Manually removing spyware
Sometimes it comes in handy to be able to manually remove spyware. Too often, techs and hobbyists hit a brickwall with these rogues. So they format the hdd and reload Windows, often discarding data, installed apps and ass't other sundry settings. Manually removing infected files offers a more surgical approach.
The best way to remove spyware and viruses, of course, is the SOB (standard operating bullscheiss). Run apps like Ad-Aware, Spybot, Ccleaner, SpySweeper, Ewido, or whatever. Update your AV app and run it. Run online scans. Do the SOB first. But this often fails to remove newer, persistent forms of spyware.
When running the SOB, there's no sense in watching the paint dry, so start hunting. Search the system for any recently added dll's or exe's. Also, for any null files (xxx.~) or tmp's. The time stamp's important. One of the first things to determine is how long a user's been having problems. This will help refine your search for any recently added files.
Do your homework here. Google any dll's or exe's you find in your search-by-date. No sense in deleting any legitimate app files. Sometimes you'll find dll's and exe's in odd places: temp folders, even the Windows' font folder. Use common sense. If you're not sure, backup the dll or exe to a usb drive. Null files and tmp files are safe to add to your list. Crap cleaner (Ccleaner) will clear the stuff in the temp folders generally but not always. Don't take anything for granted.
Recently I ran across the dreaded "Spy Falcon". The user said he had been having problems for 4 days or so. While running the SOB, a search for week-old dll's yielded ginuerep.dll, the only one to turn up in my search-by-date. Googling "ginuerep.dll" yielded the info I needed: confirmation ginuerep.dll was spyware and also Spy Falcon removal instructions. By the time I found out Spybot wasn't going to remove it, I was ready to manually do it. No sense in wasting time.
Online AV scans such as Panda and Trendmicro will often reveal infected files other apps won't find, such a java downloaders (rogue jar files). But they won't remove them. Rootkitrevealer, the same (beware false positives with this one). These infected files sometimes won't be visible from Windows. But they ARE there. You can verify that if need be by booting to a live cd (Insert's good for this) or running old DOS utilities (co.com or dr.com).
Up to this point, we've been compiling a list of files from a number of sources. We're haven't removed any files yet. It's really important to keep accurate notes. To manually remove rogue files, we're finding them in one step and removing them in another.
So we got our list, then see what we can delete from Windows Explorer, or whatever file manager you use, before rebooting. Again, don't assume that if you can't see it, it's not there. Delete from a command prompt if you can (better know some DOS stuff!).
Removing our little friends is a process of booting and rebooting till they're gone. You need a live linux cd. First, so we can see what's on the Windows' partition. And second, so we have another option for removing the rogues (they can get tricky). You can hide from Windows' API, but you can't hide from Midnight Commander.
There's really no set order for booting between safe mode and the live cd. You're flying by the seat of your pants at this point. Booting into safe mode is best done with command prompt, one of the safe mode options you'll get after hitting F8. I prefer using the "del" command. It works better than to use a file manager like Explorer. In my experience, the "del" command will still delete files not visible by the API.
Booting to the linux CD, mount the Windows partition (usually /dev/hda1/, but not always). If it's a FAT file system you're dealing with here, fine. If you've mounted an NTFS partition, you'll need to run a linux app called "captive" so you can write to it (or delete in this case). Insert (linux) has great instructions for this. I believe it's on all the Knoppix distros, don't know about the others. A caveat here: captive doesn't work everytime. It gets buggy on some volumes, don't know why.
So you'll have two basic options for deleting files: the linux cd and safe mode. Stick to your list. If you're worried something on the list is a system file of some kind, use the linux cd and a usb drive to make a copy before you delete. Midnight Commander (mc) is a handy file manager for this. Make sure you got good notes if you need to put anything back.
And use those online scans, too, until you get an all clear (yes, you'll need the loathesome Internet Explorer for those, replete with ActiveX, so make sure you don't have the screws down too tight on IE). Boot. Reboot. Repeat as necessary.
Happy Hunting!
