Softpanorama (slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-)

Spyware Removal Using Spybot S&D

Dr. Nikolai Bezroukov

• Introduction
• Installing Spybot
• Running Spybot
• Main settings
• Autorun settings
• Expert Settings
• Running a Spybot Scan
• Additional Spybot Tools
• System Startup Menu
• Using Spybot Immunization
• Webliography
• Feedback

Introduction

Warning: This document is mainly oriented on helping home PC users. Users generally should not install this software on their corporate PC...

Spyware is usually disguised as a useful  free utility (for example for synchronizing your clocks with some atomic clocks), or as some diagnostic utility/procedure that was suggested on a pop-up screen ( directed to users who do not understand much about windows and TCP/IP ;-), but the fact has a hidden functionality:  an analysis and tracking program (which reports your activities to the advertising providers' web site for storage and analysis, the 'spyware' agent). This additional modules are installed on your system without any warning or approval when you install this Trojan software on your PC and they are often difficult to remove as they contain "deletion resistance" mechanism typical for viruses.

Even though the name may indicate so, Spyware currently is not an illegal type of software if the functionality that it contain is adequately explained in the "fine print" and there is a removal capability.  But the fact is that even if you agree to the "terms and conditions" what the adware  and Spyware providers do with the collected information and what they're going to 'feed' you with, is beyond your control. That makes it a highly undesirable activity and it should be banned from the Internet and/or your computer system. There is a huge awareness problem that needs to be dealt with as for educating users about Spyware. Right now this kind of education is usually connected with the user attempt to remove accidentally installed Spyware from your PC: after such an experience users become more conscious and usually suspicious about 'free gifts" from the Internet. 

Often this is a non-trivial takes as this king of software contains special mechanism to make remove difficult or impossible for a regular user. In a sense it hijacks the user PC.

General Procedure

The first thing you can do is to install one of thee antispyware utilities (Adaware or Spybot) and try to delete spyware using them.

If this does not help then you need to switch into investigative mode and try to understand what actually was installed on your PC.

First you need to print three list of items: 

• The list of your current registry entries (especially in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run section of the registry
   

• The list of current processes and their association with files on the disk

• The list of files installed  in your Windows directory (or WinNT directory)

Before using the ustility please print and read help pages for Spybot after the installation.

Scanning you computer with  Spybot

To scan the computer with the Spybot, double-click on the desktop icon.

First of all you need to check for updates by clicking the Search For Updates button. This will ensure that the Spyware signatures used by Spybot and the program itself are up to date. If there are any updates, click the Download Updates button and let them download and install.

• Resident tool. One of the programs you'll notice here is the Resident tool, a continuously running security program. Presently, the Resident tool section provides a browser application for Internet Explorer that prevents downloads of known malicious software, such as spyware installers. This is a very useful functionality. You should activate the Resident tool program by clicking on the Install button at the top of the screen.
• The Active X menu displays a list of Active X controls currently installed on your system. Active X controls are categorized by color. Green entries are legitimate Active X controls. Red entries mark controls related to spyware. Black entries are not known to the Spybot database.
• The BHOs tab displays information about Browser Helper Objects (BHOs). BHOs are small programs—often Active X controls—that extend Internet Explorer’s capabilities. Because they are integrated with your browser, BHOs have access to each Web site you visit. Green entries are legitimate BHOs; red entries are associated with spyware; black entries are unknown to Spybot.
  
  If you have any concerns about a BHO in this list, you can easily disable it. Click on the BHO to be disabled. At the top of the BHO window, click on the toggle button. Disabled BHOs will then appear grayed out in the BHO list.
• Browser Pages tab, Spybot also provides protection against browser-hijacking agents that can reset the start or search page in Internet Explorer. If your browser start page or search page is changed and cannot be reset through IE, the new URL will probably show up in this list.
  
  To reset the offending URL and ensure the URL is added to the next Spybot update, click on the URL your browser has been redirected to. At the top of the screen, click on the Change button and enter the new URL. Mail the offending address to detections@spybot.info, and the URL will be added to the list of known bad URLs.
• Hosts File tab. Spybot comes with its own hosts file, which contains an extensive list of Web sites known for spyware; you can view this list on the Hosts File tab. When this file is installed, no content from any of the sites in it will be displayed. To install the Spybot hosts file, click on the Hosts File tab.

  At the top of the Hosts File screen, click on Add Spybot-S&D Hosts List. The Spybot hosts file will now be used instead of your default hosts file. To remove the Spybot hosts file, click on Remove Spybot-S&D Hosts List.

  Note: Using the Spybot hosts file can cause decreased performance. Read the FAQ included with Spybot to correct these problems for your version of Windows.

The Process List tab displays all processes running on your system. Although any process may be killed (stopped) through this tab, it is intended primarily as information for technical support. To kill a process in this list, select the process and click on the Kill button at the top of the window.

• System Startup Menu The System Startup menu lists all programs that are started when Windows is launched. This menu allows the user to change the path to a Startup program or change the command used to execute the program. You can also delete any program from Startup or insert a program to be started with Windows.
  To view any item in the System Startup list, select the item and click on the Info button at the top of the System Startup screen. To disable a program run at startup, or to allow a disabled program in this list to start with Windows, select the program and click on the Toggle button at the top of the screen. To change the path to a program run at startup, or to change the command options run with the program, select the program from the System Startup list and click on the Change button at the top of the screen. it gives you the ability to add and configure new startup programs. To add a new program to the Startup list, click on the Insert button at the top of the screen. Make the program available to All Users On Startup or only to the Present User. Select how the program will be run. There are three selections available:

  • Run The Program As A Normal Program
  • Run The Program As A Service
  • Create An Autostart Group Link

Provide a name for the registry entry and select the path to the executable file. A new entry with the value you enter will be added to the list of programs run at system startup.

Using Spybot Immunization

The Spybot Immunization function is controlled through the Spybot-S&D tab. It provides four very useful functions:
 

• Permanently immunizing Internet Explorer from Spyware
• Preventing Internet Explorer from downloading known Spyware installers
• Preventing Spyware from making changes to Internet Explorer configuration
• Locking the hosts file

To provide immunity for your browser and hosts file, click on the Immunize icon under the Spybot-S&D tab. In the first configuration panel, titled Permanent Internet Explorer Immunity, click on the Immunize button to immunize Internet Explorer. The next panel is labeled Percent Running Bad Download Blocker For Internet Explorer. In the drop-down list, select Block All Bad Pages Silently. Click on Install.

In the third panel, Recommended Miscellaneous Protections, click in each of the three check boxes available to lock the hosts file and to prevent Spyware from reconfiguring Internet Explorer when immunization is activated. Spybot blocks all entries that are in its database.
 

Note:

CoolWebSearch or ‘CWS’ as many refer to it as, has become one of the leading Spyware programs that affects many home users. It has surpassed a lot of very annoying hijackers such as Lop, Xupiter and Whazit etc.  Today it has over 100 variants of this Spyware engine ( allhyperlinks.com, coolwwwsearch.com, youfindall.com, etc )!!

CoolWebSearch (CWS), can not only hijack your browser to any of its variant URL’s but has also been known to cause major Internet Explorer slow downs. This ‘trojan’ enters your computer by a ByteVerify exploit in the Microsoft JavaVM and installs it self. For more information please see the following link.

Merijn (author of popular anti Spyware program HijackThis) has made a tool to get rid of CoolWebSearch, including many of its variants.

Webliography

Tutorial - The home of Spybot-S&D!

Using Spybot - Search & Destroy to remove Spyware from Your Computer

Spybot Search & Destroy Support Procedures

AIT - Using Spybot Search & Destroy to Remove Spyware

Spybot Search & Destroy 1.3 Tutorial

Techworld.com - Automating Spybot Search & Destroy with ZENworks

SpyBot tutorial

Feedback

[Aug 24, 2005] What a great app! (Feedback for the page Spyware Removal Using Spybot S&D; slightly edited for clarity):

Thanks for recommending this freeware -  I recently cleaned my pc from a Trojan which disabled the wallpaper and gave a warning tool in the task bar telling me to buy some anti malware software. I knew this was a hack from the start and set about cleaning the registry , resetting dodgy files in SYSTEM32 to a .doc extension, etc but I was not able to clean certain items - I was not allowed to delete certain entries from the registry (in particular the RUN key) - seemed like a permissions problem. I ran recommended program in safe mode booting of XP and I cleaned everything it found and the machine seems much happier now!

What I would like to know is how you remove an item from the registry when you know its bad . I tried messing about with the permissions on the item but nothing worked.

... ... ...

Keep up the great work!

Regards

Peter

Peter,

There are several good free registry editors,  watchers. See Free Registry Tools for more information. But the first step is easy to do with regular Windows registry editor (regex.exe):

Often spyware is pretty primitive and removal of the component that is installed in

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

registry key disinfects the PC.

To do this follow the step outlines below. Be very careful working with the registry and do not delete entries just because they look suspicious. check each of them as outlined below:

1. Open your registry in regedit
   • Click "start" (bottom left of your screen)
   • Select "Run"
   • Type "regedit"  in the command line displayed
   • Click OK. 
2. In a tree that is shown select HKEY_LOCAL_MACHINE
   • then click on + sign for the key SOFTWARE
   • then click on + sign for the key Microsoft
   • then click on + sign for the key Windows
   • then click on + sign for the key CurrentVersion
   • then click on + sign for the key Run
3. Put a bookmark for the Run entry (Click Favorites, Add to Favorites and preserve the name Run that Microsoft Registry Editor suggests, so that you can gat tot he same place quickly if you need to.
4. Print all entries (File, Print).  Look for suspicious entries, that have strange names, load programs from strange locations, etc but don't take any actions on them.
5. Open Windows Explorer  Click on  Tools, Folder options , View and and Details View and
   • uncheck:
     • Hide extensions for know file types
     • Hide protected operating system files
   • check
     • Show hidden files and folders
     • Remember each folder view setting

   click apply to all folders and OK.
    

6. Find each suspicious file from the printed list of Run section and check the creation date. After that go to the listed directory find the file, left click and click on properties. Check Version section.  If Description is missing, Version is missing or this is an unknown company, then the file is suspicious.
7. For each suspicious file search Goggle. If Google search proves that this entry belongs to spyware  simply delete the key.
8. For each other file try to search Google. But be critical as for results. do not rush to delete it without additional consultation in one of the recommended in Fighting Adware/Spyware Paranoia page forums.

Last modified: February 28, 2008