Smart File Advisor Crapware Removal

If you had come to this page, you are more likely than not to have installed a perfectly legit software which had bundled with this software known as "Smart File Advisor" also known as SFA. One known one is Alcohol 52% FE.

While what SFA tries to do is to keep track of your file associations, but in a very dangerous way. Instead of letting Windows manage it, it checks for a php online everytime a new file type is used. In addition, it messes around with your registry at:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Associations
And this is where the real danger lies in. In theory (if it had not already been taking places) is that whenever you try to download a file, it would poll that php scripts and it CAN do really bad things like redirecting you to another file instead (and renaming it to be your original - Its not even hard), make you run some scripts which captures information form your PC, insert codes into your return pages which can do almost anything a page can do and more.

In short. SPYWARE. And its not just me doing all the bullshiting here! Even AVG backs me by flagging SFA as a virus!

So, if I have convince you to uninstall SFA. Good. But this is just the point where you find that if you try to uninstall it from the Add/Remove or "Programs and Features" (in Windows 8), you will either find that SFA will threaten to remove your other software as well and most likely it will fail to uninstall anyway.

So, is there a uninstaller? Yes, but after looking through the page I found, I find the "uninstaller" rather fishy by itself too, so I really won't recommend it. So, let's do it manually. You will need to make sure you close the stupid SFA program from the tray and in memory (Task Manager). Then you will need to perform the following which involve deleting of a folder (usually just 1, 32 or 64 bits). And then you will need to remove some registry entries away. I had it packed into a reg file for you to cut and paste into your editor and save it.

1. Delete away these directories if you have any of them:
C:\Program Files\Smart File Advisor
C:\Program Files (x86)\Smart File Advisor

2. Here is the "Remove SFA.reg":
Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\*\shell\sfa_checksum]

[-HKEY_CLASSES_ROOT\*\shell\!sfa]

[-HKEY_CLASSES_ROOT\Unknown]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\sfa_checksum]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\!sfa]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Smart File Advisor"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SFAUpdater"=""

[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Smart File Advisor_is1]

Uninstall Apple Crapware

At some point of time, I must be mad to install that Apple iTunes which is 300MB... Then I decided to remove it. And the crap it left haunts me till today. Every so and then, Apply Software Update still pops up, trying to connect to the Internet which my firewall had blocked. Why is there still Apple Update when Quicktime, iTunes and all other crap from Apple had been removed? Are they sending some information to Apple or downloading some adware to my PC. Its up to your imagination. To me, it is a total nuisance.

It does not pops up all the time shows that it is a scheduled task. Opening Scheduler will reveal a whole tab for Apple. Well, its simple enough to disable it here. But for my case, I want it out and clean from my PC. So, you should go look at the Program Features and locate the 2 Apple crapware. Use the search with "Apple" and you will find it. One of them is the Apple Software Update obviously and other Apple Support . Both should go to trash immediate (without passing recycled bin or collecting $100). 

Some more unfortunate people I heard had problem removing them because the uninstallation of Apple iTunes or Quicktime had screwed up and left the installation in a unclean state. In that case, we can always try Microsoft Windows Installer Cleanup at:
http://support.microsoft.com/kb/290301

You should double check on your Scheduler to see if the Apple task had been removed. 

F-Secure Backlight

Sometimes, there is just this need to run a quick scan for rootkit. And you obviously did not want to install a xxxx 2008 security suite which is about 200MB... This is one small utility which you can keep in your thumbrive or portable HDD to run quick scan. No install, no setup. Just run.

F-Secure Backlight is a rootkit detection plus REMOVAL tool. Why I highlighted removal is that there are some tools out there which scans for free, but you need to buy the suite to remove...

Anyway, read more about F-Seure Backlight cos I do not want to do sale preach here.
http://www.f-secure.co.uk/blacklight/blacklight.html

Download directly :
http://rapidshare.com/files/75397222/fsbl.exe

Flashget 0wnz you!

I had recently decided to advise people against using the so call "most popular downloader" Flashget. The reason behind has multiple security risks. I will list my findings here:

1. Flashget connects to all sort of servers in Eastern Europe, China and Russia even while its idling. Just do a netstat and you will see... To support this, just view the Flashget.exe binary and you will see a whole bunch of url and ip address inside... Whats the use of that? Really looks suspicious.
2. Flashget shareURL seems to store all the URL of things you downloaded. This mayb even be "special" download which is for you only, but once share, you know what I mean. Its a privacy issue and by default ShareURL is turned on. Although it claims that protected URL is not shared, I am not convinced how they tell which is protected.
3. Flashget transmit several online logons as plain text. This is true even for Rapidshare. By doing so, even if Flashget does not get you (I heard stories that they collect logins and passwords and people detected it was send to somewhere in china), others will because it passes through so many routes in plain. This is totally unacceptable.
4. Although Flashget claims to be totally free now, it has a bad history of installing a highly dangerous spyware in the past even when it claims its just shareware / free for personal uses then. This has really shaken the trustworthiness of the authors.

I would present the evidences and captures if necessay to support my above claims. But if you believe me, stop now. Remove Flashget and use Orbit Downloader or some others. So far, Orbit has been tested clean and works quite well. It does not have P2P for BT and emule, but it can capture video streaming like youtube etc... OK, I don't want to convert you to Orbit, you are free to choose, but you should not put Flashget as one of your choices.