcukiz.dll 
mzoeut.dll
lwpfwjb.dll 
kkqfb.dll 
jevtxpg.dll 
hzclqhc.dll 
hvcycg.dll 
gvfsc.dll 
guxxa.dll 
erxbx.dll 
dnefhw.dll  
bpvcou.dll 
autodisc32.dll 
ld[X].tmp
hp[X].tmp
english.ini
sq.ini
spywarequake.url
ref.dat
blacklist.txt
uninstallspywarequake2.0.lnk
spywarequake2.0.lnk
spywarequake2.0website.lnk
nvctrl.exe
mssearchnet.exe
dfrgsrv.exe
msvcr71.dll
msvcp71.dll
suprox.dll
dvdcap.dll
xenadot.dll
sivudro.dll
stickrep.dll
yhbdupd.dll
imfdfcj.dll
hvnwm.dll
wfkduei.dll
ywbicim.dll
uninst.exe
spywarequake.exe
spywarequakeinstaller.exe
dfrgsrv.exe, mssearchnet.exe, nvctrl.exe, spywarequake 2.0 website.lnk, spywarequake 2.0.lnk, uninstall spywarequake 2.0.lnk, spywarequake 2.0.lnk, blacklist.txt, ref.dat, spywarequake.url, sq.ini, english.ini, hp[X].tmp, ld[X].tmp

Step 5 : View the SpywareQuake Components with its MD5s

Remove the "SpywareQuake" components:

File Name	File Size	MD5
win35.tmp.exe	20480	229a6f5beb54c795d3efb8026ff8a9ab
SpywareQuakeInstaller[1].exe	2862626	1a356729cf6dcd5617e4062a8e866c3f
v7.exe	12288	e75209324f8db49ec4d97caa41e34401
fccbx.dll	266336	3372c1363d15cd98abe1406783571295
win9.tmp.exe	78336	4f28741f8562780dd6db2ea6e10c1a68
srvqnm[1].exe win8.tmp.exe	19456	6c32a0f11037fb2d319e3ab58bcac0aa
winB471.tmp.exe	20992	8bb1f9c3d383834b38468c29dd4c83d4
xc23[1].exe	12288	e75209324f8db49ec4d97caa41e34401
win15.tmp.exe	20992	23ef96e4105f541afc25845fd0f62565
win5.tmp.exe	12288	e75209324f8db49ec4d97caa41e34401
Spy-Quake2.exe	1622016	27e5588fd9c78fc43b1905fc7af711c5

SpywareQuake Screenshots

View SpywareQuake screenshots below and see for yourself how SpywareQuake looks like. Learn how to recognize SpywareQuake when it infects your machine.

(click on SpywareQuake image to enlarge)

Publication Date

Tue May 30 2006 12:19:23 EDT

Site Disclaimer

SpywareRemove.com IS NOT associated, affiliated, consorted, or connected with the publishers or creators of SpywareQuake.

User Comments

There are no comments posted for this page.

RECOMMENDED

Top Parasite Threats

Recent Parasite Threats

Resources and Tools

Recent Articles