post #1
01 October 2005, 02:42 UTC#1
Spyware/Virus Removal Guide
Have a virus on your computer that you just can't get rid of? Perhaps popups aren't leaving you alone? Well then you've come to the right place.
Introduction
While most people know what a computer Virus or Trojan are, I wanted to start by giving a good definition of what Spyware is and some symptoms of an infection.
What is Spyware?
Spyware, also know as Adware, is basically software that is installed on your computer without your knowledge, and gathers information about you and your PC, sending it back to base for either Advertising/Marketing or selling to other companies.
How does it get on my computer?
Ways that spyware find its way on to your PC include through Warez, and Porn sites that can actually download the software without you even knowing. P2P software is also a main contender for carrying spyware, and is often installed as part of the program. Some websites may trick you into downloading a piece of software that they claim is required for the website to run properly, once you download/install it then that’s when ‘real’ problems can start.
Even software that you think is safe to download and use (Download Accelerator, for example) are actually considered spyware because they can check the websites that you have visited and then send back ads that are in relation to those websites. Other software such as Porn Dialers and Premium Rate Dialers are also a big problem.
What can Spyware do?
Once on your PC, its purpose is to gather information about you the user and your PC. Data like Personal details, Passwords, and Credit Card information can be stolen and sent to someone else via your internet connection, again without you knowing. Keyloggers are a form of spyware that can be installed on your PC and that can be used to trace and log all data that you type. Your PC and your web browser can also be hijacked, meaning that your browser's homepage could be taken over by certain unwanted websites.
How do I know I have spyware?
The symptoms are similar to those from a virus:
* Your PC may be slower, with higher CPU usage than usual.
* Unexpected icons and shortcuts may appear on your desktop, and extra bookmarks in your Favorites.
* Your Web browser may have a search/tool bar that you’ve never seen before and a new home page.
* Popup ads may appear even when a browser is not open.
These are all classic symptoms that you have been hijacked and are being spied on
What can I do about it?
This thread will show you how to eliminate 99% of Spyware-related problems.
Introduction taken from SysOpt
For more information on Adware/Spyware, check out this link
Cleaning Guide
Before we begin, there are some programs you need:
*Note* I know that many will have their own opinions on what programs are the best to use to effectively clean a computer, but over the years, these are the ones I've come to use and trust. Plus, all of these programs are completely free. However, feel free to donate to these respective projects to help their developers continue to update these great programs
AVG Antivirus
Ad-Aware SE
Spybot Search & Destroy
SpywareBlaster
Microsoft Anti-Spyware
HijackThis
A-Squared
Download and install all of these programs, and use their respective update features to make sure they are fully updated. Another side note: I'll be assuming you are running Windows XP. This guide is tailored for XP users, but many things in it can be applied to other Microsoft OSs
Once all these programs are updated, its time to restart in safe mode and begin scanning. However, first we need to disable system restore. Malware can reside in the system restore directory, which is inaccessable to scanning software. Here's how to do that:
Next, we have to get into safe mode:
When you get to the boot.ini tab, put a checkmark in
This will force the computer to restart in safe mode.
Now that you are in safe mode, its time to start cleaning out your files.
Start with this:
When the folder pops up, delete everything in it, and empty out the Recycle bin.
Also, clear out everything in your Temporary Internet Files folder by navigating to this directory:
Note: you will need to have "show hidden files and folders" enabled to see this directory
*Important Note* If you are cleaning a computer which has multiple user accounts, you will need to do this for every user account.
Again, delete everything in this directory. Next we will clear out the Prefetch folder. This folder contains a listing of various Programs that start up with Windows, but it can get cluttered after a long time. If we delete everything in the folder, it will auto-generate only the files that are needed.
To empty this folder, go to:
Hit 'Enter' and delete everything in this folder.
Now that we have cleared out some, our scanning times should be reduced.
Next, we will remove any unnecessary programs
Start by going into the Control Panel -> "Add/Remove Programs", and delete anything which looks suspicious. Use your common sense and judgement here. If you get any sort of errors saying that a certain program cannot be uninstalled due to the fact that you are in Safe Mode, write down the name of that program so that you can uninstall it once you return to normal Windows.
Scanning with AVG
We will be doing a full system scan with AVG Antivirus and deleting any files which it reports as infected.
Since we are in Safe Mode, AVG will not have loaded automatically. Therefore, we will have to start it manually by opening it in the Start Menu.
Click on the "Test Center" button to set up the scan:
Click on the large "Scan Computer" button to do a complete system scan.
Scanning with Ad-Aware SE
Now, we will run a scan with Ad-Aware SE.
We will want to do a full system scan. Click the "Start" button and under "Select a scan mode", select "Perform full system scan". We will do this instead of running the "smart system scan". This way every nook and cranny will be covered. Once again, remove anything that is found.
A bit of an Ad-Aware tip: When you finish scanning and are taken to the removal page, you can right-click in order to select all instances of spyware. This is good for saving time if you have a large number of critical problems listed:
Scanning with Spybot Search & Destroy
We will now essentially repeat the same process with Spybot Search & Destroy. Spybot and Ad-Aware seem to compliment each other; one program tends to find things the other will not.
Click the "Check for problems" button and allow Spybot to begin scanning. Again, remove anything that Spybot flags.
Scanning with Microsoft Anti-Spyware
Once again, we will repeat the same similarprocess with the Microsoft Anti-Spyware program.
Click the small "Scan options" button and have the program perform a full system scan instead of the "intelligent quick scan".
Again, remove anything that the program flags.
Scanning with A-Squared
A-Squared is a great program that helps bridge the gap between Antivirus programs and Antispyware programs. It attempts to remove Trojans, Dialers, and other malware that neither Antivirus programs or Antispyware programs are adept at removing.
Note: You will need to create a free account in order to use A-Squared Free, but this is relatively easy to do.
Click the "Scan your computer for Malware infections" button, and you will see a screen similar to this:
A-Squared Scan Menu
Be sure that all your hard drive partitions are in the list of "folders to be scanned". This way, every 1 and 0 on your hard drive will be analyzed. Also, make sure that all the checkboxes under "Settings" are checked. Once you do this, select "Scan selected folders" to begin scanning with A-Squared.
If these programs have been updated as suggested and ran as directed, this scanning should have taken care of 99% of your Spyware problems
Additional Cleanup
Now, it is time to do some additional cleaning, but for some of the following steps we will need an internet connection, which is unavailable in Safe Mode.
Uncheck the /SAFEBOOT on the boot.ini tab of msconfig, and restart the computer.
Running CWShredder
When in Normal Windows, run the CWShredder .exe file. CWShredder is a specialized program for removing variants of Cool Web Search, a relatively difficult adware variant to get rid of.
Click the "Fix" button, and let CWShredder run its' scan.
Running HijackThis
Now, run the HijackThis .exe file. Click on the "Do a system scan and save a logfile" button.
HijackThis is a very powerful tool, but as you can see, it is not that user friendly. Unlike the other programs listed in this guide, HijackThis does not discriminate between harmful and helpful software. It is up to the user to make this differentiation, which is why you must proceed with caution. However, there is a website which can analyze your HijackThis log and help you greatly.
Visit http://hijackthis.de/. Paste a copy of your HijackThis logfile here, and click the "Analyze" button.
If you see any entries labeled "Unnecessary" or "Nasty", put a checkmark next to their entries, and have HijackThis fix those problems.
Running Spybot Immunize
Now we will enable the Immunize feature Spybot Search & Destroy. This is a great tool for helping prevent spyware and malware from getting on your computer in the first place. Open Spybot and enter the "Advanced" mode. Click on "Immunize" and run the Immunize feature.
In addition, you can put a check mark in "Enable permanent blocking of bad addresses in Internet Explorer". Even if you use an alternative browser such as FireFox or Opera, IE is embedded within Windows and many other programs (such as Steam), so there are still ways that malware can take advantage of IE holes.
Running SpywareBlaster
If you noticed in the last screenshot, Spybot itself makes the suggestion that since we have SpywareBlaster installed, we should run it to have 'much more control on ActiveX protection'. So lets run Spywareblaster now.
Since we've already updated the program and downloaded its' latest definition files, all we need to do is click "Enable All Protection".
In addition to this feature, if you click on the "Tools" button, you will see that there are many more options you can try out, including HOSTS file encryption, and a Flash blocker
Understanding Microsoft Anti-Spyware's Real-Time Agent
First, make sure that the Microsoft Anti-Spyware real-time protection is enabled and actively running. You will know that it is if you see the small red and yellow circle in your system tray. Whenever a significant change is made to your system settings, registry, or Internet configuration, this program will have a message pop up and alert you.
There are three different color messages, green, yellow, and red. The general rule of thumb is that the green messages are not cause for concern, the yellow ones are messages that you should look at carefully and see what the program is telling you is happening on your system, and the red messages are critical warnings that require immediate action.
*Important Note* Another very important piece of information is that if there are multiple user accounts on the computer you are cleaning, you may have to run these applications on each user account. With Windows XP, multiple user accounts are essentially multiple computers: they are quite seperated from each other, and just because one account is clean doesn't mean the other are. At the very least, log in on each account and see if Microsoft AntiSpyware alerts you to any infections.
Final Steps
One of the last, and possibly most important steps, is to change your Internet browser. If you are running IE, you are asking for problems. Since the majority of PC users run Internet Explorer, the majority of malware is tailor-fit for it. This is the same reason I recommend using AVG antivirus instead of Norton or McAfee. AVG is just as effective as the professional software, and costs a lot less (free). In addition, many viruses are specifically programmed to disable Norton and McAfee due to their widespread use.
Consider using Mozilla Firefox
Firefox Download Link
Or Opera
Opera Download Link
You should also download ShootTheMessanger, a small .exefile that will disable the built-in Windows Messenger service, thus preventing SPAM-ads from reaching your system. You only need to run this file once to permanently disable Windows Messenger Service.
It should be noted that if you follow this guide to the letter, some programs that you might have installed (such as Kazaa) will no longer work. If you have any program installed that needs certain adware installed to run, this will be the case. However, you shouldn't have any software like that installed in the first place, so this will be all the more reason to uninstall it.
Common Adware/Spyware-Laden Software
The following programs can usually be found on the majority of PC users' computers, and should probably never be.
WeatherBug
WeatherBug is an software program powered by AWS WeatherNet that provides weather updates (for American cities) from a small icon in the systray. WeatherBug gives you current weather conditions, your local weather report, and storm alerts, however the free version is ad-supported containing both banner and pop-up ads. In some cases, it installs the My Search toolbar.
For WeatherBug removal instructions, click Here.
Be sure to follow the "Extra removal instructions for Windows XP" users.
For an alternative to WeatherBug, Firefox users should check out ForecastFox. This is a simple, small plugin which will display the weather conditions in your local area in the lower corner of a FireFox browser. It is very small, light plugin, and of course, spyware/adware free.
AOL Instant Messenger
AIM is a popular Instant Messaging client, and unfortunately, it is bundled with spyware/adware. Different version of AIM have been bundled with WildTangent, WeatherBug, AOL on Desktop, and Viewpoint Media Player. Obviously, you do not need all of these for a simple Instant Messaging client. Fortunately, there are ways to get around this.
Aim Ad Hack is an effective program that will strip these non-useful and possibly malicious programs from AIM. You will need the latest version of AIM to use the latest version of this program.
The free version of Trillian will allow you to connect to the AIM network, as well as Yahoo!, MSN, and many more. It is ad-free.
So that's it. By now your computer should be Virus and Spyware free. You can re-enable System Restore now, and all should be just fine. I realize that this guide is very new and probably doesn't cover everything, but I will be making additions to it and changing things as newer and better technologies become available. And please, if you would like to leave a comment, leave something constructive, not "I don't use an antivirus program because I'm cool" or "OMG SPYBOT SUCKS USE ADAWARE!". And of course, if you have any questions or problems, you can PM me, or make a thread in the HLF Hardware & Software Forum. Happy Computing!
NOTE: This was all taken from here.It took me like an hour to copy it all here, cause of formatting and editing. Maby this will stop all of the "Help my pc is messed up!" threads.
Have a virus on your computer that you just can't get rid of? Perhaps popups aren't leaving you alone? Well then you've come to the right place.
Introduction
While most people know what a computer Virus or Trojan are, I wanted to start by giving a good definition of what Spyware is and some symptoms of an infection.
What is Spyware?
Spyware, also know as Adware, is basically software that is installed on your computer without your knowledge, and gathers information about you and your PC, sending it back to base for either Advertising/Marketing or selling to other companies.
How does it get on my computer?
Ways that spyware find its way on to your PC include through Warez, and Porn sites that can actually download the software without you even knowing. P2P software is also a main contender for carrying spyware, and is often installed as part of the program. Some websites may trick you into downloading a piece of software that they claim is required for the website to run properly, once you download/install it then that’s when ‘real’ problems can start.
Even software that you think is safe to download and use (Download Accelerator, for example) are actually considered spyware because they can check the websites that you have visited and then send back ads that are in relation to those websites. Other software such as Porn Dialers and Premium Rate Dialers are also a big problem.
What can Spyware do?
Once on your PC, its purpose is to gather information about you the user and your PC. Data like Personal details, Passwords, and Credit Card information can be stolen and sent to someone else via your internet connection, again without you knowing. Keyloggers are a form of spyware that can be installed on your PC and that can be used to trace and log all data that you type. Your PC and your web browser can also be hijacked, meaning that your browser's homepage could be taken over by certain unwanted websites.
How do I know I have spyware?
The symptoms are similar to those from a virus:
* Your PC may be slower, with higher CPU usage than usual.
* Unexpected icons and shortcuts may appear on your desktop, and extra bookmarks in your Favorites.
* Your Web browser may have a search/tool bar that you’ve never seen before and a new home page.
* Popup ads may appear even when a browser is not open.
These are all classic symptoms that you have been hijacked and are being spied on
What can I do about it?
This thread will show you how to eliminate 99% of Spyware-related problems.
Introduction taken from SysOpt
For more information on Adware/Spyware, check out this link
Cleaning Guide
Before we begin, there are some programs you need:
*Note* I know that many will have their own opinions on what programs are the best to use to effectively clean a computer, but over the years, these are the ones I've come to use and trust. Plus, all of these programs are completely free. However, feel free to donate to these respective projects to help their developers continue to update these great programs
AVG Antivirus
Ad-Aware SE
Spybot Search & Destroy
SpywareBlaster
Microsoft Anti-Spyware
HijackThis
A-Squared
Download and install all of these programs, and use their respective update features to make sure they are fully updated. Another side note: I'll be assuming you are running Windows XP. This guide is tailored for XP users, but many things in it can be applied to other Microsoft OSs
Once all these programs are updated, its time to restart in safe mode and begin scanning. However, first we need to disable system restore. Malware can reside in the system restore directory, which is inaccessable to scanning software. Here's how to do that:
QUOTE
Right-click on My Computer -> Properties" -> System Restore -> "Turn off System Restore"
Next, we have to get into safe mode:
QUOTE
Start -> Run -> msconfig -> boot.ini
When you get to the boot.ini tab, put a checkmark in
QUOTE
/SAFEBOOT
This will force the computer to restart in safe mode.
Now that you are in safe mode, its time to start cleaning out your files.
Start with this:
QUOTE
Start -> run -> %temp%
When the folder pops up, delete everything in it, and empty out the Recycle bin.
Also, clear out everything in your Temporary Internet Files folder by navigating to this directory:
QUOTE
X:\Documents and Settings\username\Local Settings\Temporary Internet Files
Note: you will need to have "show hidden files and folders" enabled to see this directory
*Important Note* If you are cleaning a computer which has multiple user accounts, you will need to do this for every user account.
Again, delete everything in this directory. Next we will clear out the Prefetch folder. This folder contains a listing of various Programs that start up with Windows, but it can get cluttered after a long time. If we delete everything in the folder, it will auto-generate only the files that are needed.
To empty this folder, go to:
QUOTE
Start -> Run -> 'C:\WINDOWS\Prefetch'
Hit 'Enter' and delete everything in this folder.
Now that we have cleared out some, our scanning times should be reduced.
Next, we will remove any unnecessary programs
Start by going into the Control Panel -> "Add/Remove Programs", and delete anything which looks suspicious. Use your common sense and judgement here. If you get any sort of errors saying that a certain program cannot be uninstalled due to the fact that you are in Safe Mode, write down the name of that program so that you can uninstall it once you return to normal Windows.
Scanning with AVG
We will be doing a full system scan with AVG Antivirus and deleting any files which it reports as infected.
Since we are in Safe Mode, AVG will not have loaded automatically. Therefore, we will have to start it manually by opening it in the Start Menu.
Click on the "Test Center" button to set up the scan:
Click on the large "Scan Computer" button to do a complete system scan.
Scanning with Ad-Aware SE
Now, we will run a scan with Ad-Aware SE.
We will want to do a full system scan. Click the "Start" button and under "Select a scan mode", select "Perform full system scan". We will do this instead of running the "smart system scan". This way every nook and cranny will be covered. Once again, remove anything that is found.
A bit of an Ad-Aware tip: When you finish scanning and are taken to the removal page, you can right-click in order to select all instances of spyware. This is good for saving time if you have a large number of critical problems listed:
Scanning with Spybot Search & Destroy
We will now essentially repeat the same process with Spybot Search & Destroy. Spybot and Ad-Aware seem to compliment each other; one program tends to find things the other will not.
Click the "Check for problems" button and allow Spybot to begin scanning. Again, remove anything that Spybot flags.
Scanning with Microsoft Anti-Spyware
Once again, we will repeat the same similarprocess with the Microsoft Anti-Spyware program.
Click the small "Scan options" button and have the program perform a full system scan instead of the "intelligent quick scan".
Again, remove anything that the program flags.
Scanning with A-Squared
A-Squared is a great program that helps bridge the gap between Antivirus programs and Antispyware programs. It attempts to remove Trojans, Dialers, and other malware that neither Antivirus programs or Antispyware programs are adept at removing.
Note: You will need to create a free account in order to use A-Squared Free, but this is relatively easy to do.
Click the "Scan your computer for Malware infections" button, and you will see a screen similar to this:
A-Squared Scan Menu
Be sure that all your hard drive partitions are in the list of "folders to be scanned". This way, every 1 and 0 on your hard drive will be analyzed. Also, make sure that all the checkboxes under "Settings" are checked. Once you do this, select "Scan selected folders" to begin scanning with A-Squared.
If these programs have been updated as suggested and ran as directed, this scanning should have taken care of 99% of your Spyware problems
Additional Cleanup
Now, it is time to do some additional cleaning, but for some of the following steps we will need an internet connection, which is unavailable in Safe Mode.
Uncheck the /SAFEBOOT on the boot.ini tab of msconfig, and restart the computer.
Running CWShredder
When in Normal Windows, run the CWShredder .exe file. CWShredder is a specialized program for removing variants of Cool Web Search, a relatively difficult adware variant to get rid of.
Click the "Fix" button, and let CWShredder run its' scan.
Running HijackThis
Now, run the HijackThis .exe file. Click on the "Do a system scan and save a logfile" button.
HijackThis is a very powerful tool, but as you can see, it is not that user friendly. Unlike the other programs listed in this guide, HijackThis does not discriminate between harmful and helpful software. It is up to the user to make this differentiation, which is why you must proceed with caution. However, there is a website which can analyze your HijackThis log and help you greatly.
Visit http://hijackthis.de/. Paste a copy of your HijackThis logfile here, and click the "Analyze" button.
If you see any entries labeled "Unnecessary" or "Nasty", put a checkmark next to their entries, and have HijackThis fix those problems.
Running Spybot Immunize
Now we will enable the Immunize feature Spybot Search & Destroy. This is a great tool for helping prevent spyware and malware from getting on your computer in the first place. Open Spybot and enter the "Advanced" mode. Click on "Immunize" and run the Immunize feature.
In addition, you can put a check mark in "Enable permanent blocking of bad addresses in Internet Explorer". Even if you use an alternative browser such as FireFox or Opera, IE is embedded within Windows and many other programs (such as Steam), so there are still ways that malware can take advantage of IE holes.
Running SpywareBlaster
If you noticed in the last screenshot, Spybot itself makes the suggestion that since we have SpywareBlaster installed, we should run it to have 'much more control on ActiveX protection'. So lets run Spywareblaster now.
Since we've already updated the program and downloaded its' latest definition files, all we need to do is click "Enable All Protection".
In addition to this feature, if you click on the "Tools" button, you will see that there are many more options you can try out, including HOSTS file encryption, and a Flash blocker
Understanding Microsoft Anti-Spyware's Real-Time Agent
First, make sure that the Microsoft Anti-Spyware real-time protection is enabled and actively running. You will know that it is if you see the small red and yellow circle in your system tray. Whenever a significant change is made to your system settings, registry, or Internet configuration, this program will have a message pop up and alert you.
There are three different color messages, green, yellow, and red. The general rule of thumb is that the green messages are not cause for concern, the yellow ones are messages that you should look at carefully and see what the program is telling you is happening on your system, and the red messages are critical warnings that require immediate action.
*Important Note* Another very important piece of information is that if there are multiple user accounts on the computer you are cleaning, you may have to run these applications on each user account. With Windows XP, multiple user accounts are essentially multiple computers: they are quite seperated from each other, and just because one account is clean doesn't mean the other are. At the very least, log in on each account and see if Microsoft AntiSpyware alerts you to any infections.
Final Steps
One of the last, and possibly most important steps, is to change your Internet browser. If you are running IE, you are asking for problems. Since the majority of PC users run Internet Explorer, the majority of malware is tailor-fit for it. This is the same reason I recommend using AVG antivirus instead of Norton or McAfee. AVG is just as effective as the professional software, and costs a lot less (free). In addition, many viruses are specifically programmed to disable Norton and McAfee due to their widespread use.
Consider using Mozilla Firefox
Firefox Download Link
Or Opera
Opera Download Link
You should also download ShootTheMessanger, a small .exefile that will disable the built-in Windows Messenger service, thus preventing SPAM-ads from reaching your system. You only need to run this file once to permanently disable Windows Messenger Service.
It should be noted that if you follow this guide to the letter, some programs that you might have installed (such as Kazaa) will no longer work. If you have any program installed that needs certain adware installed to run, this will be the case. However, you shouldn't have any software like that installed in the first place, so this will be all the more reason to uninstall it.
Common Adware/Spyware-Laden Software
The following programs can usually be found on the majority of PC users' computers, and should probably never be.
WeatherBug
WeatherBug is an software program powered by AWS WeatherNet that provides weather updates (for American cities) from a small icon in the systray. WeatherBug gives you current weather conditions, your local weather report, and storm alerts, however the free version is ad-supported containing both banner and pop-up ads. In some cases, it installs the My Search toolbar.
For WeatherBug removal instructions, click Here.
Be sure to follow the "Extra removal instructions for Windows XP" users.
For an alternative to WeatherBug, Firefox users should check out ForecastFox. This is a simple, small plugin which will display the weather conditions in your local area in the lower corner of a FireFox browser. It is very small, light plugin, and of course, spyware/adware free.
AOL Instant Messenger
AIM is a popular Instant Messaging client, and unfortunately, it is bundled with spyware/adware. Different version of AIM have been bundled with WildTangent, WeatherBug, AOL on Desktop, and Viewpoint Media Player. Obviously, you do not need all of these for a simple Instant Messaging client. Fortunately, there are ways to get around this.
Aim Ad Hack is an effective program that will strip these non-useful and possibly malicious programs from AIM. You will need the latest version of AIM to use the latest version of this program.
The free version of Trillian will allow you to connect to the AIM network, as well as Yahoo!, MSN, and many more. It is ad-free.
So that's it. By now your computer should be Virus and Spyware free. You can re-enable System Restore now, and all should be just fine. I realize that this guide is very new and probably doesn't cover everything, but I will be making additions to it and changing things as newer and better technologies become available. And please, if you would like to leave a comment, leave something constructive, not "I don't use an antivirus program because I'm cool" or "OMG SPYBOT SUCKS USE ADAWARE!". And of course, if you have any questions or problems, you can PM me, or make a thread in the HLF Hardware & Software Forum. Happy Computing!
NOTE: This was all taken from here.It took me like an hour to copy it all here, cause of formatting and editing. Maby this will stop all of the "Help my pc is messed up!" threads.