One of the most irritating new forms of computer problems is spyware. I’m not sure that everyone knows what spyware is, so perhaps a loose definition is a good way to start. Spyware is unwanted programs that do various bad things - two of the most common being tracking what you do and making popups. Most of the time these programs get installed without the person knowing. Either they exploit holes in IE, use ActiveX controls, or rely on the fact that most people will click “yes” whenever they see a box.
Common syptoms of spyware are tons of pop-up windows, Internet Explorer going to websites that you didn’t point it to, slow response and icons showing up places randomly and unwantedly. There are other symptoms too. Basically, if a computer is not behaving as it is supposed to, spyware could be the problem.
Cleaning off spyware is probably the thing that I do the most. I do it at work and on people’s personal computers almost daily sometimes. So I’ve developed a few tricks that I use pretty sucessfully to clean off an infected computer. A word of warning, however. There is no 100% effective way to clean off a computer. The only way to know for sure that a computer is clean is to reformat and start over.
Steps to Spyware Removal:
1) Obtain a copy of Ad Aware. This is usually my first step. Generally I just download it from download.com, but you might want to carry around a USB key with the latest version as well as the latest defintions for it in case the computer is so fouled up that you can’t get to the website. Be warned that some spyware can hijack your browser and make it look like the site you are going to is for a real version of Ad Aware but in fact is not. I tend to trust download.com. (A legal note. Ad Aware is only free for personal use, so if you are using it in a business environment, technically you are supposed to purchase the real version.)
There are other programs that you can also use if licensing issues stand in your way. Microsoft recently released a copy of their anti-spyware program which has gotten good reviews. I have had mixed results, however. One time it worked wonders, another time it caused more problems than it was worth. Keep in mind that it is in Beta. Spybot - Search and Destroy is another popular one that hasn’t been getting the best reviews, but is still out there. I’m sure there are also other programs that I have just not used so I don’t feel comfortable commenting on.
2) Boot the computer into Safe Mode. You do this by restarting and pressing the F8 key during startup. Safe Mode is a version of windows that only loads the bare minimum amount of services that Windows needs, so most spyware will not be started. (I did run into a program once that loaded itself whenever Windows Explorer, the program that handles all of the windowing and user interface, and the only way to get rid of this was to start up in command prompt mode and delete the file. That is a whole post unto itself, however.)
Once in safe mode, install Ad Aware (if you can’t install programs, you probably shouldn’t be doing any of this) and run it. It is pretty simple to run, and will take between 5 minutes and an hour depending on how fast your computer is and how many files you have. At the end it will generate a list of spyware. I usually remove it all. So far I haven’t run into anything that I wish I hadn’t removed.
If you didn’t take my advice and you ran Ad Aware in regular mode, there is a chance you will now have to reboot and run Ad Aware again, since it isn’t always able to delete everything. This is because some of the files it needs to delete are being used, since the spyware is running. Run it from Safe Mode in the first place. Everyone will be happier.
This is about as much as a novice should do. Well, a novice could also run a few other spyware removal programs, since they tend to catch some different things. The next steps are a little more advanced, and have the possibility of causing more damage.
3) Run hijackthis. Hijackthis is a program that shows you things that are hooked into the browser as well as things that start up when windows starts up. It can be obtained here. What you should do here is run it and place check marks next to anything that is suspicious. I know that this is vague, but that is the problem with spyware. There are no hard and fast rules. Some guidelines, however. Any tool bar stuff that you didn’t install should go. Anything that ends in a seemingly random number of numbers and letters followed by .exe should also go. Anything that shows up with “run” and isn’t something like antivirus or Instant Messenger or other software that you explicitly recognize should go. Basically anything that looks funny or like it shouldn’t be there, you should get rid of. Here you run a chance of causing damage, but if you are careful, it shouldn’t be too bad.
So after putting check marks next to all of the things you want to delete, press the fix button, and then unplug the computer. Do not turn it off through windows. Unplug it. Some spyware watches for the shutdown event, and will reinstall itself if you deleted it. Turn the computer back on. Boot back into Safe Mode. Go to the next step.
4) In Safe Mode (I don’t know why I capitalize that. But I started and I’m gonna keep doing it.) browse to your windows directory. On Windows 98, ME or XP this will most likely be c:windows. On Windows 2000 it is c:winnt. If it is somewhere else, then you are smart enough to know where it is. Sort this directory by date (you might have to change the view to details) and look for anything that is created in the last few days. As a general rule if there are multiple files that were created in the last few days at the same time, delete them. Again, you could be causing problems, but chances are you are going to have to reinstall windows if you can’t fix it, so you might as well try, right? Then go into the windowssystem32 directory and do the same thing. Sort by date, delete recent things, especially if they were created at the same time.
5) Go into add/remove programs. Remove any programs that look weird. Toolbars, strange media players, anything that says “ads", “rebates", “money” or things the look like programs that you didn’t install. (After a while you just get a feel for things that are bad.) There is a chance that in uninstalling them you will actually reinstall them, but I’ve found that programs that are nice enough to allow you to remove them aren’t so bad.
6) Browse to the “program files” directory. Delete any folders that correspond to anything that you’ve seen in the previous steps. If you removed a toolbar in add/remove programs, delete the folder if it was left. And if you see something weird looking, delete the folder. If it is legit, you can always reinstall. Most programs don’t keep any of your data in the “program files” directory, so you shouldn’t worry too much about deleting things from here.
Well that is about all that I can think of right now. I do have some advice to keep you from getting more Spyware. First, use Firefox. It does not have ActiveX support without special plugins. ActiveX is the #1 spyware gets installed. Major problem solved. Also, don’t go to sketchy websites. Don’t click “yes” without reading what you are clicking yes to. In fact, just click no. That is your safest bet. Don’t let teenagers on your computer. Don’t play weird online games. Buy a Mac. Don’t use computers.
I’d like to thank a few people, because I didn’t come up with this all on my own. Colin Pettus and Ken Koch both gave me ideas that I use whenever I’m cleaning. And if anyone out there has any ideas that I haven’t mentioned here, comment on them and I’ll add it to my toolbox.