Spy/Ad/Mal ware Removal & Prevention
Step One:
Take Maul Smash Case! |
 |
|
Just Kidding, we will get that 'puter of yours back from the spy/mal ware scum buckets.
Relax, smile, sit back and follow the steps outlined below!
Email me here if you have any questions.
|
 |
|
First let me define a few items.
Spyware - Spyware is a catchall phrase that includes many different types of software exploits.
Which include:
Adware- advertisements that display in applications (Opera, DAP, etc.) These applications can retrieve personal information about your internet browsing habits. You can & will be targeted with specific popup and other types of advertising. Beyond annoying, they violate our privacy with adware!
Malware- Malware invades your computer taking over normal operating system functions. This is the most serious of the so called spyware applications. Your computer is no longer yours. The scum buckets who write this stuff own it and use it at their will. Many actually integrate with the operating system of your computer making them difficult to remove.
Browser Hijacking - Spyware installed via security holes in various web browsers. They can take over your default startup home page or your web searching ability.
A note on P2P Clients- Limewire, Kaaza and other applications have been know to secretly install spyware such as Gator which can steal things as our credit card number, user names and passwords. Mom, dads, buy your kids some cds and do not allow them to use P2P applications. It is not worth the trouble. Almost every time I go to a friend of a friend's home to fix their "SLOW" computer, their kids have used music stealing 'er swapping programs. Their computers are "SLOW" because they have hundreds of spyware installs. (Once I was at a home working on a system and removed over 1000 spyware items from a computer.) Many of the files that are downloaded are PORN & loaded with virus', trojans and malware. I guaranteeit -you use a file sharing program and your computer will become infected - GUARANTEE!
-= We Start =-
I personally use Maxthon & Firefox for browsing the internet. Use one or both of these, follow the steps below, we can successfully remove these pests from our computer and prevent the installation of spy/ad/malware on our systems in the first place.
Step One:
Go to Startup -> Control Panel-> Add or Remove Programs
Review the list of installed applications on your computer. Remove any programs you obviously see are not programs you installed. If in doubt about a program, do not remove it. The next steps will determine if the programs are spy or malware.
TIP: A excellent and freeware program that is much more powerful than Windows built in Add or Remove applet is MyUninstaller by Nir Sofer of NirSoft. Along with displaying the list of all installed applications, it allows you to uninstall
an application or simply delete an uninstall entry that is obsolete. You can also save the list of all installed
applications into a text file or HTML file.
Additional information is shown for most installed applications that the standard Add/Remove applet does not display: product name, company, version, uninstall string, installation folder and more.
This application is highly recommended. Most uninstallers still leave behind files on your computer so we need this program to remove all of the files from your computer.
My steps for removing a program from your computer.
A. Run MyUninstaller.
B. Take note of the installation folder this program reveals to you. Jot it down on a peace of paper.
C. Highlight the item to be deleted and click on the "Uninstall Selected Software" (the garbage can icon) button, or press control + u. Note: Do not click on the "delete selected entry" (the red x icon) button, this only removes the entry in the Add / remove listing, it does not uninstall the program.
D. After removing the program use Windows Explorer and locate the installation folder you jotted down above and manually remove the directory. Many programs leave behind files on your computer wasting hard drive space.
Better yet, download and install Total Commander (Norton Commander style file viewer - read about this powerful shareware ($32.US) tool on our Software We Use Page) to view files on your computer for easier removal. Total Commander is the most used program on my computer. I highly recommend you download it and give it a try.
E. Another problem with many programs is that they do not remove all their entries from your windows registry. Hey software authors, this is my computer, when I want to remove your software from it I expect your program to completely erase itself!! Arg!
UPDATE: 22 Oct 08 - I now use CCleaner to clean my registry, not Regseeker as described next (you can still trust RegSeeker for Windows XP) - get CCleaner here. Run the installer and uncheck the option to install Yahoo toolbar (unless you want Yahoo toolbar).
RegSeeeker & CCleaner are excellent programs (and reliable - I checked out dozens of registry cleaners and found these to be the best for me - I have not had one problem with these programs and have used them hundreds of times to clean my registry. Go to the Software We Use Page to read more about RegSeeker. Download it here: -Direct Download link-
Install RegSeeker
Click on the Clean the Registry button as shown above.
Click on the "Scan Drives for old exe entries in Registry" box. Make sure the other boxes are checked as shown above.
Make sure the "Backup before deletion" box is checked. This way if you have any problems, you can reinstall any registry entry you delete. (I have had zero problems so far!)
Click on the okay button to start the scan and let RegSeeker do it's work.
When the scan of your registry if finished click on the Select all Button.
Right click on any selected item in the list of bad entries RegSeeker finds and select "Delete selected items.
It is that simple to keep your Windows registry clean, and thus more efficient.
Now onto using some powerful & reliable freeware spy/ad/mal ware removal tools:
Step Two - Download & Install:
UPDATE 22 OCT 08 - I no longer use Ad-aware I now use Malwarebytes' Anti-Malware, see number 5 below. This program is a must for some nasty malware out there. Some will not even let Spy Bot S & D run! I now use this program first on a computer given to me to clean.
1. Ad-AwareSE Personal Addition - Ad-aware is THE award winning, free, multi component spyware detection and removal utility that consistently leads the industry in safety, user satisfaction, support and reliability. -Support Forum-
Download the program, install it, update the reference files and run it.
2. Spybot Search & Destroy - Spybot Search & Destroy can detect and remove spyware, malware, hijackers of different kinds from your computer. Spybot-S&D can also clean usage tracks, an interesting function if you share your computer with other users and do not want them to see what you worked on. There is a Support Forum (click here) you can go to to ask questions about this program.
Download the program, install it, update the reference files and run it.
3. SpywareBlaster - Spyware, adware, browser hijackers, and dialers are some of the fastest-growing threats on the Internet today.
By simply browsing to a web page, you could find your computer to be the brand-new host of one of these unwanted fiends!
The most important step you can take is to secure your system. And SpywareBlaster is the most powerful protection program available.
- Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests.
- Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.
- Restrict the actions of potentially dangerous sites in Internet Explorer.
SpywareBlaster can help keep your system spyware-free and secure, without interfering with the "good side" of the web. And unlike other programs, SpywareBlaster does not have to remain running in the background. SpywareBlaster is freeware for personal and educational use. -Support Forum-
Download the program, install it, update the reference files and run it.
UPDATE 22 OCT 08 - Some other safe to use Programs:
4. Malwarebytes' Anti-Malware - Malwarebytes' Anti-Malware is considered to be the next step in the detection and removal of malware. We compiled a number of new technologies that are designed to quickly detect, destroy, and prevent malware. Malwarebytes' Anti-Malware can detect and remove malware that even the most well-known Anti-Virus and Anti-Malware applications on the market today cannot.
5. WinPatrol 2008 - WinPatrol is an all-purpose utility designed to increase the performance and usability of your computer. It's FREE and has been assisting computer users for over ten years.
6. RogueRemover FREE - is an application that can remove rogue anti spyware, antivirus, and hard drive cleaning applications with ease. Rogue applications provide false information about the safety of your computer as well as, give erroneous scan results or put their own malware on your computer. It has the ability to completely remove WinAntiSpyware/WinAntiVirus, SpyAxe, VirusBlast, VirusBursters, as well as a number of other rogue applications. In addition, we have implemented a threats center which will allow you to keep up to date with the latest rogue threats.
Some advanced tools to use:
ComboFix: How to use ComboFix - Some more tips - Some warnings on using it -
FileASSASSIN - is an application that can delete any type of locked files that are on your computer. Whether the files are from a malware infection or just a particular file that will not delete - FileASSASSIN can remove it.
Step Three Preventive Maintenance:
Make sure you run Spybot Search & Destroy and Ad-Aware often. I run them at least once a week. Also be sure to update the reference files each time you use the programs. Spyware blaster needs to be updated often also. I do it every other week or so.
IMPORTANT - Keep your Operating System up to date. Make sure you have Windows Update setup to automatically notify you if there are any new security updates released by Microsoft. Make sure you do download and install these updates. Microsoft (although slowly) does fix security holes in its software. It is important to install these updates to prevent spyware. If you have not installed Windows XP Service Pack 2, you are asking for trouble. Install it. I have on over 16 systems now with zero problems.
Step Four - WARNING:
Beware of any other Spyware removal/prevention tools that are not on this list. The ad/spy/malware scum buckets are devious. They are now using alledged removal tools to install their unwanted (I believe should be illegal) programs on our computers. Here is a listing of such software. Also here at Malwarebytes Security Forums are some of the newest and on their BLOG - THE BLOG IS A GREAT TOOL! See also Bharath's Security Blog for up todate rogue applications. Bleeping Computer's How To Remove List.
Stick with the above mentioned tools in my steps above to be safe. They work great. If you know of any other free/donation-ware programs that work well let me know about them via our Contact Us Page. Remember our criteria for a great program, small in size, no install files, no registry entries, and no files into our windows directory. We do use software that has installation files as long as the removal tool REMOVES the program completely.
Step Five :
Review your Startup Programs, Services, Drivers, Processes from time to time. Even after the above steps, the scum buckets can get there dirty programs on to our machines.
This step is for advanced users. Be careful when using these programs. Remember, if in doubt - DON'T!
An excellent freeware program for viewing, disabling and removing startup entries & browser helper objects is StartupRun by Nir Soft. This program is for experts as you must know what the entries do before deleting or disabling.
For beginners I just found another program, Startup Inspector for Windows. This is a freeware program that not only lists your startup programs but it has a brief explanation for each one with recommendations as to if you need it running or not. -Download Link- -Support Forum Link-
Another one: StartUpLite - Malwarebytes has created a safe, easy, and efficient way to eliminate these unnecessary applications that start when you turn on your computer - StartUpLite. StartUpLite is a lightweight and simple to use application that allows you to speed up your system startup, safely and efficiently. The program allows you to disable or remove unnecessary startup entries from your computer. By using StartUpLite, you can dramatically help shorten your startup time with only a few clicks of the mouse.
For Drivers & Services use ServiWin by Nir Soft. ServiWin utility displays the list of installed drivers and services on your
system. ServiWin allows you to easily stop, start, restart, pause, and continue service
or driver.
For Processes use CurrProcess by Nir Soft. This utility displays the list of all processes currently running on your
system.
A list of startup items & services explaining what the above items do on your machine can be found at these sites:
Some offsite articles worth reading (they will open in a new window or tab):
How to install and use the Windows XP Recovery Console - bleeding computer tutorial
How to Prevent Malware -
How to Prevent the Online Invasion of Spyware and Adware - by Enrique de Argaez
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - bleeding computer forum thread
Malware: Help prevent the Infection - by Sandi Hardmeiri, March 22, 2005
Simple and easy ways to keep your computer safe and secure on the Internet - bleeding computer tutorial
So how did I get infected in the first place? - Spyware Info Forum by Tony Klein
Last Step
Report your finding here: Malware Complaints - Register Your Complaint About Malware That Has Infected You - Let Others Know How You Feel. This site was started by anti-malware fighters as a place where you, a victim, can register your feelings about the malware writers that have made your life a misery. It is to provide you with ways that YOU can start to fight back at them, to hopefully start to make them suffer for what they have done to you, and the thousands of others who they have infected. We need you to 'Stand up and be Counted', to do this you can do several things, dependent on your country where you live.
Thanks & good day,
Frank Broughton
Webmaster
Last Updated
October 22, 2008
|
Software 