First of all I'd like to thank everyone who sent me a note telling me that these instructions work - it's good to know that not only are they correct but that they are easy to follow too.

Also, I'd like to add that these removal instructions also work for a variant of SpywareQuake called SpyQuake2.com, so if you have that, feel confident that these instructions (or the commercial utilities linked to) will remove this for you too.

If you are coming here and you have Spyware Quake on your system then I suggest that you print out the steps below and follow them carefully (I've created a PDF which contains instructions on removing Spyware Quake that you can download in case that's easier for you to follow and print).  Missing out a step can mean that you end up with Spyware Quake on your system at the end, which is an end result that you don't want.

It is vitally important that after removing SpywareQuake you scan your system for any other malware - this is to prevent re-infection.

---------------------------------------------------------------- 

Want a quick, low-cost and guaranteed way to remove Spyware Quake and protect yourself against future spyware?  Click here to download a copy of Spyware Doctor. SPECIAL OFFER!!! For 5% discount (limited to first 1,000 customers - going fast!) enter coupon code AWKI-83I0.

Spyware Quake/SpywareQuake is a new fake antispyware application.  Once installed (usually the installation is carried out by Trojans or using Windows vulnerabilities) on a PC it generates fake messages informing the user that the PC is infected with fake malware in an attempt to get the user to buy a commercial application.

There is also a Windows System Tray message generated:

Your computer is infected!
Critical System Error!
System detected virus
activities.  They may cause
critical system failure. Please
use antimalware software to
clean and protect your system
from parasite programs.
Click here to get all available
software.

To remove Spyware Quake you need to download two tools:

• smitRem.exe
• FixSQ.reg

It’s important to bear in mind that smitRem DOES NOT uninstall Spyware Quake – this is to uninstall portions of Smitfraud that is installed as part of Spyware Quake.  Soon smitRem will be updated to include Spyware Quake and the uninstall will be far easier.

Spyware Quake Removal Instructions

1. Download smitRem.exe and FixSQ.reg.  Save both to your Windows desktop
2. Double-click on smitRen to run it and extract the files to your desktop.
   
3. Double-click on FixSQ.reg.  When asked if you want to merge the information into your Windows registry, click Yes and then OK.
4. Now reboot your PC and start it in Safe Mode.  This is an important step!  If you allow the system to boot into Windows normally you will have to go back to Step 1.
5. Once your PC has booted into Windows enter Control Panel and double-click on Add or Remove Programs. 
6. Find the entry for SpywareQuake and double-click on it and uninstall the application.  DO NOT reboot the PC if prompted to do so!
7. Delete the following files and folders (some may not be present on your system):
   c\windows\system32\nvctrl.exe
c\windows\system32\dfrgsrv.exe
c\windows\system32\mssearchnet.exe
c\windows\system32\stickrep.dll
c:\program files\spywarequake\
8. Double-click on the smitRem folder on your desktop and run the file contained in the folder called RunThis.bat.  This program will then guide you through the uninstall process for any remaining components that are installed on your system.  It will also automatically run Disk Cleanup to remove any remaining traces of the spyware.
9. Reboot your system and start it up normally.
10. Install/update your antivirus/antispyware applications and run a full system scan.  If you aren’t running any, get some!  Do not skip this step!  At the very least run a free online scan at the Windows Live Safety Center.
11. Click on Start > All Programs > Accessories > System Tools > Disk Cleanup.  Run a Disk Cleanup operation on the drive you have Windows installed onto (usually C drive).  Remove all the temporary files and temporary Internet files to make sure that Spyware Quake is gone.
12. At the end of all this you might find that a few things are different.  Your homepage might be a blank (about:blank) and your cookies containing login details for some websites might be gone.  You will have to reset these as you use the system. 

Alternatively, if you want an automatic way to remove Spyware Quake, get a copy of Spyware Doctor (trial here). SPECIAL OFFER FOR PC DOC READERS!!!  For 5% discount (limited to first 1,000 customers - going fast!) enter coupon code AWKI-83I0.

Spyware Doctor has consistently been awarded Editors' Choice, by leading PC magazines and testing laboratories around the world, including United States, United Kingdom, Sweden, Germany and Australia. All current versions of Spyware Doctor have won Editors' Choice awards from PC Magazine in United States. In addition, after leading the market in 2005, Spyware Doctor was awarded the prestigious Best of the Year at the end of 2005.

That’s it!  Your system should now be free of this annoying malware.

Technorati Tags: SpyQuake2.com, Spyware Quake, SpywareQuake

This entry was posted on Sunday, March 26th, 2006 at 13:15 and is filed under Stay Secure. You can follow any responses to this entry through the RSS 2.0 feed. Responses are currently closed, but you can trackback from your own site.