Tutorial=How to remove spy-ad-mal-ware FOREVER!

[\/iNcEnT]

Getting Ready:

Disable System Restore (WinXP & WinME only) if you are infected; Any trojans, spyware, etc. you may have picked up could have been saved in System Restore and are waiting to re-infect you. Since System Restore is a protected directory, your tools can not access it to delete files, trapping viruses inside. To disable it:

For Windows XP:

1: Right click on the My Computer icon on your desktop and select properties.
2: Click on the system restore tab.
3: Check the box that says "Turn off system restore on all drives". Click OK.
4: Click Yes when you are prompted to restart the computer
5: To re-enable System Restore, follow steps 1-3, but in step 3, click to clear the Disable System Restore check box.

For Windows Millenium:

1: Right-click My Computer, and then click Properties.
2: On the Performance tab, click File System, or press ALT+F.
3: On the Troubleshooting tab, click to select the Disable System Restore check box.
4: Click OK twice, and then click Yes when you are prompted to restart the computer.
5: To re-enable System Restore, follow steps 1-3, but in step 3, click to clear the Disable System Restore check box.

2. Enable viewing of hidden files and folders and extensions; Start Windows Explorer and click on your main hard drive, usually c:\. Then select Tools from the top of Windows Explorer and then Folder Options. Go to the View tab. Scroll down to the folder icon that says Hidden files and folders and check show hidden files and folders. Also, right below this option, uncheck the hide file extensions for known types. Also for Win NT, 2000, & XP systems, uncheck the Hide protected operating system files option.


3. Downloading Tools; Download the following tools and save in your favorite download folder or create one, for example C:\Temp or C:\Downloads. And then install, update, and configure as indicated below. While this may seem like overkill, there currently is no one perfect removal tool. Because of this, to properly find and fix your problem, you need to try a variety of programs.


AD-AWARE SE......Install, click Check for Updates now and get any updates, then exit.
CCleaner...........Install only, then exit
SpyBot...............Install, do the search for updates now and get any updates, then exit.
SpyWareBlaster....Install, click Download Latest Protection Updates, Check for Updates, and then Enable All Protection, then exit. It does a great job of blocking known vulnerabilities as well as known malicious websites.
CWShredder.....No installation required! Just unzip it to a folder.
Kill2Me............No installation required! Just unzip it to a folder.
HS Remove.......No installation required! Ready to run as is. (Only for WinNT, 2K, XP)

HEHE now ur ready to scann like a pro.

Now for the Removal Part.

Do these scans first in normal boot mode:

do an online scan at Trend Micro's Free Online Virus Scan
do an online scan at Symantec Security Check

If using a non-IE browser, you can use Trend Micro's online scan with Java located HERE

1. Start your computer in safe mode, why safe mode? Because safe mode allows you to load only the required drivers to use the computer. To run in safe mode push F8 when your computer start's up.

2: Clean Your Hard Drive; Remove temporary internet and other files not needed with CCleaner. Run CCleaner with the default options to clean out temporary files. Optionally, check the clean "Delete Index.dat" checkbox. Only use the Windows tab and select Run Cleaner. Do not run any other options from other tabs.

3: Main Spyware Scan And Removal; Scan your machine with Ad-Aware SE (remember to get the Ad-Aware VX2 Cleaner Plug-In for it) and Spybot. Look for the Immunize feature in Spybot and use it. Make sure you install the Spybot DSO Exploit patch before running a scan with Spybot.

4: Secondary Spyware Scan And Removal: Other Removal Tools; Run the other programs you downloaded; CWShredder (make sure you select Fix), and HSRemove. They are free, standalone and easy to use.After you do all of those steps, restart in normal mode, and laugh as how ur free of all that crap u had. Best thing to do is do a scan with all of the scanners to make sure your clean.

If you are still having problems after performing all the above, these alternative scans below may prove to be useful.

Bitdefender online scan
RavAntivirus online scan <-- select Auto Clean then click Scan My PC
TrojanScan online scan
ADS SPY - Alternate Data Streams Spy from Merijn


AFter these scans, run the scans u downloaded.........

[Nubli]

Just make sure not to run each and every program at once, worse than Ad-ware/Spyware

[jedimaster86]

Yeh, and just be careful because if you don't use Spybot correctly, i believe i read somewhere that it can screw up your computer or something like that (there are many options in Spybot). Heh, looks like most of this was copied right out of another source, and then some language here and there changed to make it looks more like today's average online user (ex: "ur", "u"); no biggie but just make sure you note your sources next time; thanx.

[Shihan]

Actually, there is no complete way to prevent it from coming back if you don't know what you're doing.
Example: Downloading known spyware...
And don't play with HijackThis unless you know what you're doing. ^_^
Gotta love people who check everything to be removed on it and then complain that their system doesn't work afterwords.