spyware removal and prevention tutorial

These are my recommended steps to stop spyware:

--Before starting all of this i recommend downloading these using XP's safe mode with networking or if it is not xp, download all tools and run all in safemode.--

1) In windows Me or Xp turn off system restore and CLEAN IT OUT!
2) Clean temp files to make next steps quicker, I use cleanup! cleanup.stevengould.org

3) Download spysweeper www.webroot.com (update and scan)
4) Download adaware www.lavasoftusa.com (update and scan)
5) Download spybot www.safer-networking.org (update, IMMUNIZE and scan)
6) Download CWShredder http://www.intermute.com/spysubtract..._download.html (run)
7) Download HijackThis www.merijn.org (scan and remove any bogus entrys)
8) Download About:Buster His site has been down use google for this one and run it
--If any LSP's cannot be removed try using LSP fix www.cexx.org/lspfix.htm --

Now REPEAT IN ALL USE ACCOUNTS!!! <----VERY IMPORTANT

These are my recommended steps to immunize spyware:

1) Spybots - already done above
2) Download Spywareblaster www.javacoolsoftware.com/spywareblaster.html (Update and immunize) --NOTE DOES NOT AUTOMATICALLY UPDATE you can donate $10 so it will though.
3) Download Blockfile www.spywareguide.com/blockfile.php and import to registry
4) Download Ie-Spyad https://netfiles.uiuc.edu/ehowes/www...ce.htm#IESPYAD and import files to registry
5) Download new Hosts file http://www.mvps.org/winhelp2002/hosts.htm and copy to
Windows XP = C:\WINDOWS\SYSTEM32\DRIVERS\ETC
Windows 2K = C:\WINNT\SYSTEM32\DRIVERS\ETC
Win 98\ME = C:\WINDOWS
--NOTE steps 3-5 will obviously not update themselves so they must be downloaded periodically-
6) If you have money pay for spysweeper so it will update its self and protect you.

And thats all she wrote! That will help you with you issues except for the really tough tough spyware that has to be manually removed by an experinced tech.

PLEASE DO NOT POST Hijackthis logs here -google is your friend in this case and www.help2go.com/modules.php?name=HJTDetective is a good site that will help a little.

GOOD LUCK ALL!

thanx .. nice tut

Why thank you

About:Buster site has been working fine :confused:

http://www.malwarebytes.biz/forums/index.php?act=idx

About:Buster can be downloaded from Subratam's:
http://www.subratam.org/?page=removal

Quote:

---

Before starting all of this i recommend downloading these using XP's safe mode with networking or if it is not xp, download all tools and run all in safemode.--

---

You don't need to download 6 different software applications. All you need is Adaware from www.lavasoft.de and CWSShredder as stated by you.

I would like to add a couple useful tips to help get rid of spyware if your running Internet Explorer 6.0

Open Internet Explorer click on tools, go down to Internet Options, Click on the Advanced Tab, under Browsing look for "Enable third party browser extensions" and uncheck it. Next Hit apply then OK. Next close IE and all other applications and reboot the PC. This also helps with spyware. Also, if your running XP Pro you can use the System restore feature, and back your OS into a previous state before you got infected with that crap. On a personal note I hate spyware I work for a ISP and it seems ALL customers are getting infected with this crap. I wish there was a way to get rid of this crap for ever its a nightmare for technical support. Anyways thanks for the info, Computernerd22

That is not true at all i work on computers every day and i mostly do "tune-ups" which usually is removing spyware thses days. Adaware does not pick up everything, neither does spybot, we used to jsut use spybot or adawre depending on what was better that day but now we need all of them. I can do a scan with both adaware and spybot then find hundreds and hundreds of spyware with spysweeper.

And doing a system restore isnt always the best idea, i tell people to turn it off 1st because it will empty it because spyware and viruses can and do hide there.

And groovicus, thank you for that :D

I am amazed by the "System Restore" comments on a number of sites.. Some ppl just recommend useing it as the firstline of defence, others dont bother advising turning it off..even arguing when it is mentioned to be turned off.
Not Clearing the System restore is just a game of Russian Roulette..

And yes.. many tools is the go for today.. Adaware, Spybot SnD, HJT, The Cleaner, Stinger, etc etc.. one on its own is not assurance enough for me when cleaning.. what is normaly a mixed infection (that is Virus, advertising trojans, Trojans, misc adware, spyware).

Gotta use multiple scanners... Sigs have not been nearly powerful enough lately.

Quote:

---

Now REPEAT IN ALL USE ACCOUNTS!!! <----VERY IMPORTANT

---

How about just the admin?

Quote:

---

Download HijackThis www.merijn.org (scan and remove any bogus entrys)

---

I never recommend this step, 'tis very dangerous.

As usual with these tutorials (how many of these do we have now?), the author forgot the most important part of all.
UPDATE WINDOWS

I'd also recommend not using older versions of Internet Explorer ( the ones with the DSO exploit ).
The DSO exploit enables a remote site to execute code without the user's permisssion.



PacKet Thirst

Hey Hey,

Where to start.... other than to say I'm rather unimpressed by this... it has a few good points but several bad points that completely counter the good aspect...

Before anything else I'm going to mention that www.merijn.org is basically impossible to get to (or so I've found)... so I'd suggest visiting http://www.spywareinfo.com/~merijn/downloads.html for Hijack This.

Now on to the rest of this

Quote:

---

--Before starting all of this i recommend downloading these using XP's safe mode with networking or if it is not xp, download all tools and run all in safemode.--

1) In windows Me or Xp turn off system restore and CLEAN IT OUT!
2) Clean temp files to make next steps quicker, I use cleanup! cleanup.stevengould.org

---

We start with something good... We'll see if this pace maintains itself.

Quote:

---

3) Download spysweeper www.webroot.com (update and scan)
4) Download adaware www.lavasoftusa.com (update and scan)
5) Download spybot www.safer-networking.org (update, IMMUNIZE and scan)
6) Download CWShredder http://www.intermute.com/spysubtract..._download.html (run)
7) Download HijackThis www.merijn.org (scan and remove any bogus entrys)
8) Download about :Buster His site has been down use google for this one and run it
--If any LSP's cannot be removed try using LSP fix www.cexx.org/lspfix.htm --

---

This portion isn't too bad.... but it's a bit of overkill... You should be careful while using HJT... and I don't think Spysweeper is necessary... It's decent software.. but it's not that special... The only benefit to Webroot is if you want a corporate spyware solution. I can't comment on solution 8 because I've never used it but after that the rest is fairly decent.... The LSP one however.... most people who need something this basic are going to have no clue what you mean at this point.... You might want to explain it a little better.

Quote:

---

Now REPEAT IN ALL USE ACCOUNTS!!! <----VERY IMPORTANT

---

As soda mentioned... why? Just use the admin account.

Quote:

---

These are my recommended steps to immunize spyware:

1) Spybots - already done above
2) Download Spywareblaster www.javacoolsoftware.com/spywareblaster.html (Update and immunize) --NOTE DOES NOT AUTOMATICALLY UPDATE you can donate $10 so it will though.
3) Download Blockfile www.spywareguide.com/blockfile.php and import to registry
4) Download Ie-Spyad https://netfiles.uiuc.edu/ehowes/ww...rce.htm#IESPYAD and import files to registry

---

These won't help immunize you against spyware... they may defend against specific variants... the only protection aginst spyware is safe computing habits.

Quote:

---

5) Download new Hosts file http://www.mvps.org/winhelp2002/hosts.htm and copy to
Windows XP = C:\WINDOWS\SYSTEM32\DRIVERS\ETC
Windows 2K = C:\WINNT\SYSTEM32\DRIVERS\ETC
Win 98\ME = C:\WINDOWS

---

What if the malware has modified the registry so that the host files points elsewhere?

Quote:

---

6) If you have money pay for spysweeper so it will update its self and protect you.

---

With the number of freeware/shareware solutions out there... there's no need to ever spend money on this sort of product

Quote:

---

PLEASE DO NOT POST Hijackthis logs here -google is your friend in this case and www.help2go.com/modules.php?name=HJTDetective is a good site that will help a little.

---

Who are you to tell people not to post their HJT logs here.... They're more than welcome to post them and ask for our help.

Now there are a few problems here.... Microsoft Anti-spyware (and I'm normally Anti-MS) is quite good and combines several of these programs into one utility. It should be listed...

There's also no mention of running a virus scan.... You're desktop AV should be run (AVG, Norton, McAfee, PC-Cillan, etc)... and you should also make use of the TrendMicro System cleaner - http://www.trendmicro.com/download/zh-tw/tsc.asp

It was mentioned that Windows updates should be installed and this is true.. however after cleaning before going back online you should make sure that there is a firewall enabled.. Windows or third-party.. even a hardware firewall (home router) is fine if you know there's no infections behind it..... This makes a huge difference though... especially with the recent increase in network aware malware.

Peace,
HT

You might try this:

http://www.ewido.net/en/

It has over 87,000 items in its database

It is payware, but you can download a trial. After that has expired you can Still update it and use it as a manual scanner, for free.

I also like SwatIT, it takes forever but is very thorough.

http://swatit.org/

I think that these two are somewhat better with trojans and worms that the others.

I agree with HTRegz, in that you should run your updated AV in safe mode and do an online scan.

You should monitor the registry and check for new programs:

RegistryProt from DiamondCS http://www.diamondcs.com.au/

This is also a useful tool that warns you of new executables on the block:

http://www.winpatrol.com/


Other than that, I think you should warn people more about using HijackThis! It is not a tool for the uninitiated. They should be sure to back up the Registry before manually deleting things.

Cheers

This seems to be a good a place as any to mention this. Wouldn't it be nice to have people submit tutotials for review by a panel of AO members who are experts in the field? Too many times I have seen bad advice (tutotials specifically) posted and many more times people try the first thing they read before seeing corrections to the post (tutotial). Anyone else think this idea may improve the quality of tutorials here?

my 2 cents

--TH13

Quote:

---

Wouldn't it be nice to have people submit tutotials for review by a panel of AO members who are experts in the field?

---

This was never submitted or posted in the tutorials section. The poster called it a tutorial and put it into the Spyware/adware section.

Perhaps it might be better to put your suggestion into Site Suggestions. That said, it's hard to define what an "expert" would be and who they should be.

Oh.. and it's TUTORIAL. I think you're 'R' key is stuck. ;)

You do need to run your scans in every user. This is mostly important in XP becasue they all have their own sets of files and registry keys that for some reason the admin acounts dont scan all of them. And thehorse13 I concider my self an expert when it comes to computer repair and especially spywware. I have been fighting it for literally years. At work we have created a checklist around the shareware/freeware tools i update and put on a cd every week. We have created a checklist that helps us remove spyware, viruses and other various problems with very good effecency. We are the only computer store in our are that cares about actually fixing computers and we have an excelent reputation, we are very picky people.

And i do recommend using hijackthis if you know what you are doing otherwise you can post your log and if you do what an expert sais you should be fine.

edit-
and that host file stops you from going to anysite that hosts spyware if you host file has been redirected well then it wont help no but when you fix that it will.

regarding the software tools that prevent your pc to be infected with spyware, there nice. I think its good to haver them but for me Spybot, Adaware & About Buster and CWshedder are enough to prevent your pc to be infected. Thanks. dont forget about firewalls.

I can hardly believe with all this good advice that nobody mentioned the most powerful, most overlooked clean-up program available...



It's called Add/Remove programs...guaranteed to remove 80% of what ails ya.

Quote:

---

I have been fighting it for literally years.

---

I don't think following a checklist really counts, but whatever... about the only thing I can agree with is your link to help2go. As much as I hate automated scans, many of the 'consultants' on that site are well known, and work hard to keep it updated. That doesn't mean, however, that it isn't prone to false positives.

Along with any good help guide should be a list of places to research problems. CastleCops has some of the best:
http://computercops.biz/CLSID.html
http://computercops.biz/LSPs.html
http://computercops.biz/StartupList.html

In Addition:
http://www.liutilities.com/products/...rocesslibrary/

Also, how about some real tools for when you have malware that automated processes don't touch? These are what the real experts use:
http://www.subratam.org/?page=removal
http://www.sysinternals.com/

How about a list of places to turn to when you get in over your head:
http://asap.maddoktor2.com/ -- list on left side

Let me SECOND Nihil's promotion of WinPatrol and RegistryProt: both very good!

You forgot a few things I would suggest...

* For spyware blocking: SpywareGuard by Java Cool Software uses heuristics so you dont have to keep updating it.
http://www.javacoolsoftware.com/sgdownload.html

* For info regarding what's starting up process-wise: StartupList by Merijn
http://www.merijn.org

* OpenPorts by DiamondCS; shows ports listening/connected to system and process used in connection, commandline; (http://www.diamondcs.com.au/openports)

* TCPView by SysInternals; shows ports listening/connected to system and process used in connection, GUI; (www.sysinternals.com)

* TDIMon by SysInternals; process viewer; (http://www.sysinternals.com)

* Process Explorer by SysInternals; process viewer; (http://www.sysinternals.com)

* PrcView by Igor Nys; process viewer; (http://www.prcview.com)

* Browser helper object detector: BHODeamon
http://www.definitivesolutions.com/bhodemon.htm

* Free Internet Spyware Scanners:
http://www.spywareguide.com/txt_onlinescan.html
http://www.bitdefender.com/scan/license.php
http://www.webroot.com

* Free Internet Virus Scanners:
Any browser:
http://housecall.trendmicro.com
Requires IE/Active-X:
http://security.symantec.com
http://www.pandasoftware.com/activescan
http://www.bitdefender.com/scan/license.php

* Spyware Help Sites:
http://www.spywareinfo.com
http://www.spywarewarrior.com

* Browser hijack help:
http://bcheck.scanit.be/bcheck/hijacked.php

* General Spyware:
http://www.spywareguide.com
http://www.spywarewarrior.com/rogue_anti-spyware.htm

* Process lookup:
http://sysinfo.org
http://www.processlibrary.com
http://www.answersthatwork.com/Taskl...s/tasklist.htm

* Virus libraries:
http://www.viruslist.com
http://us.mcafee.com/virusInfo/default.asp