Spying on the spyware makers

TalkBack 8 of 212:

Next »

« Previous

• Thread View
• Flat View

Try this.

Removing Spyware is tricky as everyone has discovered. I can normally clean a major infected computer in about 3 hours. It's not necessary to know the name of the Spyware you are trying to remove but it can help. Here is my basic process.

1) Delete all temporary internet files & cookies.

2) Check add remove programs for any Adware that may be listed. Log onto the internet and try uninstalling everything that may be showing up there. A lot of these programs uninstall are bound to the internet. Be very careful when you read the uninstall steps as the questions lead you to answer the wrong way. Also if possible go to the website and look in their tech support section if there is one. LOP for example has a global removal tool that will uninstall every one of their Adware programs in one step.

3) Kill all running Spyware & Adware processes. If you don?t know which processes are the Trojans & Adware a virus scan will at least identify the files. Note that most processes you see running are also the name of the file on the system. While investigating the processes & files on the system check the file properties and a legitimate file will have the software company there. If there are no identifiable properties it becomes my suspect. The Windows task manager (ctrl + alt + del) has a process list in Windows 2k & XP, Win98 needs a process viewer installed. Spybot & MS Anti-Spyware has process viewers and a kill command is available there.

4) Update your anti-virus software and do a complete scan of all files. If your anti-virus software won't run it's possible you have an assassin Trojan on the system. Recently I?ve been dealing with the Sober virus and it?s new job is to take out any anti-virus & anti-spyware removal tools. It also blocks access to all websites that will help you remove the infections, they are blocked in a global variable that shows up in the host file but when you look at the host file there is nothing there. I found that Spybot will kill these entries in the advanced tools hosts tool. If you?re anti-virus software fails to run, uninstall it and after a reboot reinstall and update the software but don?t reboot the system or the assassin will take it out again. Disconnect from the internet then run the complete scan and remove all the virus?; any virus that cannot be deleted or quarantined are running as a process and the system has the file locked. To delete these, kill the associated process to the virus file name. If you can?t kill it and it keeps coming back do a registry search for the file/s name and delete all references to it/them. Then pull the plug on the computer, do not shut down as the virus will replace its load entry in the registry. Pulling the plug causes complete data loss and virus? are not immune to that so when you restart the system after pulling the plug the viral process is not loaded. Rescan your computer and you can now delete the file/s. Do not reconnect to the Internet yet.

5) If you haven?t done this yet, make sure you install and update your anti-Spyware application. It?s a good idea to do this before you start your cleanup/removal because there are going to be downloader?s found by the anti-Spyware scan. Anything that is found but cannot be removed, once again, is the same problem as the virus in step three. Do the same thing here. Identify the files, delete the registry entries, pull the plug, restart Windows in ?Safe Mode? and rescan the computer for both virus and Spyware.

6) Restart the computer normally and rescan for both virus and Spyware. It should come up clean this time.

7) Once your system is clean, open up Internet Properties and reset Internet Explorer back to the default settings. This is under the Programs Tab and there you will see a button to ?Reset Web Settings? check the box to reset the home page (this will be MSN but you can change that later).

8) Reconnect to the Internet.

To manually remove the Hyperload Mah Jongg examine the Registry and delete the entries for it. Kill any running process associated with Hyperload Mah Jongg (possible to have to pull the plug again) and then delete the install folder. Restart the computer in normal mode and if there is any file missing or load errors write down the file name and search the registry deleting any reference to it. Restart the computer again.

Posted by: Uncle Buck   Posted on: 05/13/05 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Reducing Server Total Cost of Ownership with VMware Virtualization Software VMware VMware virtualization enables customers to reduce their server TCO and ... Download Now
• Virtualization: Architectural Considerations And Other Evaluation Criteria VMware Of the many approaches to x86 systems virtualization available in the ... Download Now
• The Impact of Virtualization Software on Operating Environments VMware Today's use of virtualization technology allows IT professionals to ... Download Now