Malware/Spyware Removal Guide

MercilessKiller

A lot of people will post a new thread instead of following browntoa's instructions (even after viewing it) seeing as most spyware can be removed in one step instead of going through the whole list.

My advice to MSE Techie forum would be to create a sticky (or maybe an index) to removal of different types, rather than putting the instructions from how to remove EVERYTHING in one tutorial That puts off all newbies...

Browntoa

always the same steps, regardless of the infection as it goes...you want to be sure that you clean everything off the pc in one go

many infections open a gateway and install further infections, keyloggers etc so it's best to make sure you are working from a clean slate when tidying up with a hijackthis log


ps..updated the first posts

Penny_Watcher

I just wanted to say thank you for the advice in the first couple of posts on this thread. I'm "technically challenged" , but after following the advice to the letter I managed to rid our laptop of various bit of malware/spyware [and?] trojans picked up yesterday by DS1(12) and his best mate randomly clicking on stuff on the interweb.:mad: We needed to use all 5 of the recommended scans as some programs didn't pick up all the problems.

Thanks again. Definately money saving as I would have been off down the local lap top doctors to get it fixed. :T :A

peterbaker

Hi Browntoa!

Well done for taking on what must be quite a workload over the months since you started this!

I have over the years managed to get rid of several persistent spyware infections using instructions like yours but currently I am a bit stumped. I've got MS Windows Home Vista Premium on this 2 week old laptop and already I have got an infection probably picked up by my son on a Flight Simulator X freebie download site.

The laptop had Windows Defender preloaded but I have never been convinced that Windows Defender is any good. Are you?

I have already discovered that http://www.pandasecurity.com/homeusers/solutions/activescan/ doesn't yet support Vista.

Can you help us Vista peeps yet?

The main symptom is a DNS redirect on my webmail which is at Madasafish but redirects to one of those flipping annoying link pages which implies it is the answer to God The Universe and Everything! I can still get to my webmail by going in via a backdoor URL that doesn't have madasafish.com domain, but it is very annoying.

I also seem to get an 888 Party Poker advertisement and some cpxinteractivecom popups.

An AVG Anti-Spyware scan found some stuff and apparently deleted them but I still haven't tracked down the DNS redirect culprit. I also noticed that AVG Antivirus automatically snared a Trojan yesterday when I wasn't in any dodgy website, (apart from the FSX download sites this laptop is too new to have risked on anything remotely dodgy!) I was impressed but not concerned ...I let AVG delete the Trojan without taking a note of what it was...perhaps a mistake.

Anyway, like most amateur Sherlock Holmes, I already have HijackThis 2.02, and you are welcome to tell me where to post the log or any snippets from it ... I promise not to clutter up this thread with it of course

Cheers

PB

lorib_2

Browntoa wrote: »

Download the following software, in each case as it downloads click on the “Run” button on the File download box that opens to install the software.

Before you start make sure you are at least up to date with Windows XP Service Pack 1a by going here

http://www.microsoft.com/windowsxp/downloads/updates/sp1/default.mspx

and choosing

http://www.microsoft.com/windowsxp/downloads/updates/sp1/express.mspx


1) Please download and install Superantispyware from here ….

[FONT=&quot]http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE

• Load SUPERAntiSpyware and click the Check for Updates button.
• Once the update has finished, exit SUPERAntiSpyware.
• Please do NOT run a scan yet!

[/FONT]
2)Ad-Aware from Lavasoft from here

http://www.lavasoftusa.com/products/ad_aware_free.php

Install, click Check for Updates now and get any updates, then exit

3)Crap Cleaner from

http://www.ccleaner.com/ccdownload.asp

Install only, then exit

4) Microsoft Windows Defender (this can only be used with Windows 2000/XP/2003) (was known as Microsoft AntiSpyware)

http://www.microsoft.com/athome/security/spyware/software/default.mspx

Install it and update it

5)Spybot Search and Destroy

http://www.safer-networking.org/

Install, do the search for updates now and get any updates, Make sure you leave the SDhelper ( IE bad download blocker) checked to install (this is the default).

You will need to disable system restore, boot into safe mode, scan for the problem and finally re-enable system restore.

For Windows XP:

1: Right click on the My Computer icon on your desktop and select properties.
2: Click on the system restore tab.
3: Check the box that says "Turn off system restore on all drives". Click OK.
4: Click Yes when you are prompted to restart the computer
5: To re-enable System Restore, follow steps 1-3, but in step 3, click to clear the Disable System Restore check box.

For Windows Millenium:

1: Right-click My Computer, and then click Properties.
2: On the Performance tab, click File System, or press ALT+F.
3: On the Troubleshooting tab, click to select the Disable System Restore check box.
4: Click OK twice, and then click Yes when you are prompted to restart the computer.
5: To re-enable System Restore, follow steps 1-3, but in step 3, click to clear the Disable System Restore check box

Thanks for the info about removing spyware crap...... it took me an hour to go through it but it worked and removed a nasty program that would not let me delete from the system as it said I had to buy a license first. Me happy, thanks, your a life saver

ioscorpio

adaware se or adaware 2007

I currently have adaware se personal, should I change to adaware 2007 ???

spud17

I believe there were the usual niggles initially, mostly about the apparent need to register/pay (or some such), you just ignore this (cancel).

There were a few threads on this forum about this.

I put it on a work mates PC (complete novice) and not heard of any problems.

Saying that, I still use the se version which still updates ok, will get around to changing someday.

Infidel

Something weird has happened with my PC today. I wanted to use system restore (as i noticed my firewall was disabled when i turned my PC on today and i had to re-intall it) but all the system restore points seem to have vanished, so i couldn't and still can't click back to any dates before today.
Any help much appreciated.

Quasar

Well, I installed Superantispyware a few days ago and right now I have done my first scan with it. It has found 117 threats - some tracking cookies, trojans and a Browser Hijacker Favorites, whatever that is. I'm totally stunned.

I always run regular scans with Adaware and spybot, and occasionally they find stuff, but never on this scale!

superscaper

Quasar wrote: »

Well, I installed Superantispyware a few days ago and right now I have done my first scan with it. It has found 117 threats - some tracking cookies, trojans and a Browser Hijacker Favorites, whatever that is. I'm totally stunned.

I always run regular scans with Adaware and spybot, and occasionally they find stuff, but never on this scale!

Wouldn't worry too much, I'm sure most of the tracking cookies are harmless as I find superantispyware is very cautious, which may be a good thing as I think in this case getting rid of some false positives won't actually do any harm. But it does seem better than some of the other antispyware.