Malware Removal Guide - Please Read Before Posting

**evilfantasy** · 6th Sep 2007

..
Virus Worms Trojans Spyware Backdoors trojans Parasites Exploits Rootkits Keyloggers Dialers Adware Riskware Hijackers Toolbars Pop-Ups

MALicious softWARE

Malware Removal

Working the below steps will create four logs to be included in your post:

SUPERAntiSpyware
Malwarebytes' Anti-Malware
DDS logs (DDS.txt & Attach.txt)

Save each log after each scan somewhere you can easily find them like the Desktop. Without the logs we will not know what malware is still there or how to remove it.

(---------------------------------------------- Before you start the steps ----------------------------------------------)

Remember

Important: Work the steps in order.
If you don't understand a step stop and ask!
Keep all questions/replies in the same thread.
Continue to respond until given the all clear.
Be patient: Malware removal can be just as time consuming and stressful for us as it is for you.
Remember: Just because the symptoms may be gone does not promise that all of the malware is. It is strongly suggested to continue in posting all requested logs until given the all clear. You will then receive final cleanup steps specific to your PC, links to programs and advice to help you prevent infections in the future.
Copy & Paste all logs unless otherwise requested.

If for some reason you cannot perform one of the steps, move on to the next step and make note of what happened when posting your logs.

Antivirus

Make sure your antivirus is fully up to date with the latest virus signatures before continuing.
Run a full scan and remove anything found.

If you say yes to any of the following:
- You do not have an antivirus installed.
- You have an antivirus program or Security Suite that is expired.
- You just don't like your current antivirus program and want something better.

If the answer to any of the above is yes:
- Download one free antivirus program.
- Important: Uninstall any old or outdated antivirus program(s), including Security Suites before upgrading or replacing with a new one.
- Install the new antivirus and make sure it is updated.
- Do a full system scan and remove or quarantine everything found.

AVG users only: If you still use AVG 7.5 or AVG 8.5 you should update to the new AVG 9.0 now before continuing. AVG 7.5 and AVG 8.5 are no longer supported by Grisoft so your PC is at risk!

Important: You should only have one antivirus and one firewall installed at any time. If you have two or more of either installed then uninstall all but one now before continuing.

Internet connection problems

If you are having trouble connecting to the Internet try running this WinSockFix utility to repair your connection.

Note: You may want to download WinSockFix now in case the removal process interferes with your Internet connection.

If you can connect to the Internet but are having problems accessing certain sites you may have a hijacker that has manipulated your Hosts file.

To correct this download HostsXpert

Unzip the HostsXpert file and double click on HostsXpert.exe
Press Restore Original Hosts and press OK
Exit HostsXpert.

Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.
If you do not know what a Hosts file is, you are most likely not using a custom one.

(---------------------------------------------- Malware removal steps ----------------------------------------------)

Step One

Malware in Add or Remove programs

Click on the Windows Start button and go to the Control Panel
In the Control Panel, double-click the Add or Remove Programs icon.
- Vista and Windows 7 users see here for Add/Remove Programs location.
When the Add or Remove Programs window has fully populated.
- Check for any unknown or suspicious looking programs.
- Do not uninstall anything you may be unsure of.
- Post details of unknown or suspicious programs in your post and we will advise on which to uninstall.

For a list of Malware applications that can be found in Add or Remove Programs follow this link: Uninstall Malware via Add or Remove Programs

Step Two

House cleaning

Download CCleaner Slim and save it to your Desktop.- Alternate download link
When the file has been saved, go to your Desktop and double-click on ccsetupxxx_slim.exe
Follow the prompts to install the program.

Double-click the CCleaner shortcut on the desktop to start the program.
Click on the Options block on the left, then choose Cookies.
- Under Cookies to Delete, highlight any cookies you would like to retain permanently
- Click the right arrow > to move them to the Cookies to Keep window.
Go into Options > Advanced uncheck Only delete files in Windows Temp folders older than 48 hours
Click Cleaner on the left then Run Cleaner on the right to run the program.
Important: Make sure that ALL browser windows are closed before selecting Run Cleaner

Caution: Only use the Registry feature if you are very familiar with the registry.
Always back up your registry before making any changes.
Exit CCleaner after it has completed it's process.

Step Three

SUPERAntiSpyware FREE (SAS)

If you already have SUPERAntiSpyware be sure to check for updates before scanning!

Download SUPERAntiSpyware.exe

Alternate download link 1
Alternate download link 2

Double-click the icon on your desktop to run the installer.
When asked to Update the program definitions, click Yes
If you encounter any problems while downloading the updates, manually download and unzip them from here
Next click the Preferences button.

Under Start-Up Options uncheck the following:
Start SUPERAntiSpyware when Windows starts
Show SUPERAntiSpyware icon in system tray
Show splash screen on startup

Click the Scanning Control tab.
Under Scanner Options make sure only the following are checked:

Close browsers before scanning
Scan for tracking cookies
Terminate memory threats before quarantining
Scan Alternate Data Streams
Please leave the others unchecked.
Click the Close button to leave the Control Center screen.

On the main screen click Scan your computer
On the left check the box for the drive you are scanning.
On the right choose Perform Complete Scan
Click Next to start the scan. Please be patient while it scans your computer.
After the scan is complete a summary box will appear. Click OK
Make sure everything in the white box has a check next to it, then click Next
It will quarantine what it found and if it asks if you want to reboot, click Yes
To retrieve the removal information please do the following:

After reboot, double-click the SUPERAntiSpyware icon on your desktop.
Click Preferences. Click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
It will open in your default text editor (preferably Notepad).
Save the notepad file to your desktop by clicking (in notepad) File > Save As...

Save the log somewhere you can easily find it. (normally the desktop)
Click close and close again to exit the program.
Copy and Paste the log in your post.

SUPERAntiSpyware is FREEWARE, however you may want to upgrade to the Pro version which features highly advanced real-time protection, scheduled scans, automatic updating and much more. Compare SUPERAntiSpyware Free vs Professional

Step Four

Malwarebytes' Anti-Malware (MBAM)

If you already have Malwarebytes be sure to check for updates before scanning!

Download Malwarebytes Anti-Malware.exe and save it to your desktop.

Alternate download link (.exe)

Double-click mbam-setup.exe and follow the prompts to install the program.
Be sure a checkmark is placed next to:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform Quick Scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Save it to a convenient location like the Desktop.
The log is also automatically saved and can be viewed later by clicking the Logs tab in MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Copy & Paste the log in your post.

Step Five

Updating Java

Old versions of Java have vulnerabilities that malware can use to infect your system.

First verify your Java version
If there are any other version(s) installed then update now.

Get the new version

If your version is out of date install the newest version of the Sun Java Runtime Environment

Note: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Remove old versions

Download JavaRa and unzip the file to your Desktop.
Open JavaRa.exe and choose Remove Older Versions
Once complete exit JavaRa and delete the program.
Run CCleaner.

Additional Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and reboot your computer.

Step Six

Restart

The above steps will have improved performance on the majority of computers and may have actually cleaned all of the malware.

Restart your system to see how it's working.
If you're still having problems then continue to steps Seven and Eight now.
Posting the logs is still suggested even if you think the PC is clean.
Just because the symptoms may be gone does not promise that all of the malware is. It is strongly suggested to continue in posting all requested logs until given the all clear.

If you don't plan to post the logs then be sure to check out Keeping Yourself Safe On The Web for tips and free tools to prevent future malware attacks.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

Step Seven

DDS

Download DDS from HERE or HERE and save it to your desktop.

Vista and Windows 7 users right click on dds and select Run as administrator (you will receive a UAC prompt, please allow it)

XP users Double click on dds to run it.
If your antivirus or firewall try to block DDS then please allow it to run.
When finished DDS will open two (2) logs.
Save both reports to your desktop.
The instructions here ask you to attach the Attach.txt.

1) DDS.txt
2) Attach.txt

Instead of attaching, please copy/past both logs into your Thread

Note: DDS will instruct you to post the Attach.txt log as an attachment.
Please just post it as you would any other log by copying and pasting it into the reply.

Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run.
After downloading the tool, disconnect from the internet and disable all antivirus protection.
Run the scan, enable your A/V and reconnect to the internet.
Information on A/V control HERE.Then post your DDS logs. (DDS.txt and Attach.txt )

Step Eight

Posting the logs

You are now ready to post the logs.
Just posting the logs in some instances is not enough information for us.
Give details including malware names and locations if available.
Let us know what you've already done to fix the malware (if anything).
Copy & Paste the logs directly into the thread unless specifically requested to attach them.
Keep all questions/replies in the same thread.

Logs needed

SUPERAntiSpyware log
Malwarebytes' Anti-Malware log
DDS logs (DDS.txt & Attach.txt)

Post the logs in the Virus, Spyware & Security Forum

Important!

Illegal software

Computer Juice does not support illegal activity. We do not support the use of any pirated or otherwise illegal software including Windows itself. If you install the cracked software, you are running executable files from unknown sources. You are in effect giving unknown sources access to information on your hard disk and potentially giving complete control over the operation of your computer.

We will NOT help anyone pirate anything or help to make the system work with pirated software. But if you mess up your computer in the process, we will help you fix it.
Uninstall any cracked applications before posting for help.
You may be asked to uninstall any P2P or File Sharing programs during the removal process if they are believed to be the source of the problem.
We will discontinue help if you refuse to remove any cracked (illegal) program.

Thank you for taking the time to read this. The CJ Team

.

**evilfantasy** · 4th Dec 2007

C-J Malware Removal Posting Guidelines

In order to submit the required logs you will need to be a logged into the forums with a registered account. Registration and use of the forums is free.
To register, you will need to specify a user name and password, and a valid email address.
The administrator may have configured the forum to send you the final part of the registration process by email, so ensure that the email address you provide is valid and working.
See the Computer-Juice FAQ for full details on membership.

Click here to create a free account

All advice given by anyone here, is taken at risk. While best efforts are made to assist in removing infections safely, the unexpected can happen. Computer-Juice is ultimately not responsible for any damage.
Anyone who is willing to help in removal can. But we will NOT tolerate ANY inaccurate advice given. The post will be deleted. Multiple offenses will result in a public warning within the thread or a private message. If the warnings are not taken seriously you may be subject to a temporary or permanent ban form Computer-Juice.
Members posting in help threads should only post help topics. Any post deemed as unnecessary or containing faulty information will be deleted.
Suggestions are welcome but "Drive by help" will not be tolerated. Include details. Malware removal can stretch into many hours over a few days depending on the time constraints of the OP, and the helper. If you don't know if you have the time to see the fix all of the way through, then don't even start to help!
There is always risk involved in installing and removing any software. Even a fix that over time has shown to be reliable, can present problems to a few.
Please do NOT turn off System Restore trying to remove an infection. Doing so would only serve to destroy a known working restore point and won't remove the malware. An infected restore point is better then NO restore point!
If you start topics at multiple sites for the problem you will be requested to either close out the other help thread(s), or your post with us will be locked. Malware removal can be time consuming and multiple sources of information will only confuse the process. Please don't do it.
Tell us what problem(s) you are having, and please be specific.
Do not abbreviate or use chat/text talk. If we misinterpret what is being said the results could be a damaged Operating System.
Let us know what (if anything) you've already done to fix the problem(s).
If you do not understand a step, simply ask for information. We will offer any advice necessary to help you.
Do not post a request for help in someone else's thread. This can lead to confusion, and your post will be deleted with a message to start your own thread.
Please do not pm/email logs, or fixes, all assistance is to be provided in the forums.
HijackThis doesn't scan the entire system and is only used for undetected or hard to remove entries. It is not antivirus or antispyware. Therefore we can not ensure a computer is malware free just by seeing a HijackThis log.
Please do not start more than one topic for the same computer, for the same infection. It will either be removed, or merged with your original thread.
Following advice and fixes given in other threads is risky. Your symptoms may only appear to be similar. Ignoring this warning and using someone else's fix instructions could lead to serious problems with your operating system.
Please do not attach infected files!
Please do not link to infected sites.
Copy and paste logs into your threads.
Please don't post a picture to show the problem, the logs will be enough.
If a screen shot is needed we will request one.
Do not post screen shots of error messages, type the error message out IN FULL.
If a screen shot is needed we will request one.
All posts are to be posted in the forum default black font.
Once a post is submitted please do not edit it. We would rather see a new post made mentioning the corrections. In many instances we will be reading the post while it is being edited and not know the information has changed. A new post will alert us to the changes.
At the end of a cleanup please make sure you follow through with any final log requested, and read the links provided. Even if it appears to you that your computer is back to normal operation, we would rather not see you back in a few weeks because the follow up instructions were not applied.
For rules on posting in all forums see Forum Rules! - Please Read Before Posting!

Regards C-J Staff

**evilfantasy** · 4th Dec 2007

Cleaning, regular maintenance, and updating are essential to a computers continued speedy performance

Remove unnecessary programs

Click Start > Control Panel
Click Add or Remove Programs
Scroll through the list and examine each program.
Click each program you no longer need, click the Change/Remove button, and then follow the prompts to uninstall it.

You may have to restart your computer after removing a program. After your computer restarts, repeat the steps above to remove more programs.
You may find a few Toolbars or a number of programs you have forgotten about or didn’t know were there.
If there are problems removing any programs from add/remove programs try the Windows Installer CleanUp Utility

Remove unused files from your system

Download CCleaner
It is suggested to download the CCleaner – Slim – No Toolbar which is the version without the Yahoo! Toolbar.

Double click on the ccsetup.exe file to start the installation of the program.
Select your language and click OK, then next.
Read the license agreement and click I Agree.
Click next to use the default install location.
Under Install Options, choose all the default settings
Click Install then finish to complete installation.
Double click the CCleaner shortcut on the desktop to start the program.
On the “Windows” tab, under “Internet Explorer,” uncheck “Cookies” if you do not want them deleted. (If deleted, you will likely need to reenter your passwords at all sites where a cookie is used to recognize you when you visit).
If you use either the Firefox or Mozilla browsers, the box to uncheck for “Cookies” is on the Applications tab, under Firefox/Mozilla.
Click on the “Options” icon at the left side of the window, then click on “Advanced.”
deselect “Only delete files in Windows Temp folders older than 48 hours.”
Caution: It is not recommended that you use the “Registry” feature unless you are very familiar with the registry as it has been known to find legitimate items.
Click on the “Cleaner” icon on the left side of the window, then click Run Cleaner to run the program.
After CCleaner has completed its process, click Exit.
- Note: Run CCleaner on each user account

CCleaner Tour: After Installation A common myth that will not improve performance is cleaning the Prefetch folder. Please see: Don’t clean out the Prefetch folder.

Defragment the Hard Drive

Over the course of regular PC use, your files get fragmented and spread out all over the hard drive.
Reading and writing data on a heavily fragmented hard drive is slowed down because the time for the heads to move between fragments on the disk surface can be substantial.
See: The Importance of Disk Defragmentation for detailed instructions.
In addition to running the Disk Defragmenter at regular intervals, monthly is optimal, there are other times you should run it too, such as when:

You add a large number of files.
Your free disk space totals 15 percent or less.
You install new programs or a new version of Windows

Microsofts built in Disk Defragment utility, does as good a job as any, but is known to be slow.
Here are free alternatives that do the same job in a much quicker time.

Auslogics Disk Defrag
Defraggler
Diskeeper Lite – Works with Win98
Iobit SmartDefrag
JkDefrag

For defragmenting your pagefile and registry hives use PageDefrag
Note: It is recommended to shut down all applications including your antivirus before running a disk defrag to avoid the process from continually starting over.
For the best results it should be run from safe mode

Defragment the Registry

As a speed tweak defragmenting the Registry is probably not ever going to show an improvement in performance. But over time it can become very large and should occasionally be defragmented.
You can compact and defrag the registry with Auslogics Registry Defrag

Vista and Internet Explorer 7

The Phishing Filter could be causing your computer to respond very slowly as it evaluates Web page contents.
See The Phishing Filter may slow down the PC and Phishing Filter FAQs

Detect and repair disk errors

CHKDSK is best to be ran in SAFE MODE.

Vista & Windows 7

Click Start, and then click Computer.
Right-click the volume you want to check, and then click Properties.
Click the Tools tab, and then click Check Now.
Do one of the following:

To run CHKDSK in read-only mode, clear all check boxes, and then click Start.
- To repair errors without scanning the volume for bad sectors, select the Automatically Fix File System Errors check box, and then click Start.
  - To repair errors, locate bad sectors, and recover readable information, select both the
  - Automatically Fix File System Errors
  - and Scan For And Attempt Recovery Of Bad Sectors check boxes.
  - Then click Start.

Windows XP and 2000 – Click Start > Run > type CHKDSK and click OK.
Windows 98 or Me – Click Start > Programs > Accessories > System Tools > ScanDisk.

Check for damaged, altered or missing critical system files

The System File Checker (SFC) searches for protected files that have been damaged, altered or are missing. It restores the correct version of the file from the cache folder.

You must be logged on as an administrator or as a member of the Administrators group to run sfc.
You may be asked to insert your XP Installation CD so have it available.

Win 98 Using System File Checker
XP Using the System File Checker Tool
How to automatically repair Windows Vista using Startup Repair

Manage autostart items

A huge culprit of computers loading and running slow is what is running in the background

CCleaner also has a startup manager.
Open CCleaner click Tools then Startup
You can delete any unneeded items from there.
Be careful, there is no backup.
Because the startup loads drivers and some programs you may need, be careful removing items you are unsure of.
You can either look up the program on Google or ask in our Support Forums what an item is for.
For quick reference use these online databases.

StartupList Index
Startup Programs Database

Some things to look for.
You will still be able to use these programs, you just have to launch them manually.
QuickTime Task
Musicmatch Jukebox
iTunesHelper
TkBellExe – RealPlayer Update
ISUSScheduler or ISUSPM Startup – InstallShield Updater Service
DVDLauncher – CyberLink PowerDVD
Adobe Reader Speed Launcher
Google Updater
StartUp Tool is an easy to use start-up items editor, which allows you to identify, add, edit, remove or disable start-up items using an intuitive graphical user interface.
MalwareBytes StartUpLite is a lightweight program that can disable or remove all known unnecessary startup entries from your computer and thus quicken the startup procedure of your system.
Startup Delayer allows you to setup how many seconds after Windows has started, to load each program.
Note: MSconfig should not be used as a startup manager. It is meant to be used for trouble shooting only. For more information see: How to deal with startup processes – Do not use MSconfig

Disable unnecessary Services to free System Resources

Services are programs that run when the computer starts up and continue to run as they aid the operating system in functionality.
There are many services that load and are not needed which take up memory space and CPU time.
Disabling these services will free up system resources which will speed up your overall computer experience.
It is recommend that you sort through the list and read the descriptions to decide if you need that service depending on what you want to do with your computer.

Remember, you can always turn the service back on if you find that you need it in the future.

Below is the procedure to turn off a service.

Click the Start button.
Select Run from the bottom of the right column.
Type services.msc in the box and click OK.
Once the services window has loaded you are ready to turn off unneeded services.
Find this service you wish to disable in the list and select it with the mouse.
Right click and select Properties.
Once the properties windows has loaded locate the Start up type drop down box and select Disable.
Then click OK and the next time the computer starts the service will not be loaded.

Remember to only remove unessential services or you risk experiencing boot problems.
Search Google for information on unknown services or ask in our Support Forums and we will help.
- Another good resource is Black Viper’s XP Services Configuration and Vista Services Configuration pages.

Disable some visual effects

While visual enhancements may be attractive, they can slow a computer down. Disabling some of them will free up system resources and makes the operating system perform better.

Right click My Computer, choose > Properties > Advanced, click on Settings
In the Visual Effects tab, select Adjust for best performance or uncheck all the visual effects, except for the last three.
Click Apply, then OK, then OK again.
Then right click your Desktop and choose > Properties > Appearance > “Effects.
Uncheck the first two boxes and click OK.

Update! Update! Update!

Many people do not like automatic updates. If this is the case get in the habit of frequently checking the Microsoft website for critical security updates.
Go to http://windowsupdate.microsoft.com and install ALL critical security updates.
Protect Your Computer – Microsoft Update – Microsoft Security
Secuna Software Inspector is an extremely useful tool which is strongly recommend to use at least once a month.

Clean the dust out

Always turn your computer off before you begin and unplug all power cords
Heat is the biggest cause of component failure in computers.
Dust clogs the vents behind your computer, which causes your CPU to overheat and cause faulty processor fans which can result in unexpected shutdowns, random restarts, booting problems, etc.
Regular cleaning could save you costly maintenance fees down the road.

Remove the cover touching as little as possible inside the computer and take a moist towel and wipe any dust from the interior of the cover.
Blow compressed air around all of the components and along the bottom of the case, keeping the nozzle four inches away from the machine.
Blow air into the power supply box and into the fan (from the back of the case).
Blow air into the floppy disk and CD drives.

Last, check that your connections are secure.
Cleaning the Interior of your PC
Curing Laptop Overheating

Create a Restore Point

When you are all done be sure to Create a new Restore Point to ensure you keep all the changes you just made

You must be logged on to an administrator account.

Go to Start
All Programs
Accessories
System Tools
System Restore

Choose the radio button marked Create a Restore Point on the first screen then click Next.
Give the new Restore Point a name, then click Create. The new Restore Point will be stamped with the current date and time.

You may want to keep a log of this so you can find it easily should you need to use System Restore.

Then use Disk Cleanup to remove all but newly created Restore Point.

Go to Start > Run and type: Cleanmgr
Click OK.
Click the More Options tab.
Click Clean Up in the System Restore section to remove all previous restore points except the newly created one.

Vista Users please see these links. Create a New Restore Point and Guide to Vista Disk Cleanup

More suggestions and performance tips

Restore Your Computer’s Performance with Windows XP
XP Performance Tweaks
Performance Boost for XP
How to fix the top 10 Internet Explorer issues Rust Never Sleeps: How To Deal With Moisture And Corrosion In Your PC

Add more RAM

This is a quick solution that can have a dramatic affect on your system’s speed and responsiveness.
You can check how much RAM you have.
Right click My Computer
Choose Properties > General tab.
If you have 512MB
Pay attention to what software you install.
Every computer needs Security software installed (Antivirus+Firewall) and they should start up with Windows and run in the background.
If you have 512MB or less choose an Antivirus and Firewall that doesn’t require that much memory and processing time.
Don’t install “heavy” Security Suites like Norton, Panda, McAfee, TrendMicro…
Understanding, Identifying and Upgrading the RAM in your PC

PC Pitstop

Is your PC acting sluggish?
Do you have to reboot your computer because of errors and lockups?
Stop by PC Pitstop for a free computer checkup and diagnostics that can help you detect and fix many common computer problems.

**evilfantasy** · 16th Jan 2008

.
Step 1: Download Ad-Aware Free

Download Ad-Aware Free from Lavasoft at the following link: Lavasoft Ad-Aware Free

Double-click on the installation file and a guide screen should start.
Follow the prompts to install the software and when it asks if you would like to do a Standard or Advanced Installation, select the Standard
Continue following the prompts until the program has finished installing.

Ad-Aware should open upon completion of installation.
If not then double-click the Ad-Aware Icon from the desktop.

Step 2: Running Ad-Aware Free

When the program starts for the first time, it will prompt you to enter your registration information. We are using the free version of Ad-Aware 2007 so simply press the Cancel button.

Ad-Aware Free will now open and you will be at a screen similar to the one below.

Figure 1

Step 3: Updating Ad-aware

Click on the Update button (Figure 1).
Ad-Awa will now check for new malware definitions and program updates.
If an update or program update is found you will see a prompt, click on the Yes button and let it download the update.
Now click on the OK button to go back to the Ad-Aware status screen.

Step 4: Configure the scan settings

Click on the Settings tab (see Figure 1) in the left navigation bar.
Next click on the Scanning tab (Figure 2) to see the scan options.

Figure 2

Under the Scanning tab (Figure 2) please do the following.

Put checkmarks next to the following settings:

Unload malicious processes and modules
Remove malicious LSPs
Scan Alternate Data Streams (ADS)
Scan Tracking Cookies
Scan for MRUs
Deep Archive Scan
Unload Modules
Unload browsers while scanning
Let Windows remove files at startup
Deactivate Ad-watch
Re-analyze scan result

We also suggest you set the Ignore infection with TAI lower than: to 3.
When done click the Save button (Figure 2) to save the settings.

Step 5: Scan the computer

Figure 3

To begin the scan you should click on the Scan tab (Figure 2) in the left navigation bar.
This will bring you to a screen where you can select the type of scan you would like to perform.
You should select the Full Scan option (Figure 3) and then press the Scan button (Figure 3) found in the lower right hand corner of the screen.
Ad-Aware will now scan your computer for malware.

Step 6: Scan Results

Select items to remove or quarantine
Put a checkmark in the box next to each item or right-click on the screen and click the Select All Objects option.
When all the items are selected, you should click on the Remove or Quarantine button (Figure 4) depending on the action you would like to take.
- Either Remove or Quarantine ALL items.
- Taking no action is pointless and the scan will just need to be ran again.
Note: You should then click on the Privacy Objects tab in the scan results and remove all the items that are considered privacy risks.
You can not add privacy risk items to the quarantine, you can only remove them. Select the items and when you are finished selecting them, click on the Remove button.

Figure 4

When you are done with this process, click on the Finish button (Figure 4) to go to the Scan Summary screen which contains an overview of the infections found and what action you performed on them.

Optional: How to remove the Ad-Aware Service

Note: Ad-Aware2008 (or any other year) users. Substitute Ad-Aware2008.exe where this guide says Ad-Aware2007.exe.

To disable the unnecessary Ad-Aware Service from running follow this procedure.

To stop Ad-Aware running as a Service.

Go Start > Run. type in:
- services.msc
- Find the Ad-Aware Service and set it to Manual
Go to Start > Run type in:
- Notepad.exe and press Enter
Copy and paste the below quoted text into Notepad:

@ECHO OFF
Ad-Aware2007.exe
sc stop aawservice
@echo Done

In Notepad go to File > Save As...
Name it start_adaware.bat <<Be sure it is saved as a Text file
Choose the save location as
- C:\Program Files\Lavasoft\Ad-Aware 2007
Double click the start_adaware.bat file to run it.
- It should look like this
Ad-Aware will open, close it.
Ad-Aware will no longer run as a Service.

Although this has never caused a problem on hundreds of computers the unexpected can happen.
Take care in working this procedure carefully.
We are not responsible for mistakes.
.

**evilfantasy** · 16th Jan 2008

.
Download Spybot-S&D

Double click on the downloaded file to run the installation.

During installation:

Leave all settings at default except TeaTimer (make sure you uncheck the option during installation)
Teatimer can be a resource hog and also block the removal of some problems malware.
- If you already have TeaTimer enabled, see the bottom of this post on how to disable it.
Do the recommended registry backup.
During the install agree to search for updates now to install any updates.
Agree to Immunize the system.
Make sure you leave the SDhelper (IE bad download blocker) checked to install.

After installation:

Always check for updated before running a scan.
If you get the bad checksum error when trying to update, just choose a different server location.
Also look for the Immunize feature in Spybot and use it.
- First, in the left column click on the Immunize icon and it will check to see what needs to be immunize.
- After it completes, leave the default settings and click on the green plus sign at the top that says Immunize.
Close ALLbrowser windows.
Now click the Search & Destroy icon. (upper left)
Then on the top menu click the Check for problems button to start the scan.
- Be patient, this can take a while to run.
- Progress will be shown in the status bar at the bottom of the window.
- Do not run any other scans while Spybot is running.
When the scan completes make sure you select everything and then click Fix selected problems on the top menu bar.

NOTE: Anytime you install updates for Spybot, check for new Immunizations by following the above steps.

How to disable Spybots' TeaTimer

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent our tools from fixing certain things.

Please disable TeaTimer until your computer is clean.
TeaTimer can be re-activated once your logs are clean.

First:

Right click Spybot in the System Tray (looks like a calendar with a padlock symbol)
Choose Exit Spybot S&D Resident

Second:

Open Spybot S&D
Click Mode, check Advanced Mode
Go To Left Panel, Click Tools, then also in left panel, click Resident
If your firewall raises a question, say OK
Uncheck the box labeled Resident TeaTimer and OK any prompts.
Use File, Exit to terminate Spybot
Reboot your machine for the changes to take effect.

Third:

With both Tea timer and SpyBot closed.
Download ResetTeaTimer.zip

Unzip the file.
Double click ResetTeaTimer.bat to remove all entries set by SpyBot's TeaTimer.
Once finished running, you can delete it. It will not be needed again.

Note: If TeaTimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.

**evilfantasy** · 21st Jan 2008

Using add/remove programs does a good job of uninstalling programs. Only it does not completely remove all traces of what it uninstalls. There are often empty folders as well as empty Registry Keys.

Revo Uninstaller doesn't just uninstall programs from your computer it completely removes all traces. Not only from the programs file folders but also from the Registry. Leaving much less clutter then most programs built in uninstaller alone can.

Download Revo Uninstaller
Double click the installation file on the desktop to run the installer.
Let it install to the default location.

You should now have a new Icon on the Desktop.

Double click the new Revo Uninstaller Icon on the desktop to start the program.

You will now see a list of installed programs that Revo Uninstaller can remove.

Locate the program you are uninstalling and Right Click the Icon then choose Uninstall.

Click yes to the warning and choose the Uninstall Mode.

Choose the Advanced option and then click Next.

This will launch the programs built in uninstaller. Be patient it can take several seconds.

Once the uninstaller is done click Next.

Revo Uninstaller will now scan for leftover information. Be patient it can take several seconds.

Once this scan is done click Next.

You will then be presented of the leftover entries found by Revo Uninstaller.

Look at ALL of the entries to ensure they relate to the uninstall.

Next click Select All > Delete to remove the entries.

Click Next.

If there are any program file folders left over you will be presented with a list to be removed.

Again look at ALL of the entries to ensure they are related to the uninstall.
Click Select All > Delete to remove the entries.
Click Finish to go back to the uninstall list.

You are now ready start completely uninstalling programs from your computer.

There are also more advanced features in Revo Uninstaller such as the Hunter Mode, Autorun Manager, Windows Tools and Junk Files Cleaner.

Read more about them at the VS Revo Group Uninstaller Help Pages

**evilfantasy** · 4th Mar 2008

Download the Unlocker Installer and save it to the Desktop.

Double click the installer to begin the installation process.

Choose the language and click OK

From the following screens keep choosing Next until you reach the following screen to Choose Components

Make sure there is a check mark next to each of the Unlocker components as shown below.

Note: The new version of Unlocker 1.8.6 has an eBay check box that must be unchecked unless you want the eBay shortcut added to your Desktop.

Now choose Install then Finish to complete the installation.

Now that the program has been installed, Unlocker will have added a autorun entry to your registry to start the Unlocker Assistant when Windows starts. This background program stays resident and detects when you try to delete, copy, rename, or move a file that is in use.

When it detects one of these operations, it will automatically open up a Window in order to assist you in working with the file.

Example

With Unlocker installed, when you press the OK button to exit the error, the Unlocker Assistant will automatically launch to help you delete the file.

From the Dropdown Menu select Delete and then click OK

What this does is delete the open file handles and then attempts to delete the file.

If Unlocker still has problems deleting the file after closing its file handles, it will ask you if you want to delete the file on reboot as shown below.

Choose Yes and restart the computer to complete the process.

Unlocker is useful with the following errors:

Cannot delete file: Access is denied
There has been a sharing violation.
The source or destination file may be in use.
The file is in use by another program or user.
Make sure the disk is not full or write-protected and that the file is not currently in use.

Thread Tools

Random Album Pictures

Posting Permissions