Softpanorama (slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-) Softpanorama Search

Spyware Removal Guidelines

Dr. Nikolai Bezroukov

• Introduction
• Installing Spybot
• Running Spybot
• Main settings
• Autorun settings
• Expert Settings
• Running a Spybot Scan
• Additional Spybot Tools
• System Startup Menu
• Using Spybot Immunization
• Webliography
• Feedback

Introduction

Warning: This document is mainly oriented on helping home PC users. Users generally should not install this software on their corporate PC...

Spyware is usually infects the computer when you browed infected or rogue sites. You can also get it via email disguised as a useful  free utility and picturesque presentation of Paris, London, Moscow, etc. Even more nasty cases are when spyware distributors run fake antivirus utility or some rogue site pretends to be a spyware fighting site and offer infected downloads.  As they often want money for disinfecting from the spyware they infected you with, this is as close to extortion as one can get.

Sometimes fake disinfection or diagnostic utility/procedure (you TCP connection is running slow, click to fix this problem) that was suggested on a pop-up screen in reality is a spyware that infects your computer. This trick is directed to users who do not understand much about windows and TCP/IP.  any program that  has a hidden functionality is a spyware. Often those programs are tracking program (which reports your activities to the advertising providers' web site for storage and analysis, the 'spyware' agent) or "advertizements substitution programs, which replace legitimate advertizements in web page with thier own, siphing advertizinf revenue to specific sites.

Not only those additional modules are installed on your system without any warning or approval they are often designed in such a way as to be difficult to detect and remove. They often contain "deletion resistance" mechanism typical for viruses.

Even though the name may indicate so, spyware currently is not an illegal type of software if the functionality that it contain is adequately explained in the "fine print" and there is a removal capability.  But the fact is that even if you agree to the "terms and conditions" what the adware  and Spyware providers do with the collected information and what they're going to 'feed' you with, is beyond your control. That makes it a highly undesirable activity and it should be banned from the Internet and/or your computer system. There is a huge awareness problem that needs to be dealt with as for educating users about Spyware. Right now this kind of education is usually connected with the user attempt to remove accidentally installed Spyware from your PC: after such an experience users become more conscious and usually suspicious about 'free gifts" from the Internet. 

Often this is a non-trivial takes as this kind of software contains special mechanism to make remove difficult or impossible for a regular user. In a sense it hijacks the user PC.

As with anything, an ounce of prevention is worse pound of cure: using non-standard browser for example Opera, using disposable virtual machine or "public PC" mode in Windows.

In IE in private browsing, setting cache deletion after each session and checking   Tools/Managed add-ons are also useful precautions.

More general procedure includes baselining you Windows directory, sensitive parts of the registry and list of  process just after booting before you open any application.

General Procedure

The first thing you can do is to install several useful antispyware utilities to detect what kind of infection you have, so that you can browse Google or Bing to find the best way to disinfect it.  You can just run Adaware and Spybot S&D on you PC and see what they will say. That does not mean that they necessarily will be able to disinfect you PC.

If this does not help then you need to switch into investigative mode and try to understand what  new components were recently installed on your PC.  In this case having full backup of you C drive is the most useful service for yourself you can imagine (and if you get tired playing the role of computer Sherlock Holmes you can just restore the image from Ghost of Acronis backup).

First you need to print five lists about your computer: 

1. The list of your current registry entries  in several parts of registry (starting with  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run section of the registry (using HijackThis)

2. The list of current processes and their association with files on the disk  Using free Process Explorer or other free Windows Process Viewers

3. The list of files installed  in your Windows directory (or WinNT directory).

4. Your currently opened network connections using netstat, or more specialized utility, like Microsoft Network Monitor 3.3. Version 3.3. has a new feature called ‘Process Tracking’ which helps to identify any scamp applications sending network data.  You can also view all the network traffic generated processes on your machine and view the frames associated with each process by using the conversation tree.

5. The list of processed that use Svchost, using, for example, free Svchost Process Analyzer 1.0

The simplest and most popular baseline utility is HijackThis.  After you create baseline you usually will find suspicious entries. Check them with Google and you will find some additional information.  Create a HijackThis log and post it on one of the Webforums that help with such problems, for example Web User Forums. The map looks like this.

Before using the utility please print and read help pages for Spybot after the installation.

Scanning you computer with  Spybot

To scan the computer with the Spybot, double-click on the desktop icon.

First of all you need to check for updates by clicking the Search For Updates button. This will ensure that the Spyware signatures used by Spybot and the program itself are up to date. If there are any updates, click the Download Updates button and let them download and install.

• Resident tool. One of the programs you'll notice here is the Resident tool, a continuously running security program. Presently, the Resident tool section provides a browser application for Internet Explorer that prevents downloads of known malicious software, such as spyware installers. This is a very useful functionality. You should activate the Resident tool program by clicking on the Install button at the top of the screen.
• The Active X menu displays a list of Active X controls currently installed on your system. Active X controls are categorized by color. Green entries are legitimate Active X controls. Red entries mark controls related to spyware. Black entries are not known to the Spybot database.
• The BHOs tab displays information about Browser Helper Objects (BHOs). BHOs are small programs—often Active X controls—that extend Internet Explorer’s capabilities. Because they are integrated with your browser, BHOs have access to each Web site you visit. Green entries are legitimate BHOs; red entries are associated with spyware; black entries are unknown to Spybot.
  
  If you have any concerns about a BHO in this list, you can easily disable it. Click on the BHO to be disabled. At the top of the BHO window, click on the toggle button. Disabled BHOs will then appear grayed out in the BHO list.
• Browser Pages tab, Spybot also provides protection against browser-hijacking agents that can reset the start or search page in Internet Explorer. If your browser start page or search page is changed and cannot be reset through IE, the new URL will probably show up in this list.
  
  To reset the offending URL and ensure the URL is added to the next Spybot update, click on the URL your browser has been redirected to. At the top of the screen, click on the Change button and enter the new URL. Mail the offending address to detections@spybot.info, and the URL will be added to the list of known bad URLs.
• Hosts File tab. Spybot comes with its own hosts file, which contains an extensive list of Web sites known for spyware; you can view this list on the Hosts File tab. When this file is installed, no content from any of the sites in it will be displayed. To install the Spybot hosts file, click on the Hosts File tab.

  At the top of the Hosts File screen, click on Add Spybot-S&D Hosts List. The Spybot hosts file will now be used instead of your default hosts file. To remove the Spybot hosts file, click on Remove Spybot-S&D Hosts List.

  Note: Using the Spybot hosts file can cause decreased performance. Read the FAQ included with Spybot to correct these problems for your version of Windows.

The Process List tab displays all processes running on your system. Although any process may be killed (stopped) through this tab, it is intended primarily as information for technical support. To kill a process in this list, select the process and click on the Kill button at the top of the window.

• System Startup Menu The System Startup menu lists all programs that are started when Windows is launched. This menu allows the user to change the path to a Startup program or change the command used to execute the program. You can also delete any program from Startup or insert a program to be started with Windows.
  To view any item in the System Startup list, select the item and click on the Info button at the top of the System Startup screen. To disable a program run at startup, or to allow a disabled program in this list to start with Windows, select the program and click on the Toggle button at the top of the screen. To change the path to a program run at startup, or to change the command options run with the program, select the program from the System Startup list and click on the Change button at the top of the screen. it gives you the ability to add and configure new startup programs. To add a new program to the Startup list, click on the Insert button at the top of the screen. Make the program available to All Users On Startup or only to the Present User. Select how the program will be run. There are three selections available:

  • Run The Program As A Normal Program
  • Run The Program As A Service
  • Create An Autostart Group Link

Provide a name for the registry entry and select the path to the executable file. A new entry with the value you enter will be added to the list of programs run at system startup.

Using Spybot Immunization

The Spybot Immunization function is controlled through the Spybot-S&D tab. It provides four very useful functions:
 

• Permanently immunizing Internet Explorer from Spyware
• Preventing Internet Explorer from downloading known Spyware installers
• Preventing Spyware from making changes to Internet Explorer configuration
• Locking the hosts file

To provide immunity for your browser and hosts file, click on the Immunize icon under the Spybot-S&D tab. In the first configuration panel, titled Permanent Internet Explorer Immunity, click on the Immunize button to immunize Internet Explorer. The next panel is labeled Percent Running Bad Download Blocker For Internet Explorer. In the drop-down list, select Block All Bad Pages Silently. Click on Install.

In the third panel, Recommended Miscellaneous Protections, click in each of the three check boxes available to lock the hosts file and to prevent Spyware from reconfiguring Internet Explorer when immunization is activated. Spybot blocks all entries that are in its database.
 

Note:

CoolWebSearch or ‘CWS’ as many refer to it as, has become one of the leading Spyware programs that affects many home users. It has surpassed a lot of very annoying hijackers such as Lop, Xupiter and Whazit etc.  Today it has over 100 variants of this Spyware engine ( allhyperlinks.com, coolwwwsearch.com, youfindall.com, etc )!!

CoolWebSearch (CWS), can not only hijack your browser to any of its variant URL’s but has also been known to cause major Internet Explorer slow downs. This ‘trojan’ enters your computer by a ByteVerify exploit in the Microsoft JavaVM and installs it self. For more information please see the following link.

Merijn (author of popular anti Spyware program HijackThis) has made a tool to get rid of CoolWebSearch, including many of its variants.

Webliography

Tutorial - The home of Spybot-S&D!

Using Spybot - Search & Destroy to remove Spyware from Your Computer

Spybot Search & Destroy Support Procedures

AIT - Using Spybot Search & Destroy to Remove Spyware

Spybot Search & Destroy 1.3 Tutorial

Techworld.com - Automating Spybot Search & Destroy with ZENworks

SpyBot tutorial

Feedback

[Aug 24, 2005] What a great app! (Feedback for the page Spyware Removal Using Spybot S&D; slightly edited for clarity):

Thanks for recommending this freeware -  I recently cleaned my pc from a Trojan which disabled the wallpaper and gave a warning tool in the task bar telling me to buy some anti malware software. I knew this was a hack from the start and set about cleaning the registry , resetting dodgy files in SYSTEM32 to a .doc extension, etc but I was not able to clean certain items - I was not allowed to delete certain entries from the registry (in particular the RUN key) - seemed like a permissions problem. I ran recommended program in safe mode booting of XP and I cleaned everything it found and the machine seems much happier now!

What I would like to know is how you remove an item from the registry when you know its bad . I tried messing about with the permissions on the item but nothing worked.

... ... ...

Keep up the great work!

Regards

Peter

Peter,

There are several good free registry editors,  watchers. See Free Registry Tools for more information. But the first step is easy to do with regular Windows registry editor (regex.exe):

Often spyware is pretty primitive and removal of the component that is installed in

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

registry key disinfects the PC.

To do this follow the step outlines below. Be very careful working with the registry and do not delete entries just because they look suspicious. check each of them as outlined below:

1. Open your registry in regedit
   • Click "start" (bottom left of your screen)
   • Select "Run"
   • Type "regedit"  in the command line displayed
   • Click OK. 
2. In a tree that is shown select HKEY_LOCAL_MACHINE
   • then click on + sign for the key SOFTWARE
   • then click on + sign for the key Microsoft
   • then click on + sign for the key Windows
   • then click on + sign for the key CurrentVersion
   • then click on + sign for the key Run
3. Put a bookmark for the Run entry (Click Favorites, Add to Favorites and preserve the name Run that Microsoft Registry Editor suggests, so that you can gat tot he same place quickly if you need to.
4. Print all entries (File, Print).  Look for suspicious entries, that have strange names, load programs from strange locations, etc but don't take any actions on them.
5. Open Windows Explorer  Click on  Tools, Folder options , View and and Details View and
   • uncheck:
     • Hide extensions for know file types
     • Hide protected operating system files
   • check
     • Show hidden files and folders
     • Remember each folder view setting

   click apply to all folders and OK.
    

6. Find each suspicious file from the printed list of Run section and check the creation date. After that go to the listed directory find the file, left click and click on properties. Check Version section.  If Description is missing, Version is missing or this is an unknown company, then the file is suspicious.
7. For each suspicious file search Goggle. If Google search proves that this entry belongs to spyware  simply delete the key.
8. For each other file try to search Google. But be critical as for results. do not rush to delete it without additional consultation in one of the recommended in Fighting Adware/Spyware Paranoia page forums.