If you are using Windows XP or Windows 2000, it helps to boot into Safe Mode with Networking. You can do this by restarting the computer and hitting 'F8' at bootup, then selecting the mode from the DOS menu that appears.
Special note about Windows XP: all users in XP have their own environments, so you must clean each user individually in case of infection. If you leave one user infected, they may reinfect the others.
When you are ready to clean, close all open programs.
1. Run Ad-aware. Update the program and then start a new scan. Choose 'Custom Scan' and change all the red X marks to green checks. When the scan finishes, right-click on the list of found items, choose 'Select All Objects', then click next to clean the system. Note anything it was unable to clean.
2. Run Spybot. Update the program, then use the Immunize button. Start a new scan. Let Spybot clean whatever it finds, but note anything it was unable to clean.
3. Run, update, and clean with CWShredder and AboutBuster. They will look for specific, problematic spyware programs and remove them if they exist. A clean scan is a happy scan.
4. Go to your Control Panel and open Add/Remove Programs. Go through the list and find suspicious entries and uninstall them. Variations on the word "Search" are often featured. If you are unsure if a program is legitimate, go to www.google.com and enter the name of the program into the search field. If it is spyware, websites in the results will mention it as such.
5. Open HijackThis. This program is NOT the same as the others. It shows more than spyware and you should be VERY CAREFUL when using it or you will break things in your system. Press 'Scan' to see a list of items. Use Google to check to see which items are legitimate and which are spyware. Remove the spyware and scan to see if the items return. Make note of any that do so.
6. Re-run Spybot until it comes up clean or shows a few items that keep coming back. Again, make note of what remains. Some items can only be cleaned while in Safe Mode; if you have an infection like this and are in normal mode, reboot into safe mode (F8 at startup with any version of Windows) and scan/clean to remove, then return to normal mode.
If one item is DSO Exploit, Spybot cannot fix this and repair must be done directly in the registry. To fix the DSO Exploit, you will need Spybot's results and your registry editor (Start/Run/type in 'regedit' and click OK). Look at the information Spybot provides for the DSO Exploit. There will be registry paths listed. In the registry editor, follow the folders until you reach the matching locations. Inside will be an item called '1004'. Delete this item and then right-click in the right pane and create a new DWORD Key. Name it '1004' and give it a value of 3. Repeat this action for each listed folder.
7. Launch Internet Explorer and go to http://housecall.trendmicro.com/ Run a scan on your computer and clean or delete any found infections. Then go to http://www.pandasoftware.com/activescan/ and begin a scan. When you reach the scan settings, check off Heuristic and click on My Computer to scan your entire system. This will clean trojans from your PC that are related to the spyware.
8. Reboot the system.
9. Go to your Control Panel/Internet Options. Clear your temporary files and reset your security and privacy levels to default. Under Advanced reset to defaults, then disable Install On Demand.
9. Run Ad-aware and Spybot again until results show clean for both. You now have a clean PC.* Rejoice!
*There are a few spyware programs that cannot be removed without manual work in the system files. I don't recommend trying to clean these yourself unless you are very knowledgable. Most internet how-tos are useless with these because of the speed at which spyware mutates. In these cases, either find an expert who will clean it or reformat and reinstall.
![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
Re: This was posted by someone else, but it's locked.
Date: 2006-05-25 01:12 am (UTC)If you are using Windows XP or Windows 2000, it helps to boot into Safe Mode with Networking. You can do this by restarting the computer and hitting 'F8' at bootup, then selecting the mode from the DOS menu that appears.
Special note about Windows XP: all users in XP have their own environments, so you must clean each user individually in case of infection. If you leave one user infected, they may reinfect the others.
When you are ready to clean, close all open programs.
1. Run Ad-aware. Update the program and then start a new scan. Choose 'Custom Scan' and change all the red X marks to green checks. When the scan finishes, right-click on the list of found items, choose 'Select All Objects', then click next to clean the system. Note anything it was unable to clean.
2. Run Spybot. Update the program, then use the Immunize button. Start a new scan. Let Spybot clean whatever it finds, but note anything it was unable to clean.
3. Run, update, and clean with CWShredder and AboutBuster. They will look for specific, problematic spyware programs and remove them if they exist. A clean scan is a happy scan.
4. Go to your Control Panel and open Add/Remove Programs. Go through the list and find suspicious entries and uninstall them. Variations on the word "Search" are often featured. If you are unsure if a program is legitimate, go to www.google.com and enter the name of the program into the search field. If it is spyware, websites in the results will mention it as such.
5. Open HijackThis. This program is NOT the same as the others. It shows more than spyware and you should be VERY CAREFUL when using it or you will break things in your system. Press 'Scan' to see a list of items. Use Google to check to see which items are legitimate and which are spyware. Remove the spyware and scan to see if the items return. Make note of any that do so.
6. Re-run Spybot until it comes up clean or shows a few items that keep coming back. Again, make note of what remains. Some items can only be cleaned while in Safe Mode; if you have an infection like this and are in normal mode, reboot into safe mode (F8 at startup with any version of Windows) and scan/clean to remove, then return to normal mode.
If one item is DSO Exploit, Spybot cannot fix this and repair must be done directly in the registry. To fix the DSO Exploit, you will need Spybot's results and your registry editor (Start/Run/type in 'regedit' and click OK). Look at the information Spybot provides for the DSO Exploit. There will be registry paths listed. In the registry editor, follow the folders until you reach the matching locations. Inside will be an item called '1004'. Delete this item and then right-click in the right pane and create a new DWORD Key. Name it '1004' and give it a value of 3. Repeat this action for each listed folder.
7. Launch Internet Explorer and go to http://housecall.trendmicro.com/ Run a scan on your computer and clean or delete any found infections. Then go to http://www.pandasoftware.com/activescan/ and begin a scan. When you reach the scan settings, check off Heuristic and click on My Computer to scan your entire system. This will clean trojans from your PC that are related to the spyware.
8. Reboot the system.
9. Go to your Control Panel/Internet Options. Clear your temporary files and reset your security and privacy levels to default. Under Advanced reset to defaults, then disable Install On Demand.
9. Run Ad-aware and Spybot again until results show clean for both. You now have a clean PC.* Rejoice!
*There are a few spyware programs that cannot be removed without manual work in the system files. I don't recommend trying to clean these yourself unless you are very knowledgable. Most internet how-tos are useless with these because of the speed at which spyware mutates. In these cases, either find an expert who will clean it or reformat and reinstall.