Spyware Adware Removal - Removing Spyware/Adware

Removing Spyware/Adware

Sunday, 24 April 2005

We know that this is probably the main reason why you are here - but firstly we must tell you that there is no 'one solution' that will solve all adware and spyware related problems.

There are many different types of spyware/adware and the depth to which it infests a computer varies considerably. There are however many people that work tirelesly to assist individuals such as yourself to successfully remove such infestations and where necessary we shall try to point you in the right direction . Your ability to remove the infestation will largely depend upon your own capabilities and the confidence you have in them.

Novice Computer User - Basic Infestation

The very first thing you need to do is to see if you can remove the problem in the normal manner i.e. via an uninstall entry in your 'start>programs' menu or the 'add-remove programs' located in control panel (Believe it or not sometimes it works).

If you know that your computer is already infested with spyware and adware - or if you have a strong suspicion that it is:-

1. Download one or both of the following applications:-

SpyBot Search & Destroy

Ad-Aware SE Personal Edition

2. Install the application and then update the definition files using the integrated update option.

3. Disble 'System Restore' temporarily (Win XP & ME)

Right click on 'My-Computer' icon>select properties>clickon system restore tab>select Turn off system restore.

4. Re-boot you computer in 'Safe Mode':-

Push the F8 key at the top of the keyboard as your computer re-boots - you may have to do this several times. If your bios 'Boot Menu' option is also F8 - select your hard drive and then push the F8 key again.

5. Once your computer has started in 'Safe Mode' , run one or both of the applications:-

You may have to select them from the 'start>programs' menu as the icons may not be visible.

6. Review the listings found and allow the application to fix them as necessary.

7. Update the definition files for your antivirus application - You do have one don't you? If not utilze one of the following applications:-

8. Re-boot your computer into safe mode again and run your antivirus program - remove any viruses as necessary - most viruses will be deleted automatically but for others you may have to download an additional small application from your antivirus software provider that deals specifically with the virus you have.

9. Re-start your computer as normal and re-enable 'system restore'.

If your lucky the above will have solved your problem and all you need to do now is take the necessary steps to prevent the infestation occuring in the future.

Notice however, we said - if your lucky! Sadly most of us don't take any action to prevent such infestations until it is to late and if you fall into that category it is likely that you may well have multiple parasites causing you a multitude of problems. You may well not be able to update the definition files for your antivirus application or the above mentioned Spyware removal applications and if that's the case they may not solve your problem.

Now you have a decision to make - Just how proficient are you with a PC and how confident are you?

If you think the above has been a little difficult and you would rather now get some assistance we would recommend that you utilise this commercial application:-

Webroots - Spy Sweeper

If however you have the stomach for it - it is time to go to War!

Proficent Computer User - Serious Infestation

Oviously you have some nasty spyware or a very stubborn virus buried deep on on your system which does not want to relinquish its contol. Now the first thing you must do is to try an establish exactly what it is:-

1. Check your start up processes

Right-click on the taskbar and choose Task Manager from the menu
Click on the Processes tab and view the processes you have running
Using google or your preferred search engine, carry out a search on all of the processes running that you are questionable about - ie if you don't know what it is, research it!
Stop the processes causing the problem by right-clicking on them and choosing End Process.

2. Often you will not be able to stop the processes in the above manner and you will receive the dreaded "Access denied" message. Not to worry - it's just simply time to call in the artillery:-

Download a small utility program called Pskill.exe from SysInternals to your hard drive.

(If you are running Windows XP skip the above step - XP comes with its own 'kill' utility:- taskkill.exe)

Open a DOS command window:- 'Start>Run> type "cmd">click OK'.
In the command window that appears type C:\pskill.exe and the name of the process you want to kill, then press enter i.e.:-

if you wanted to kill the explorer process type:- "C:\pskill.exe explore.exe"

Pskill will respond:- "Process explorer.exe killed"

(If you are running windows XP - just type:- "taskkill.exe" followed by the process you want to stop in the same manner as above, at the command promt)

For more information about the command line options for taskkill or pskill ust append /? to the command i.e. type taskkill /? at the command prompt.

3. So by now we should have stopped the offending process, but how do we actually stop it from re-appearing? Somewhere on your computer you still have some nasty spyware or a very stubborn virus. Sysinternals has come to our rescue once again with a great little software applet called:- Autoruns

4. This applet displays shows you what programs are configured to run during system bootup or login and more importantly where they are located. So download it to your hard drive and use it to find the infestation so that you can delete it. Again be careful - do not delete anything unless you know what it is - if in doubt research it via google or your preferred search engine. You do not want to delete valid system files/registry entries.

5. Now that you have succeded in 'killing' off your parasite you can set about cleaning up your system in your own good time.

Hopefully your problem has now been solved - But there will be instances when the above will not work for you in such circumstances we suggest that you utilise the HiJack this

[ Back ]