XP-IE has spy-falcon (XP-SP2)

[rabee]

I got "Spy-Falcon" malware yesterday, and was advised through a Google search to delete dxmpp.dll (or "remove it").
then, I should go to regedit, and follow this string:
HKEY_LOCAL_MACHINE_SOFTWAREMICROSOFTWINDOWSCURRENT VERSION EXPLORERSHARED TASK SCHEDULER.....then, "remove any unknown classis".
I found (Default) REG_SZ (value not set). This was the only one without a stated value. I'm always nervous about going into the Registry, so my question is:
Does anyone know if this REG_SZ (value not set) is a legal registry entry, or can I safely delete it. If not delete it, how should I modify it to killl this rotten spyware and intruder?
I downloaded Mocrosoft beta Security program, and it couldn't get rid of it.
Sorry to be so long-winded. Thanks for past help.

[JoeP517]

It is a legal entry. You should not have to do anything to it. If all other entries are known then just getting rid of the dll and re-booting should do it.

Joe

[rabee]

Thanks for the reply - -
Now, Ifind that Windows XP Home cannot find or display the dxmpp.dll..........Is there a special way to get to that?
I've tried the Search, but "no files can be found" or words to that effect. I never have much luck with the Search
utility in XP - - very low rate of success for me. More help would be appreciated.

[HansV]

Do you display the contents of system folders, and do you show hidden files and folders?

[viking33]

There is a lot of discussion regarding this SpyFalcon thing. If you have Googled it you have seen the number of hits on the subject.

One that seems to be worthwhile is HERE

Some of those hits suggest you go to a Spyware Removal site but it will only remove it if you purchase the removal tool. Those are places I would stay away from. Far away.

[viking33]

Adding the note:

This is a rather long process, so I would print out the page and have it handy to follow it step by step.

[rabee]

Hey Bob -
I owe you big, man. It worked like a charm - the bleeping computer link was the ticket and it wiped out the rotten Spy Falcon.
I wish there was a way to track which email or whatever brought on this thing....it really is the most annoying thing you
can find on your desktop. But, it's gone now, and thank you very much.

[viking33]

Ray,
You are most welcome. Glad that did the trick for you.

So far as tracking where it came from, well, that's kind of like trying to find out where you got that nasty cold from. All you can do is be extremely careful as to where you surf. Don't open strange emails or attachments and use good AV and malware progs ( and keep them updated ) and have a good firewall up and running.