Eliminating spyware/scumware/malware etc

[Realist]

Disable any System Restore or Goback type software that you may have running.
Turn on "Show all files" etc in Windows Explorer.
Empty all temp folders including temporary internet files.
Empty your Recycle Bin.

Ensure that your AV is up to date and run a full scan. Also run at least one of the following online scans:
Trend Housecall.
Panda Antivirus
Norton Security
McAfee Freescan
RAV Antivirus Scan


Download the hijack pack

Close all unnecessary programs, particularly any browser sessions.

Make a new folder on your hard drive and extract all of the above archives to it.

Update and run CWSHredder and fix anything that it finds. Reboot and run it again until it gives the all clear.

Now install, update and run Spybot S&D. Fix anything that it finds, reboot and run again. Repeat this until it's all clear.

Also download, install, update and run Ad-Aware.
Users may find the freely downloadable plugins very useful.

Now reboot, run HijackThis! and post your log file in a seperate and unique thread.
When posting, please turn off "Automatically parse url's" and turn on "Disable smilies in this post".



Turning on "Show all files":

Windows 95

Open My Computer.
Select the View menu and click Options.
Select the View Tab.
Select the Show all files Radio Button.
Click OK.


Windows 98

Open My Computer.
Select the View menu and click Folder Options.
Select the View Tab.
In the Hidden files section select Show all files.
Click OK.

Windows ME

Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.
Click Start, Programs and Accessories and open Windows Explorer.
Select a hard drive from the left hand side of the Windows Explorer window.
Select View the Entire contents of this drive.

Windows 2000

Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

Windows XP

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.


Turning off System Restore:
http://service1.symantec.com/SUPPOR...src=sec_doc_nam


Setting up Spybot:
http://www.geocities.com/backgammon...morespybot.html


Setting up Ad-Aware:
Click on the “gear” symbol at the top right of the main screen. This will bring up your preferences screen.

On the General tab, select all except
“Run At Windows Startup”

On the Scanning tab, select all except
“Skip Non Executable Files”
“Skip Files Larger Than….”

On the Advanced Tab, select all except
“Move Deleted Files To Recycle Bin”

On the Tweak tab, select
“Unload Recognised Processes”
“Include Basic Ad-Aware Settings In Logfile”
“Automatically Mark All Objects In Result List”
“Automatically Try To Unregister Objects Prior To Deletion”
“XP/2000: Allow Unloading Explorer To Unload Shell Extensions Prior To Deletion”
“Let Windows Remove Files In Use At Next Reboot”
“Delete Quarantined Objects After Restoring”

After setting the above, hit the “Proceed” button to return to the main screen.

Choose "Custom Scan".
Hit the “Scan Now” button on the left of the window.
Choose the drives you wish to scan (Just select your boot drive for now but scan any other read/write devices at a later time just to be certain that you’re clean)
Ensure that the “Activate In Depth Scan” button is checked

Finally, hit the “Next” button and the scan will start.

The preferences will only need to be set once.


IMPORTANT!!!

When posting HJT! logfiles, could you please ensure that the "Disable Smilies In This Post" box is checked and that the "Automatically parse URLs:" box is unchecked.


When posting logfiles, please post them in a unique thread - Please don't tag your logfiles onto the end of threads that others have started.
<!-- / message --><!-- sig -->