mrbigjohnson
03-11-2005, 06:48 PM
Clean your PC of spyware.
>>>Shut off System Restore<<<
One of the best features of Windows ME or XP is the System Restore option, however if a virus infects a computer with this operating system the virus may be accidentally backed up because of this feature. In order to completely remove a virus on these operating systems, you should disable System Restore before cleaning the system, then reenable it after the system is clean. (http://www.pchell.com/virus/systemrestore.shtml)
PLEASE go to control panel/ folder options/ view and select show hidden and system files (http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339?Open&src=ent&docid=2002092514302348&nsf=ent-security.nsf&view=docid&dtype=corp%E2%88%8F=Symantec%20AntiVirus%20Corporate%20Edition&ver=8.x&osv=&osv_lvl=)
Also uncheck "hide file extensions of known file types"
UPDATE and run your virus scanner.
If you do not have an anti-virus program run;
HouseCall (http://housecall.trendmicro.com/housecall/start_corp.asp)
Run the following in Safe Mode.
Starting your computer in Safe Mode (http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam)
Always scan with your anti-virus program in Safe Mode
Download and run;
McAfee AVERT Stinger (http://vil.nai.com/vil/stinger/)
Download and run;
aČ free (http://www.emsisoft.com/en/software/free/)
To be able to use it, you only must set up a free aČ Account (http://www.emsisoft.com/en/software/account/), to get access to the update server.
Download then update. Run and remove any spyware it finds.
AdAware (http://www.lavasoftusa.com/software/adaware/)
Download then update. Run and remove any spyware it finds.
SpyBot S&D (http://www.safer-networking.org/en/index.html)
If all that fails;
HijackThis examines certain key areas of the Registry and Hard Drive and lists their contents. These are areas which are used by both legitimate programmers and hijackers. It's up to you to decide what should be removed. Some items are perfectly fine. You should not remove them. Never remove everything. Doing that could leave you with missing items needed to run legitimate programs and add-ins. This Page will help you work with the Experts to clean up your system. For those of you needing instructions on how to Copy and Paste the contents of a text file into a Forum Post, please look at the Table of Contents. A link to the instructions is included. (http://tomcoyote.com/hjt/)
If you have run and fixed anything with Spybot Search and Destroy or AdAware, please reboot before scanning.
Newest version resolves the crash bug on the O23 method. Make sure that you actually extract HijackThis to its own folder. DO NOT run it from within a zip manager (Winzip), as no backups will be saved.
HijackThis 1.99.1 (http://www.merijn.org/files/hijackthis.zip)
Older self extracting version.
HijackThis 1.99 (http://www.merijn.org/files/hijackthis_sfx.exe)
If you have disabled anything in msconfig or with a startup utility, please re-enable it and restart computer before running HijackThis.
Post the HJT log Here
Help keep the spyware away.
SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html)
SpywareBlaster tutorial (http://www.bleepingcomputer.com/forums/index.php?showtutorial=49)
IESpyad: This puts harmful websites in your Internet Explorer restricted site zone. (https://netfiles.uiuc.edu/ehowes/www/main.htm)
Run IESPYad, and it will extract to C:\iespyad
Open that folder, and click on install.bat
Then choose option 2
Then choose option 1 (yes)
When it tells you to press any key to continue, press the space bar
Then choose 2(exit) 2
>>>Shut off System Restore<<<
One of the best features of Windows ME or XP is the System Restore option, however if a virus infects a computer with this operating system the virus may be accidentally backed up because of this feature. In order to completely remove a virus on these operating systems, you should disable System Restore before cleaning the system, then reenable it after the system is clean. (http://www.pchell.com/virus/systemrestore.shtml)
PLEASE go to control panel/ folder options/ view and select show hidden and system files (http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339?Open&src=ent&docid=2002092514302348&nsf=ent-security.nsf&view=docid&dtype=corp%E2%88%8F=Symantec%20AntiVirus%20Corporate%20Edition&ver=8.x&osv=&osv_lvl=)
Also uncheck "hide file extensions of known file types"
UPDATE and run your virus scanner.
If you do not have an anti-virus program run;
HouseCall (http://housecall.trendmicro.com/housecall/start_corp.asp)
Run the following in Safe Mode.
Starting your computer in Safe Mode (http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam)
Always scan with your anti-virus program in Safe Mode
Download and run;
McAfee AVERT Stinger (http://vil.nai.com/vil/stinger/)
Download and run;
aČ free (http://www.emsisoft.com/en/software/free/)
To be able to use it, you only must set up a free aČ Account (http://www.emsisoft.com/en/software/account/), to get access to the update server.
Download then update. Run and remove any spyware it finds.
AdAware (http://www.lavasoftusa.com/software/adaware/)
Download then update. Run and remove any spyware it finds.
SpyBot S&D (http://www.safer-networking.org/en/index.html)
If all that fails;
HijackThis examines certain key areas of the Registry and Hard Drive and lists their contents. These are areas which are used by both legitimate programmers and hijackers. It's up to you to decide what should be removed. Some items are perfectly fine. You should not remove them. Never remove everything. Doing that could leave you with missing items needed to run legitimate programs and add-ins. This Page will help you work with the Experts to clean up your system. For those of you needing instructions on how to Copy and Paste the contents of a text file into a Forum Post, please look at the Table of Contents. A link to the instructions is included. (http://tomcoyote.com/hjt/)
If you have run and fixed anything with Spybot Search and Destroy or AdAware, please reboot before scanning.
Newest version resolves the crash bug on the O23 method. Make sure that you actually extract HijackThis to its own folder. DO NOT run it from within a zip manager (Winzip), as no backups will be saved.
HijackThis 1.99.1 (http://www.merijn.org/files/hijackthis.zip)
Older self extracting version.
HijackThis 1.99 (http://www.merijn.org/files/hijackthis_sfx.exe)
If you have disabled anything in msconfig or with a startup utility, please re-enable it and restart computer before running HijackThis.
Post the HJT log Here
Help keep the spyware away.
SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html)
SpywareBlaster tutorial (http://www.bleepingcomputer.com/forums/index.php?showtutorial=49)
IESpyad: This puts harmful websites in your Internet Explorer restricted site zone. (https://netfiles.uiuc.edu/ehowes/www/main.htm)
Run IESPYad, and it will extract to C:\iespyad
Open that folder, and click on install.bat
Then choose option 2
Then choose option 1 (yes)
When it tells you to press any key to continue, press the space bar
Then choose 2(exit) 2