Malware/Spyware Removal Guide

altin_2

hi all.
have this first BIG virus problem yesterday.
i use AVG Free Edition.
YES i did a mistake of letting activeX objects installed from a non trusted site.
at some stage i have all this antivirus downloads installed at my pc.
run AVG but nothing was found.
check this forum and download SPYBOT.
It find 15 malicious programs: AntiVermins,Zlob etc.
I'm not a pc gig but i'm pleased with Spybot.
for a moment i thought that's it--the pc is useles:mad: :mad: :mad: .
Hey i was so wrong.
Now looks everything normal.:j :j :j .

j_davies

altin wrote:

.
YES i did a mistake of letting activeX objects installed from a non trusted site[/B
for a moment i thought that's it--the pc is useles:mad: :mad: :mad: .

Yeah its never user error

Magenta

Browntoaea, HELP please!

I am not very computer savvy, I have windows 98 and a WINSPYWARE programme installed itself on my computer a few months ago. I have "removed " it once but it recreated itself and now I can hardly use my computer. Will your 4 point method work with Windows 98? Thanks so much.

Browntoa

yes, spybot and ad-aware will work

the only software that will not work is AVG anti-spyware (Ewido)

just follow the same steps

Magenta

Hi Browtoe,

Thanks for your help. I ran your 4 point system and by runnung the scans several times especially ccleaner I have managed to get the WINANTISPYWARE to loosen its hold a little bit, but no doubt it will restore itself again as before. It appears on my computer as soon as I boot up and covers almost the whole of the lower right hand corner of my computer screen making the computer virtually unusable.

I will try to start a new thread about this particular one once I have found out how to start a new one!!!!!!!!

buglawton

Any method of removal that does not involve running in Safe Mode or Recovery Console mode to delete the bad stuff. will probably fail. I got rid of certain spyware recently:
1. Identified strange components through the Ewido and AVG scans.
2. Additionally used AUTORUNS to see what starts up on the PC and noted the suspicious file names/locations.
3. Used the installation CD-ROm to boot up, went DOS prompt command mode and manually renamed said items with a 'safe' suffix ie not .dll or .exe
4. Rebooted and found PC would not connect to internet.
5. Used Installation CD-ROM to do a Windows REPAIR (there are some helpful websites to guide on this). This leaves files and programs in place so is not as drastic as a reinstallation.

Added: See http://www.michaelstevenstech.com/XPrepairinstall.htm for the full help on this. I used the 'R' mode to get to the console command line to delete the spyware files. You have to navigate to the corect location using the CD command e.g. CD windows then CD drivers or somesuch. After doing that you MIGHT be able to reboot & get the internet working again. If not then have to the Repair procedure mentioned in that link. Be careful to avoid doing a full install by accident and back up all critical files, photos & music FIRST!

Magenta

Thanks for your reply.

Mr_Dough

I use Autoruns, Process Explorer and Root Kit Revealer originally developed by https://www.sysinternals.com (now under the command of Microsoft) are very effective for Spyware removal. I then follow up with a commercial antispyware scanner.

I keep the above tools and a selection of antivirus/antispam/antispyware suites (30 day trial versions) on a USB stick with their relevant recent definitions/updates (typically a week old) for emergencies - friends computers.

If you have the time, patience and the hardware resources (an old pc), then checkout
https://www.Dansguardian.org on how to setup a Linux based web proxy filter to santise your web content from malware. I know its Linux, but don't let it put you off.

Also its worth investing in a router (checkout Zyvel, Draytek's ) which include P2P blocking and to subscription to URL/content filtering based services to weed out malware.

Hope this helps..

jiji

I am getting lot of popup & getting message my computer is infected need to load oftware to get rid. can someone help me how to get rid this. Yours help appreciated. thanks.

Browntoa

just follow posts 1 to 4 of this thread, all the instructions and software you need are there. if you still have problems after that then start a new thread about your problem and include a hijackthis log, it tells you how at the end of post 4