Have Spyware/Popups? Read me first!

[habers]

Many people post here about how they have popups/spyware/malware ect. There are many people on this board that can help get you all cleaned up. Before asking for help please run through these steps before asking for help (it will make everyone's life easier). By doing these steps most if not all of your problems will be fixed, if not post a HiJackThis log like stated below:

---

Input, modifications, additions or changes are always greatly appreciated.
Special thanks to 68ShelbyGT500KR for the dedicated contribution to this thread and forum.

---

Table of Contents

* Do these steps BEFORE asking for help
* Some symptoms of Spyware related issues
* How To's
* Spyware Removal Software
* Good tools to have handy
* Good alternatives to using Internet Explorer
* Preventative Measures
* Standalone, Freeware Virus Scanners

---

Do these steps BEFORE asking for help ^

Note: If you are running any version of Windows XP or Windows ME you will need to disable "System Restore" before running any of these tools. Once you have fully cleaned your PC you can re-enable it. The reasoning is that some spyware will hide within your system restore points and hide from the spyware removal software. By disabling System Restore you will be removing all of your restore points.

START
Close ALL programs including Internet Explorer. (This should be done prior to running any of these spyware detector/removal tools including HiJackThis)

REMOVE PROGRAMS: Some parasites can be easily and effectively removed from the Add/Remove Programs applet in the Windows Control Panel.
Others will be present here, but will not effectively uninstall. And some won’t show here. A few of these — such as the common trio of Wild Tangent, Weatherbug, and Viewpoint —should be removed here first (so as not to break the uninstall capability by using other cleaning tools). A very serious invader that none of the other tools will touch will show in Add/Remove Programs variously as MySearch, MyWay, MyWeb, MyWebSearch, etc. If they sound like ad-based software, remove it!


Download CWShredder
Select Fix.

Get Spybot - Search & Destroy
Get AdAware SE Personal
Ensure you also have downloaded the latest updates
Before running the above configure per these instructions

Close all programs including internet explorer
Run Spybot and fix all found items
Reboot
Run Adaware and fix all found items
Reboot

Also run online Virus Checkers (any of these will do)
BitDefender Virus Scan
Computer Associates eTrust Antivirus
Panda ActiveScan
RAV Virus Scanner
Symantec Security Check
TrendMicro Online Scan - this one requires Internet Explorer
TrendMicro Online Scan - this one doesn't require Internet Explorer to use

Then run the following for Trojans
Sygate Trojan Scan
Online Trojan Scan


Reboot and Post a Hijackthis Logfile if you are still having a problem. Run Hijackthis from its OWN folder. DO NOT run from the zip archive or within another folder. The folder that HJT runs from will keep backups for you. (Do NOT check off anything and click FIX unless you know what you are doing)

When you post your HijackThis log file please start your own thread and title it accordingly, DO NOT post your log file in someone elses thread, it gets too confusing that way. Also note if any viruses or trojans were found.
END

---

Some symptoms of Spyware related issues ^

* When you start your computer, or when your computer has been idle for many minutes, your Internet browser opens to display Web site advertisements.
* When you use your browser to view Web sites, other instances of your browser open to display Web site advertisements.
* Your Web browser’s home page unexpectedly changes.
* Web pages are unexpectedly added to your Favorites folder.
* New toolbars are unexpectedly added to your Web browser.
* You cannot start a program.
* When you click a link in a program, the link does not work.
* Your Web browser suddenly closes or stops responding.
* It takes a much longer time to start or to resume your computer.
* Components of Windows or other programs no longer work.

---

How To's ^

How to Delete your Temporary Files
Navigate to the C:\Windows\Temp folder (or C:\WINNT\Temp). Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Go to Start > Run and type %temp% in the Run box. The Temp folder will open. Click Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.

You can also use a tool like CCLeaner to remove the tempoary files for you.

How to start your computer in safe mode
http://service1.symantec.com/SUPPORT...01052409420406

How to show hidden files and folders
http://service1.symantec.com/SUPPORT...ntiVirus%20Cor

How to Empty Recycle Bin
http://www.monroe.k12.la.us/mcs/trai...cycle_bin.html

How to get an "Add/Remove Programs list' with HiJackThis
Open HiJackThis, Click on the "Open the Misc Tools section" button, click on the "Open UnInstall Manager" button, "Save List" button. Save the file.
It will open with Notepad. In Notepad>edit>select All>Copy and paste into the *your* Log thread.

---

Spyware Removal Software ^

The combination of the above three spyware removal tools *should* remove all the spyware from your computer. It is very possible that they may leave behind "crumbs" (pieces of spyware that by themself are benign). Any of these programs below can help you get rid of these.

General
AdAware SE Personal (VX2 Plugin)
Microsoft AntiSpyware Beta 1
Spybot - Search & Destroy
Webroot Spy Sweeper

Specific
about:Buster
CWShredder - Removes variants of Cool Web Search
Home Search Removal Tool
WinFixer

Beware of Rogue/Suspect Anti-Spyware Products & Web Sites

---

Good tools to have handy ^

Many times when someone here is helping you, they will reference a program that they want you to run. Here is a list of the common ones. Do not run these programs unless you know what you are doing.

CCLeaner - removes unused and temporary files from your system
DllCompare
Hijackthis
Killbox
LSP Fix
Startup List
WinSockFix

---

Good alternatives to using Internet Explorer ^

Firefox
Opera

---

Preventative Measures ^

* Keep Windows Updated!
* Run some active Spyware watch software like SpywareGuard (nice complement to SpywareBlaster) or Microsoft AntiSpyware Beta 1
* SpywareBlaster (Prevent spyware from installing in the first place!)
* A host file explained. Updated regularly.
* Dealing with Unwanted Spyware and Parasites and Lock Down Internet Explorer
* When you install a program, take the time to make sure you are not installing some parasite along with it! This mostly happens with "freeware".
* A Startup monitor such as ToolBar Cop, WinPatrol ect...

---

Standalone, Freeware Virus Scanners ^

For those people not running any sort of scanner on their system. Download one of the below scanners, install and get the definition updates regularly.

* AVAST 4.0
* AVG 7.0 Free Edition
* AntiVir
* BitDefender Free Edition
* ClamWin

NOTE: You can have multiple scanners on your system but ONLY have one running in real time. Otherwise it can cause confilcts with each other. Check out HandyBits VirusScan Integrator if you have more than one Virus scanner on your computer.

---

[ChrisHicks]

this should be a sticky thread.

[Otto]

I would also recommend trying out Microsoft's new AntiSpyware program. It's gotten some good reviews at picking up things that AdAware and SpyBot miss.

Download here: http://www.microsoft.com/downloads/d...displaylang=en

[68ShelbyGT500KR]

Habers,

Your link for "Ensure you also have downloaded the latest updates
Before running the above configure per these instructions" page has been moved to the following address:

http://forum.malwareremoval.com/viewtopic.php?t=13

Maybe include downloading and installing the Vx2 plug-in for Adaware SE
http://www.lavasoft.de/software/addons/vx2cleaner.shtml

[habers]

Originally Posted by 68ShelbyGT500KR

Habers,

Your link for "Ensure you also have downloaded the latest updates
Before running the above configure per these instructions" page has been moved to the following address:

http://forum.malwareremoval.com/viewtopic.php?t=13

Maybe include downloading and installing the Vx2 plug-in for Adaware SE
http://www.lavasoft.de/software/addons/vx2cleaner.shtml

Thanks 68ShelbyGT500KR, anything in the "Do this before posting" section that you think should be amended?

[68ShelbyGT500KR]

Do these steps BEFORE asking for help

Include Windows Me in the Disabling of System Restore. There is a link on your Symantec's XP page, though.

Here is Me's disabling page:
http://service1.symantec.com/SUPPORT...&osv=&osv_lvl=


"Close all programs including internet explorer" This should be done prior to running any of these spyware detector/removal tools including HiJackThis.


REMOVE PROGRAMS. Some parasites can be easily and effectively removed from the Add/Remove Programs applet in the Windows Control Panel.
Others will be present here, but will not effectively uninstall. And some won’t show here. A few of these — such as the common trio of Wild Tangent, Weatherbug, and Viewpoint —should be removed here first (so as not to break the uninstall capability by using other cleaning tools). A very serious invader that none of the other tools will touch will show in Add/Remove Programs variously as MySearch, MyWay, MyWeb, MyWebSearch, etc. If they sound like ad-based software, remove it!

Run Hijackthis from its OWN folder. DO NOT run from the zip archive or within
another folder. The folder that HJT runs from will keep backups for you.

HOW To's
add empty the Recycle Bin

How to show hidden files and folders
http://service1.symantec.com/SUPPORT...&osv=&osv_lvl=



Spyware Removal Software

Spywareblaster should be listed in the "prevention Software' section not yet created,since it doesn't detect or removes items. As far as I am aware, it is only a preventor/restrictor based software

[habers]

Thanks, everything should be incorporated now

[DVD-ho78(DTS)]

Obviously it would be a good idea to take a trip over to the Windows Update site as well.

[habers]

Originally Posted by DVD-ho78(DTS)

Obviously it would be a good idea to take a trip over to the Windows Update site as well.

got it now! Thanks!

[68ShelbyGT500KR]

Under the "prevenative maintence" Section

A host file explained. Updated regularly.


SpywareGuard (nice complement to SpywareBlaster). Keep this updated


Dealing with Unwanted Spyware and Parasites and Lock Down Internet Explorer:


When you install a program, take the time to make sure you are not installing some parasite along with it! This mostly happens with "freeware".

A Startup monitor such as ToolBar Cop , WinPatrol etc....

[habers]

Originally Posted by 68ShelbyGT500KR

Under the "prevenative maintence" Section

A host file explained. Updated regularly.


SpywareGuard (nice complement to SpywareBlaster). Keep this updated


Dealing with Unwanted Spyware and Parasites and Lock Down Internet Explorer:


When you install a program, take the time to make sure you are not installing some parasite along with it! This mostly happens with "freeware".

A Startup monitor such as ToolBar Cop , WinPatrol etc....

Got it! Thanks!

[68ShelbyGT500KR]

Some symptoms of Spyware related issues:

* When you start your computer, or when your computer has been idle for many minutes, your Internet browser opens to display Web site advertisements.
* When you use your browser to view Web sites, other instances of your browser open to display Web site advertisements.
* Your Web browser’s home page unexpectedly changes.
* Web pages are unexpectedly added to your Favorites folder.
* New toolbars are unexpectedly added to your Web browser.
* You cannot start a program.
* When you click a link in a program, the link does not work.
* Your Web browser suddenly closes or stops responding.
* It takes a much longer time to start or to resume your computer.
* Components of Windows or other programs no longer work.

Rogue/Suspect Anti-Spyware Products & Web Sites
http://www.spywarewarrior.com/rogue_anti-spyware.htm

[Venom]

i have;

adaware personal
cwshredder
spybot
spy sweeper
hijackthis
spywareguard
norton
AVG

so do i need all these programs? i know some are better at finding different things and such. but after running every program (updated) and getting a clean bill of health, can i remove any of them?

i downloaded the microsoft anti-spyware, so add that to the list. but it also seemed to incorporate alot functions that i used other spyware programs for, can ms replace anything?

or should i just keep them all for the best protection?

[VinVega]

habers, GREAT synopsis. A big from me. Definitely deserves to be a sticky in my mind.

[Fok]

great thread, keep up the good work!

[dtcarson]

Eric Howes, Some super PC security professional researcher just did a big study on adware/spyware, and here are some interesting facts:

He: 'collected 20 different anti-adware applications. He then infected a fresh install of Windows 2000 SP4 and Office 2000 SP3 with several dozen adware programs in separate stages. Finally, he counted how many active adware components were removed by each anti-adware product."

[note: Adware is not things like Opera or Eudora].

Brian Livingston from Windows Secrets Newsletter summarized Howes's results, and found the following:

"Almost all the anti-adware programs that were tested removed fewer than half of the hundreds of adware components Howes cataloged. The best at removing adware was Giant AntiSpyware, but even that program removed less than two-thirds of a PC's unwanted guests. "

Here are the results, apologies for poor formatting: Fixed [percentage] should be high, false positive should be low.

Product Adware Fixed False Pos.
Giant AntiSpyware 63% 0
Webroot Spy Sweeper 48% 0
Ad-Aware SE Personal 47% 0
Pest Patrol 41% 10
SpywareStormer 35% 0
Intermute SpySubtract Pro 34% 0
PC Tools Spyware Doctor 33% 0
Spybot Search & Destroy 33% 0
McAfee AntiSpyware 33% 9
Xblock X-Cleaner Deluxe 31% 1
XoftSpy 27% 3
NoAdware 24% 0
Aluria Spyware Eliminator 23% 3
OmniQuad AntiSpy 16% 1
Spyware COP 15% 0
SpyHunter 15% 1
SpyKiller 2005 15% 2

"Howes didn't test the anti-adware programs in the above list against a program called CoolWebSearch (CWS). This little bugger mutates every few days, it seems. CWS actually requires a completely separate anti-adware program, CWShredder'

When he combined Giant with Webroot, that only increased the success rate to 70%.
Spybot and AdAware, together, only cleaned a combineed 54%.

Livingston suggests using Giant AntiSpyware, and Webroot SpySweeper, along with CWShredder, based on Howes's research.

And of course suggests taking measures to protect yourself in the first place, starting with not downloading Grokster: "For one group of tests, Howes downloaded and installed Grokster, a popular peer-to-peer file-sharing program, from CNET Download.com. Installing Grokster and clicking OK in its subsequent dialog boxes loaded 15 separate adware programs, containing 134 "critical" executable components"
Wow.

Installing and using multiple adware fixers and preventers; using a hardware and software firewall; watch where you go on the Net, etc.

The full article can be found here:

http://windowssecrets.com/050127/

and is very much worth a read.

What I got out of it is the software I've been relying on [Spybot and AdAware] are nowhere near the best out there : (. I'll be downloading some things tonight.

[All work copyright Eric Howes and Brian Livingston, sharing info as per the note allowing it in the newsletter, etc.]

[SunMonkey]

It looks like Microsoft aquired Giant AntiSpyware and incorporated it into their program.

[68ShelbyGT500KR]

Please add these standalone, freeware Virus scanners:
Here are a few freeware versions, updated regularly!
AVG 7.0 Free Edition: http://free.grisoft.com/freeweb.php/doc/2/
AVAST 4.0: http://www.avast.com/eng/down_home.html
AntiVir: http://www.free-av.com/
More to come...


For those people not running any sort of scanner on their system. Download one of the above scanners, install and get the definition updates regularly.

NOTE: You can have multiple scanners on your system but ONLY have one running in real time. Otherwise it can cause confilcts with each other.

[lemieux66c]

hey, just wanted to say thanks for the work that you guys have put into this thread. it certainly helped clean up my brother's computer a lot. now only if the same can be said of mine....although the fact that it is 5+ years old now may be part of the reason. spy sweeper kicks the #$%^ out of it.

[68ShelbyGT500KR]

Habers,
Please add this item to the "Good tools to have handy" section:
StartupList
A tool that lists all and every auto starting program on your system,better than Msconfig. Commonly used to troubleshoot malfunctioning systems, trojan/viral infections, new spyware/malware breed and the likes.

Thanks!

[sm8680]

68ShelbyGT500KR have you looked into CCleaner? http://www.ccleaner.com/

I cannot say enough good things about this tool

[68ShelbyGT500KR]

Originally Posted by sm8680

68ShelbyGT500KR have you looked into CCleaner? http://www.ccleaner.com/

I cannot say enough good things about this tool

I will take a look, Thanks!


Habers: Can you review and add if it meets your approval?: Thanks!
How to get an "Add/Remove Programs list' with HiJackThis

Open HicJakThis, Click on the "Open the Misc Tools section" button, click on the "Open UnInstall Manager" button, "Save List" button. Save the file.
It will open with Notepad. In Notepad>edit>select All>Copy and paste into the *your* Log thread.

This will give use a list of the items that you may beed to remove, spyware or parasite based apps

[habers]

Originally Posted by 68ShelbyGT500KR

I will take a look, Thanks!


Habers: Can you review and add if it meets your approval?: Thanks!
How to get an "Add/Remove Programs list' with HiJackThis

Open HicJakThis, Click on the "Open the Misc Tools section" button, click on the "Open UnInstall Manager" button, "Save List" button. Save the file.
It will open with Notepad. In Notepad>edit>select All>Copy and paste into the *your* Log thread.

This will give use a list of the items that you may beed to remove, spyware or parasite based apps

excellent!

[dtcarson]

New update on 'the best anti-spyware program':

According to Brian Livingston's "Windows Secrets Newsletter" and PCWorld Magazine:

"[Steve] Bass, a PC World columnist, came up with the same top choice as PC World itself recently did: Sunbelt Software's CounterSpy. Bass found that the much-hyped Microsoft AntiSpyware app, currently in beta, missed some spyware that CounterSpy caught — and there's no way for users to report problems to MS or get technical support, unlike other betas."
"5. Antispyware program. Sunbelt Software CounterSpy 1.0 (left, $20) is the most effective remover of spyware, according to an April 2005 PC World review. When used with the free HijackThis program, PC World says the two apps caught 100% of the nuisances tested. HijackThis is an advanced program that's supported by free technical forums. For small to medium businesses, Sunbelt CounterSpy Enterprise ($255 for 10 machines) is top-rated by eWeek as a centrally managed program."

CounterSpy is a paid software, though it looks like you can download an 'evaluation version', which I plan to do on my home computer.

Here is the permalink to the entire issue of WSN
http://windowssecrets.com/comp/050414/

[DGibFen]

Originally Posted by dtcarson

New update on 'the best anti-spyware program':

According to Brian Livingston's "Windows Secrets Newsletter" and PCWorld Magazine:

"[Steve] Bass, a PC World columnist, came up with the same top choice as PC World itself recently did: Sunbelt Software's CounterSpy. Bass found that the much-hyped Microsoft AntiSpyware app, currently in beta, missed some spyware that CounterSpy caught — and there's no way for users to report problems to MS or get technical support, unlike other betas."
"5. Antispyware program. Sunbelt Software CounterSpy 1.0 (left, $20) is the most effective remover of spyware, according to an April 2005 PC World review. When used with the free HijackThis program, PC World says the two apps caught 100% of the nuisances tested. HijackThis is an advanced program that's supported by free technical forums. For small to medium businesses, Sunbelt CounterSpy Enterprise ($255 for 10 machines) is top-rated by eWeek as a centrally managed program."

CounterSpy is a paid software, though it looks like you can download an 'evaluation version', which I plan to do on my home computer.

Here is the permalink to the entire issue of WSN
http://windowssecrets.com/comp/050414/

I'll second that. It caught 5 pieces of spyware that the MS Antispyware program didn't touch. In addition, it looks and acts just like the MS program, so there's not much to learn if you currently use the MS program.