Is SpyHunter a virus? What it is, why it gets flagged and how to remove it
SpyHunter is a paid anti-malware program from Enigma Software, not a virus, and the "virus" label comes from a disputed detection, old advertising and fake copies. Check where your copy came from, cancel the subscription if you do not want it and uninstall it from Settings.
Facts checked October 5, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
An automatic scan checks installed programs, startup items and browser extensions for anything that came with SpyHunter.
Do it yourself · free Remove SpyHunter yourself 4 steps, about 12 minutes, no software needed.
Start the steps
SpyHunter: summary
| Type | Commercial anti-malware program; its name is also used by fake and cracked copies |
|---|---|
| Risk | Medium: not malware; the risks are auto-renewal, a disputed label and copies not from the vendor |
| Symptoms | An unexpected subscription charge; a security warning about the file; a copy you do not remember installing |
| How to get rid of it | Cancel the subscription, uninstall it from Settings, remove the extension, scan if the copy was cracked |
| Detection names | No Microsoft detection name is known for the genuine program (we found none on 5 October 2026); a cracked copy is a different file |
| Our check (5 October 2026) | Vendor pages, domain records and court record read; the program itself was not installed or tested |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 14 more facts
| Running since | Domains registered 1997 (spyhunter.com) and 1998 (enigmasoftware.com) |
|---|---|
| First reported by us | 4 November 2019 |
| Price | Typically from $49.98 (Basic) and $79.98 (Pro) every six months, auto-renewing |
| Name | SpyHunter |
| Domain registered | 23 June 1997 |
| Evidence | 8 reports from affected users and security sites; details still limited |
| Program | SpyHunter |
| Publisher | Enigma Software Group |
| Category | Optimizer |
| Price asked | $49.98 or $79.98 every six months |
| First seen | 4 November 2019 |
| Distribution | Typically bundled installers and ads |
| Damage | Money paid for exaggerated results, needless registry changes |
| Facts checked | 5 October 2026 |
Facts checked on 5 October 2026 against the vendor's own support pages, the registry's RDAP records, the court record and press reports listed in the sources. We did not install or test the program.
What SpyHunter is and what it is not
SpyHunter is a paid anti-malware program for Windows and Mac, sold by Enigma Software (its own pages now say EnigmaSoft). It is not a virus. The word "virus" gets attached to it for reasons covered below, and a few of them are fair.
- Maker
- Enigma Software Group (EnigmaSoft on its own pages); real downloads are on
enigmasoftware.comandspyhunter.com - Versions the vendor lists
- SpyHunter 5 for Windows (Basic and Pro), SpyHunter for Mac, the Web Security browser extension, and older SpyHunter 4 and RegHunter 2 (a registry tool)
- What the vendor says it does
- Detects and removes malware; subscribers get a support desk ("Spyware HelpDesk") that can send a custom fix
- Domains
spyhunter.comregistered 23 June 1997,enigmasoftware.com3 April 1998
- 1
You scan
The free part scans the computer and lists what it considers threats.
- 2
You pay to fix
Removing what it found needs the subscription, or the 7-day trial, which asks for a payment card first.
- 3
It renews itself
It renews at the standard price until you cancel it in your account on the vendor's site.
Some searches for "spy hunter" are about the car-combat video game series that began as an arcade game in 1983. If you came for that, this is the wrong page.
Is SpyHunter safe? Why it is flagged
What we checked on 5 October 2026
We did not install or run SpyHunter, so nothing here says how well it finds or removes malware. We read the vendor's pages, the domain records and the court and press record.
SpyHunter and its maker · documents read on 5 October 2026 · no program was installed
- Real vendorLong-registered domains, a named company, a support desk and written subscription terms.
- Auto-renewalThe subscription renews itself, and the trial needs a card.
- Detection is disputedA rival security vendor labelled it "potentially unwanted"; the dispute has been in court since 2017.
- Not tested by usWe did not scan a computer with it, so we claim nothing about its results.
Real product, read the terms first The program is genuine and its maker is a known company. The risks are the business model (auto-renewal) and copies that are not from the vendor. This is a document check, not a test of the software, so it clears nothing.
Why people call it a virus
There are four reasons, and only the last means a computer is infected.
| Reason | What the record shows | Does it mean infection? |
|---|---|---|
| Another security program flags it | Malwarebytes labelled it "potentially unwanted" and removed it; Enigma sued over that. Malwarebytes told the court the programs use "deceptive tactics" to scare users into paying, which Enigma disputes. | No: a disputed label on a real program |
| Aggressive marketing | BleepingComputer said in 2017 that it did not agree with some of the ways the product had been marketed; Enigma said it does not condone improper affiliates. | No: it concerns how it was promoted |
| Paying after a scan | Readers in 2012 and 2013 bought it to remove an "FBI" lock screen or a toolbar and found the problem still there. | No: it is a billing and expectation problem |
| A copy that did not come from the vendor | Cracks and "free full version" downloads use well-known names to carry other programs. | Yes: this one can be a real infection |
How the dispute unfolded
2012 and 2013
Readers ask us why it did not fix their problem
Our archive holds questions from buyers: an "FBI" lock screen it did not detect, a toolbar it found but did not remove, a copy that could not activate on a PC with no internet.
2016
Enigma sues BleepingComputer
Enigma sued over forum posts by a volunteer moderator and added trademark claims; BleepingComputer counterclaimed, accusing Enigma of a smear campaign and of calling the site's own tools viruses.
1 March 2017
The BleepingComputer case settles
BleepingComputer removed the moderator's posts and kept monitoring SpyHunter; Enigma set up an abuse form for reporting improper affiliates.
2017 to 2021
Enigma sues Malwarebytes
Enigma complained that Malwarebytes called its programs "malicious", "threats" and "potentially unwanted" and removed them. A California court dismissed the case in 2017, the Ninth Circuit reversed in 2019, the Supreme Court declined to hear the appeal on 13 October 2020, and the district court dismissed again in 2021.
November 2019
Our first report
We called the "virus" talk a misleading label from rival tools. The vendor's page offered a trial with one scan and one removal after a 48-hour wait.
The vendor's 2019 offer, as in our first report: free trial, one removal, subscription from 34.99 euros every six months. 2 June 2023
The Ninth Circuit revives the case
The appeals court held that calling a competitor's program "malicious" or a "threat" can be a judged statement of fact, but "potentially unwanted" was too vague to sue over.
2024
Three claims go forward
The San Jose court refused to dismiss three of Enigma's claims; we found no final ruling by October 2026.
What can go wrong, from most to least serious
- High
A fake or cracked installer
A modified file can install a loader, a stealer or ransomware. If it did not come from the vendor and the PC behaves oddly, treat it as an infection and follow the plan below.
- Medium
A subscription you did not intend
The trial needs a card and the paid plan renews itself, so a forgotten plan means a charge six months later. Cancel as soon as you have decided.
- Medium
Two security programs running together
Two real-time scanners can slow the computer or report each other. Windows sets Microsoft Defender Antivirus to active, passive or disabled depending on what else is installed. Use one real-time scanner and others only on demand.
- Medium
Removing something you need
Every scanner applies its own rules, and "threat" may include programs you chose. Read the list before removing anything.
What readers told us
These reports date from 2012 and 2013 and concern older versions, but each describes a mistake people still make.
"My computer was infected with the FBI Greendot Moneypak Virus ... and then downloaded SPYHUNTER software. SPYHUNTER did not detect virus. I purchased anyway as there were other threats."
"Have Spyhunter on flash drive. Rebooted in safe mode with command prompt. Have flash drive plugged in. Nothing happens. What am I missing?"
"I downloaded the software onto a working device paid the $29.99 in order to remove the malware, copied onto a flash drive and ran it on the affected device. Unfortunately as the virus has stopped the internet connection I cannot use the software ..."
Excerpts from questions sent to our old guides, shortened.
Name the problem first, then pick the tool. A lock screen needs Safe Mode or Microsoft Defender Offline: Run a Microsoft Defender Offline scan.
How SpyHunter got installed
What it costs and how the trial works
Prices have risen since 2019 and the plan renews itself, so read the checkout page before you pay.
| Our 2019 report (vendor page screenshot) | Vendor page read on 5 October 2026 | |
|---|---|---|
| Trial | Free trial: one scan and one removal after a 48-hour waiting period | One-time 7-day trial of Pro or Mac, a payment card required |
| Price | From about 34.99 euros every six months | Typically from $49.98 (Basic, Windows) and $79.98 (Pro, Windows and Mac) every six months; varies by country and promotion |
| Renewal | Not stated in our screenshots | Renews automatically at the standard price, with an e-mail reminder first |
| Refund | Not stated in our screenshots | Full refund if you cancel and ask within 30 days of the purchase |
- 1
Sign in
Go to
enigmasoftware.comand click Login at the top right. - 2
Open Order/Licenses
Choose Order/Licenses; each order has a cancel button.
- 3
Cancel every order
Cancel each order separately. A paid plan keeps working until the paid period ends; cancelling a trial ends access at once.
- 4
Ask for a refund in time
Cancel and ask within 30 days of the latest purchase. If the vendor does not answer, tell your card issuer.
Fake and cracked copies
Only the vendor distributes the real program. Anything else with the name is a different file, and cracked copies are the dangerous part of this topic.
| Where the file came from | What you may actually have | What to do |
|---|---|---|
enigmasoftware.com or spyhunter.com | The real installer, named SpyHunter-Installer.exe on the vendor's pages | Keep it or uninstall it as you wish |
| A "cracked", "keygen" or "free full version" download | A modified installer that can carry other programs | Uninstall, scan offline, change passwords |
| A pop-up, e-mail or call that says you need SpyHunter at once | A scare message that sends you to a download | Close it; do not call or download |
Our old guide said a cryptovirus pretended to be an Enigma product. We found no source naming such a program, so we do not repeat it as fact.
Do
- Download only from the vendor's own site, typing the address yourself.
- Right-click the installer, choose Properties and open Digital Signatures; an unsigned file with a security product's name is a warning sign.
- Compare the file name with
SpyHunter-Installer.exe, the name the vendor's uninstall page gives.
Don't
- Run a crack, keygen or patch for any security product.
- Download it from a torrent or file-sharing page.
How to uninstall SpyHunter
How to remove SpyHunter
Uninstall it, then remove what keeps it starting with Windows.
Nothing it flagged needs fixing.
Step 1: Uninstall SpyHunter
Open Settings > Apps > Installed apps in Windows 11, or Settings > Apps > Apps & features in Windows 10. Sort the list by install date and find SpyHunter, then choose Uninstall from the three-dot menu next to it (in Windows 10, click the entry and then Uninstall).
Remove anything else installed on the same day that you do not recognise, because such programs usually arrive together in one installer. If the uninstaller opens a browser page with an offer or a survey, close it: the program is removed either way.
Full procedure with screenshots: Uninstall a program or app in Windows On uGetFix
Step 2: Remove it from startup
Whatever SpyHunter installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items), and go through
%LocalAppData%,%AppData%, %ProgramData% and the two Program Files folders.Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold
.exe,.dll, .js or .ps1 files are the strongest sign.Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Uninstalling SpyHunter in detail
These steps follow the vendor's own uninstall page, read on 5 October 2026. Cancel the subscription first (see the cost section), because uninstalling does not cancel it.
- 1
Quit the program
Right-click the SpyHunter icon near the clock, choose Exit, then Yes, exit SpyHunter. If User Account Control asks for permission, click Yes; Windows needs it to stop SpyHunter's services.
- 2
Windows 11
Open Settings > Apps > Installed apps, search for SpyHunter, click the three dots and choose Uninstall, confirm, and answer Yes in SpyHunter's own uninstaller. Restart if it asks.
- 3
Windows 10
Open Settings > Apps > Apps & features, select SpyHunter, click Uninstall and answer Yes in its uninstaller.
- 4
Mac
Quit the app, open Finder > Applications, drag SpyHunter to the Bin and empty it. The vendor notes that small leftovers such as logs and settings may stay behind.
- 5
The browser extension
If you added SpyHunter Web Security, remove it too:
chrome://extensionsin Chrome,edge://extensionsin Edge,about:addonsin Firefox. - 6
Check what is left
Delete
SpyHunter-Installer.exeand any desktop shortcut, then check Startup apps in Task Manager for leftovers. The vendor says small log and settings files can stay on a Mac.
If the uninstaller will not start or SpyHunter comes back, something else may be reinstalling it: run the Microsoft Defender offline scan from the plan above.
After removal and prevention
Do
- Get security software from its maker's own site or an official store, and compare the web address letter by letter.
- Read the price, renewal and refund terms at checkout and note the renewal date.
- Choose Custom or Advanced setup in installers and untick extra offers.
- Read every item in a scan result before you remove it, and look up names you do not know.
- Keep a current backup (File History or OneDrive) so a bad cleanup or infection does not cost you your documents.
- On public Wi-Fi a VPN hides your IP address; it does not stop malware.
Don't
- Install a tool because a pop-up, call or e-mail says you are infected.
- Pay for a tool before you know what the problem is.
- Run two real-time scanners together.
Questions about SpyHunter
Is SpyHunter a virus?
No. SpyHunter is a commercial anti-malware program made by Enigma Software, and the vendor's pages, domains and the court record we read gave us no reason to treat the genuine program as malware.
The word "virus" sticks to it because a rival security vendor labelled it "potentially unwanted", because of past affiliate advertising, and because some people paid for it and found their problem still there.
A copy from anywhere but the vendor, especially a crack, is different and can be an infection. We did not install the program, so this describes its records, not a test.
Is SpyHunter safe to use?
The genuine program from the vendor's site is a real, long-sold product, but that does not make it right for you. The trial needs a payment card, the subscription renews every six months at the standard price, and a refund must be requested within 30 days of the charge.
Rival vendors dispute its classification, and the dispute has been in court since 2017. We did not test its detection or removal, so we cannot rate how well it works. Microsoft Defender's full and offline scans are built into Windows and cost nothing.
Why does my antivirus say SpyHunter is a threat?
Your antivirus may use a label such as "potentially unwanted program", which is a judgment about behaviour and marketing, not proof of malware. Malwarebytes used such a label and Enigma sued; in 2023 a federal appeals court held that "malicious" and "threat" can be judged as statements of fact, while "potentially unwanted" is too vague to sue over.
If the flagged file did not come from the vendor's own site, believe the warning: it may be a cracked copy. If it did, the decision to keep it is yours.
How do I uninstall SpyHunter?
Quit it from the notification area (right-click its icon, then Exit), then remove it in Settings. In Windows 11 open Settings > Apps > Installed apps, click the three dots next to SpyHunter and choose Uninstall. In Windows 10 use Settings > Apps > Apps & features.
On a Mac, drag it from Applications to the Bin. Remove the SpyHunter Web Security extension separately from your browser. Uninstalling does not cancel the subscription, so cancel that in your account on the vendor's site or you may still be charged.
How do I cancel SpyHunter and get a refund?
Go to enigmasoftware.com, click Login, open Order/Licenses and use the cancel button next to each order; with several orders, cancel each one. Cancelling during the 7-day trial ends access at once, while a paid plan keeps working until the period ends.
The vendor's terms promise a full refund if you cancel and ask within 30 days of the purchase. If the vendor does not respond, contact your card issuer, say it is a recurring charge you cancelled, and keep the cancellation confirmation and the dates.
How much does SpyHunter cost?
On 5 October 2026 the vendor's page said pricing typically starts at $49.98 every six months for SpyHunter Basic on Windows and $79.98 every six months for SpyHunter Pro on Windows and for SpyHunter for Mac, varying by country and promotion. A discounted first term returns to the standard price at renewal.
Our 2019 report showed about 34.99 euros every six months and our old guide said 30 to 40 dollars, so the cost has risen. The trial is free for 7 days but asks for a card, and the plan renews unless you cancel.
Is "spyware hunter", "spyware 5" or "SpyHunter 5" the same thing?
Mostly yes. People type the name in many ways; SpyHunter 5 is the Windows version the vendor's pages describe, SpyHunter 4 and 3 are older, and SpyHunter for Mac is a separate build. RegHunter is a different Enigma product that cleans the registry.
"Spy Hunter" is also a car-combat video game series, so some results have nothing to do with security software. If a page that offers a "spyware hunter" download is not on the vendor's own domain, treat it as unverified and do not run the file.
Can SpyHunter remove ransomware or the FBI lock-screen virus?
We have not tested that, so we cannot promise it. The vendor says paid subscribers can detect and remove malware and ask its support desk for a custom fix.
Readers who wrote to us in 2012 and 2013 said SpyHunter did not detect an FBI lock-screen virus and could not run on a PC without internet; those reports concern old versions. Ransomware that encrypts files is bigger:
- removing the program does not bring the files back
- so read our ransomware guides
- No More Ransom (nomoreransom.org) before paying anyone
Is there a fake SpyHunter or a cracked version?
Cracked versions exist wherever people look for free copies of paid software, and they are a common way for other programs to reach a PC. Our old guide also said a cryptovirus used the product's name; we found no source that confirms a specific program, so treat that as unconfirmed. The safe rule:
- download only from the vendor's own site
- never run a crack or keygen
- check the installer's digital signature in Properties
If you ran a cracked copy, uninstall it, run a Microsoft Defender offline scan and change the passwords you used since.
Will Fortect remove SpyHunter?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For SpyHunter, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Enigma Software: How to cancel your SpyHunter 5 subscription or auto-renewal (trial terms, pricing, refund) (read October 5, 2026)
- EnigmaSoft: Uninstall steps for SpyHunter and RegHunter (read October 5, 2026)
- BleepingComputer: Press release on the settlement with Enigma Software Group, 1 March 2017 (read October 5, 2026)
- Techdirt: Enigma Software countersued for waging a smear campaign (BleepingComputer's counterclaim) (read October 5, 2026)
- The Register: Malwarebytes may not be allowed to label rival's app as potentially unwanted (2023) (read October 5, 2026)
- US Court of Appeals, Ninth Circuit: Enigma Software Group USA v. Malwarebytes, No. 21-16466 (2 June 2023) (read October 5, 2026)
- Findlaw: Enigma Software Group USA v. Malwarebytes (9th Cir. 2019) (read October 5, 2026)
- SCOTUSblog: Malwarebytes v. Enigma Software Group, certiorari denied 13 October 2020 (read October 5, 2026)
- Harvard Law Review: Enigma Software Group USA v. Malwarebytes (case summary) (read October 5, 2026)
- Vital Law: N.D. Cal. on remand, three remaining claims survive dismissal (2024) (read October 5, 2026)
- Verisign RDAP: spyhunter.com registration record (read October 5, 2026)
- Verisign RDAP: enigmasoftware.com registration record (read October 5, 2026)
- Microsoft Learn: Microsoft Defender Antivirus compatibility with other security products (read October 5, 2026)
- Wikipedia: SpyHunter (video game series) (read October 5, 2026)