[Sandhu]

If you're having problems with your PC and think you have have managed to get infected, follow this guide on how to get rid of them. If you've got any questions don't hesitate to ask them here.

Sandhu's Malware Removal Guide

This process can take about 2 hours, but it is very effective. It doesn't have to be done all at once.

Step 1

• Go Start > Control Panel.
• Double-click Internet Options.
• Under Temporary Internet Files, click the Settings button.
• Click the View Files button.
• Press CTRL+A to select all files.
• Press DEL or click the Delete option at the top of the window.
• Click the Yes button on the dialogue box that appears.
• After all the files are gone, close the window.
• Click OK two times.
• Close Control Panel.

And.....

ATF-Cleaner

Please download ATF Cleaner by Atribune from here. Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Step 2

Install Ad-Aware and scan your computer

http://www.lavasoft.com/software/adaware/

- Download the Ad-Aware installation file from this link
- Run the installer and install with default options
- Start the program, if you are asked if you wish to update the definitions file, then say yes, and go ahead with the update
- If you are not asked, press Check for updates now and update the definitions file
- Next, press the Start, choose Perform full system scan, de-select Search for negligible risk entries, and check Search for low-risk threats is selected, then press Next
- When the scan is complete, press Next and select the Critical Objects tab, right-click inside the window and choose Select All Objects, then select next, and confirm the removal.
- Close Ad-Aware

Step 3

Install and configure AVG Anti-Spyware

Click here to download it

This is the one you want:

• Install AVG Anti Spyware
• Double-click the icon on Desktop to launch AVG
• On the main Status screen, under Your Computer's Security, click Resident Shield
• Click the word active to change it to inactive
• On the top of the main screen click Update.
• Then click on Start Update. The update will start and a progress bar will show the updates being installed.
• Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
• Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
• Under "Reports"
• Select "Do Not Automatically generate report after every scan"

When you have finished updating, run a scan:

Run AVG Anti-Spyware with it's updated definitions...it's important that all windows must be closed.

• Click Scanner
• Click on the Scan tab
• Click Complete System Scan to begin scanning.
  Once the scan is complete do the following:
• f you have any infections you will prompted, then select "Apply all actions"
  Now it's finished, click the Save report button, then click Save Report As and save it to your desktop. Make sure to remember where you saved that file, this is important.

Now Close AVG Anti-Spyware.

Step 4

Install Spybot S&D and scan your computer

http://www.safer-networking.org/en/mirrors/index.html

• Download the Spybot S&D installation file from this link
• Run the installer and install with default options
• Start the program, select Search for Updates
• A list of updates should appear, right-click the list and select Select All, then click Download Updates near the top
• Next, click Search & Destroy from the toolbar on the left side, and then click Check for problems from the top
• When the scan is complete, place a check mark in the box next to all entries marked in red, and press Fix selected problems
• Close Spybot S&D

Step 5

Now I would like you to run an online scan, from here http://www.trendmicro.com/hc_intro/default.asp

1. Once up click on "Scan now. It's Free"
2. Read the Term & Use and check "Yes, I accept the Terms of Use" and then click on "Launching HouseCall"
3. Quick Select: "Scan complete computer for Malware, grayware and vulnerabilities" click "Next"
4. Let Housecall go through ALL three "Steps". It can take upto 30 minutes or more to scan.
5. Please do not use your computer whilst the scan is in progress.
6. Once the scan is done select "clean all detected infections automatically"
7. For detected HTTP cookies, select "Remove all deteccted cookies". And click "Clean Now"
8. Then a message will come up; click "OK" and let it delete the selected infections.
9. During the clean up. Note any infected files down into a .txt file in Notepad. Ready to post in your next reply.
10. When asked to perforn a full scan again click "No". And restart your computer.

Step 6

ComboFix

1. Download ComboFix by sUB combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

Step 7

Open your add/remove programs tab and remove any of the following programs if you find them listed. These are all Malware (spyware/adware) entrys that may appear in the add/remove programs tab so IF you find the entry uninstall the program.

180 Search Assistant
180Solutions
Active alert
Ad Service
AdTools
AdTools Service
Alexa toolbar
BargainBuddy
Bullseye Networks
CashBack
cosmi
DH
EasySearchBar
Elite Sidebar
Elite Toolbar
Freeze Clip Art
GAIN
Gator
Hotbar Outlook Tools
Hotbar Web Tools
HuntBar
Internet Optimizer
ISTbar
ISTSvc
MaxiFiles
Media Access
Media Gateway
MySearch
MyWay Search Bar
MyWebSearch
NavExcel Search Toolbar
NavHelper
ncase
Oemji Toolbar
Open Site
Preview AdService
Search Toolbar (HuntBar/WinTools)
ShopperReports by Hotbar
Sidefind
SideSearch
Slotchbar
Software Update Manager
SurfAccuracy
SurfSideKick
Upspiral Toolbar
TurboDownload
VBouncer
Viewpoint
Viewpoint Manager
Viewpoint Media Player
WareOut
WeatherBug
Web Rebates
Web Search Toolbar (WinTools)
Webhancer
WhenU (any entry)
WeirdOnTheWeb
Windows AdService
Windows AdStatus
Windows ServeAd
WinTools
WinTools Easy Installer
WSEM Update

These are Optional removals but I recommend you remove them as well.

Download Accelerator Plus
Kazaa
Kontiki
Messenger Plus
NetPumper
NewDotNet
P2P Networking
StarWare
WildTangent

Step 8

Optional step.

Visit http://windowsupdate.microsoft.com/

Check for updates & install all updates found.

Finish!

If you have problems after this, its either: a)Not malware b)Very persistent malware that needs to be removed manually. If this is the case, start a thread in the technology forum, you'll be helped there.

Note

If you have any suggestions for me to add, PM me. All of the tools here have been checked and tested by me and others. This guide was made using techniques developed by technical helpers throughout the internet, so thanks go out to them.

[Gary10k]

Really good thread, only thing i would say is that i find Webroot Spysweeper the best programme for spyware/adaware removal. But just imo

[Guvnor]

Very good post, I use most of them already anyway

[Sandhu]

Gary, that's software you have to pay for. Eveything in that guide is meant to be free.

Thanks, both of you.

[Guvnor]

Any of you guys heard of a software called: Advanced windows care v2 personal and Glary Utilities ? they both are free and are known to speed up your pc, I currently use both of them myself.

[Sandhu]

Nope. Those things don't really do much apart from apply a few tweaks, which you can easily find on Google if you're bothered.

[Gary10k]

Originally Posted by S a n d h u

Gary, that's software you have to pay for. Eveything in that guide is meant to be free.

Thanks, both of you.

Ah, i do pay for it. But it used to come with a free 30 day trial which was awsome for a quick clear up. Dont know if its still there.

Also you should add a big bold red statement saying "DONT BUY/INSTALL OR TRAIL NORTON ANTI-VIRUS" just incase anyone thinks about it

[Kater Murr]

Woah, big words. Why don't they just make a button?

[Sandhu]

Originally Posted by Gary10k

Ah, i do pay for it. But it used to come with a free 30 day trial which was awsome for a quick clear up. Dont know if its still there.

Also you should add a big bold red statement saying "DONT BUY/INSTALL OR TRAIL NORTON ANTI-VIRUS" just incase anyone thinks about it

Aye, it still does. ;yes;

And @ the next bit. I agree, 100%.

[Planto]

Another excellent program (though I'd recommend not using it if you're totally IT illiterate):

HijackThis:

This program scans everything that's attempting to access the internet and allows you to select and delete them at will. Because, unlike Spybot or AdAware, you don't need to be online to update and install it (just grab it from another PC and install it from a CD or USB drive), it's brilliant for killing adware that's restricting your internet access (things that redirect your browser, for example).

I use it a lot at work (I work as an IT Help Assistant) when people are trying to connect to the internet but are being thwarted by spy/adware. I'll run HijackThis to kill anything restricting internet access, then download and run Spybot/Adaware. It's also good if you've run Spybot and Adaware but feel you still have infections; simply run a Hijackthis scan and look for anything that doesn't look like it ought to be there. Particulary effective for getting rid of things like mywebsearch and its variants.

http://www.download.com/Trend-Micro-...-10227353.html

[annab1684]

We've had norton anti-virus since forever and never had any viruses. . what's wrong with it?

[Sandhu]

Thanks, Planto.

Originally Posted by annab1684

We've had norton anti-virus since forever and never had any viruses. . what's wrong with it?

If it works for you, that's fine.

[kates:)]

Might sound really daft but how do you know if you have a virus?
:s

[Sandhu]

Originally Posted by kates:)

Might sound really daft but how do you know if you have a virus?
:s

From google:

Symptoms of a computer virus
If you suspect or confirm that your computer is infected with a computer virus, obtain the current antivirus software. The following are some primary indicators that a computer may be infected:
• The computer runs slower than usual.
• The computer stops responding, or it locks up frequently.
• The computer crashes, and then it restarts every few minutes.
• The computer restarts on its own. Additionally, the computer does not run as usual.
• Applications on the computer do not work correctly.
• Disks or disk drives are inaccessible.
• You cannot print items correctly.
• You see unusual error messages.
• You see distorted menus and dialog boxes.
• There is a double extension on an attachment that you recently opened, such as a .jpg, .vbs, .gif, or .exe. extension.
• An antivirus program is disabled for no reason. Additionally, the antivirus program cannot be restarted.
• An antivirus program cannot be installed on the computer, or the antivirus program will not run.
• New icons appear on the desktop that you did not put there, or the icons are not associated with any recently installed programs.
• Strange sounds or music plays from the speakers unexpectedly.
• A program disappears from the computer even though you did not intentionally remove the program.

Edit: Cheers for the rep & nice comment, Planto.

[Pyrrho101]

Originally Posted by annab1684

We've had norton anti-virus since forever and never had any viruses. . what's wrong with it?

Your computer would almost definitely run smoother with an alternative!

[CommunistHamster]

I dispute the inclusion of Messenger Plus in that list. It doesn't install adware unless you select "Install the sponsor program" in the installer.

Apart from that, great list Hopefully it'll combat the sudden increase in MSN viruses.

[Sandhu]

Cheers.

And yeah, that's true about MSN Plus, but I think if people don't know about the sponsor it's the for the best.

[AT82]

Originally Posted by S a n d h u

From google:

Symptoms of a computer virus
If you suspect or confirm that your computer is infected with a computer virus, obtain the current antivirus software. The following are some primary indicators that a computer may be infected:
• The computer runs slower than usual.
• The computer stops responding, or it locks up frequently.
• The computer crashes, and then it restarts every few minutes.
• The computer restarts on its own. Additionally, the computer does not run as usual.
• Applications on the computer do not work correctly.
• Disks or disk drives are inaccessible.
• You cannot print items correctly.
• You see unusual error messages.
• You see distorted menus and dialog boxes.
• There is a double extension on an attachment that you recently opened, such as a .jpg, .vbs, .gif, or .exe. extension.
• An antivirus program is disabled for no reason. Additionally, the antivirus program cannot be restarted.
• An antivirus program cannot be installed on the computer, or the antivirus program will not run.
• New icons appear on the desktop that you did not put there, or the icons are not associated with any recently installed programs.
• Strange sounds or music plays from the speakers unexpectedly.
• A program disappears from the computer even though you did not intentionally remove the program.

Edit: Cheers for the rep & nice comment, Planto.

But 95% when you have a lot of them symptoms it is not a virus!

[Sandhu]

Originally Posted by AT82

But 95% when you have a lot of them symptoms it is not a virus!

Ah huh, it's from the Microsoft website

It's always a good idea to check for viruses if there's suspicious behaviour, though.

[Rizzletastic]

I would reccomend AVG a lot, it is better than norton and mcafee