[Excalibur's Power]

Open up the "run" option [assuming your using Windows XP] and type "msconfig", press run. Then you clicky a thingy that gives you all the programs...

...at least that's how my dad did it.

Oh, and if you haven't, switch to Firefox.

www.mozilla.org

[Elliott]

Even with Firefox, and doing my best to sopt IE from accessing the internet, I still get IE pop ups, usually 3 or 4 an hour. Not a huge deal, but it's still a pain. Never had a pop up from firefox ^_^ .

[Elliott]

Microsoft made MSN Messenger to open your hotmail in IE, a real pain in the butt, so I never give out my hotmail as my e-mail address, I use the one from my ISP.

[Nick Presta]

IF you're getting pop ups with your browser closed, you have spyware and adware problems.

Download 'Spybot: Search and Destory' and 'Adaware SE' and run those. That should fix it.

[l3lueMage]

Okay you Guyz want to know how to get rid of popups YES IT WILL TAKE A FEW HOURS TO DO BUT your comp will run faster and lose the popups...at least mine did =D

DSL REPORTS.com said:

Q: I think my computer is infected or hijacked. What should I do? (#8428) 
A: Going through this checklist step-by-step to the end will actually save you time in restoring the security of your computer. You can proceed through most of the steps without having to wait for guidance from someone in the forum.

This FAQ is long, but that is because the instructions are step-by-step. You will go through most of the steps quite quickly, although a couple of scans may take a half-hour to run.

You will have to close your web browser windows later, so it is recommended that you printout this checklist and check-off each step as you complete it.

When you need to come back here, to link to something, use this URL:
www.broadbandreports.com/faq/security/8428

If you need time to think and plan, unplug your computer from the Internet.

If you have a question on the steps, or something interesting to pass on, feel free to post in the BBR Security Forum, one topic per infected computer. Please include the virus, symptom or filename as part of the subject line. BBR Security Forum

If you are unable to perform a step, make a note, and move on to the next step.

Don't stop when you find the first piece of malware. It is not uncommon for a computer that has been exploited through a security flaw to have been penetrated more than once. Also, some malware opens backdoors that facilitate the installation of software that enables use of the infected computer by remote control.

This FAQ is organized to guide you through these steps:

1. Update and run the defensive tools already on your computer.
2. Run tools that look for viruses, worms and well known trojans.
3. Run tools that look for well known adware and search hijacks.
4. Run tools that look for less common trojans.
5. Create a report that will allow forum experts to do a manual examination for less common adware and trojans.
6. Submit any malware that appears to be new or modified to the anti-malware vendors.
7. Run tools that allow for examination of some security and system settings that might be changed by a hacker to allow remote control of the system.
8-11. Determine the steps to clean the computer, and clean the computer.
12. Re-scan to verify that the computer was successfully cleaned.
13. Re-secure the computer and any accounts that may be violated. If applicable, report identity theft, cancel credit cards, change passwords.
14. Check that the anti-virus monitor is working again.
15. Take steps to prevent a repeat incident.
16. Post about lessons learned.
17. Reference links to product tutorials and additional information sources.

Notes:

a) If at all possible, copy (quarantine) suspected malware files to a password protected compressed file (zip file) before deleting them. Do this in addition to any quarantine function that other products have. There is more on this in step 6. Be careful not to click (left-click), open, or run suspect files. (How do I create a password protected zip file?)

Note the location of the file (the full path), because this is an important clue to where the file is from and whether it has been activated yet. If only part of the path to the file is shown by the AV scanner, use the Windows search tool (Start button / Search) to locate the file and write down the full path to the file.

Compressed folders (also called archives, files with file extensions like .zip and .cab) are now decompressed to temporary files by many malware scanners. If the only sign of malware is in one of these temporary decompression folders it is unlikely that the malware has been activated. So be sure to mention the full path and file name when posting about any file found.

^_^ A file's properties may also give a reminder as to what the file is part of. Right-click on the file in Windows Explorer or Search, and select Properties. Remember properties can be faked by hackers, so consider them reminders not proof.

c) When in doubt about a suspicious file, submit if for analysis. Your iexplorer.exe may not be the same as someone else's iexplorer.exe.

d) When a step indicates running an update, activate the update function of the program. In general, once the update is complete, stop and start the program before running your scan. This will ensure your scan is done using the latest program and malware database versions.

e) Close all web browser (Internet Explorer) windows before having a tool actually fix a problem or remove a file.

f) Often running in Safe Mode will solve problems removing files. Click here for instructions for running in Safe Mode.

g) If you are on a Windows system that has separate administrator accounts (Windows XP, 2000, NT), work using an account with administrator privileges.

Once complete, if you continue to have problems with a particular user account, repeat the scans in steps 3.1, 3.2 and 5 using that user account. (On Windows XP you will need to use the "Run As" function described here: HOW TO: Use the RUN AS Command to Start a Program as an Administrator in Windows XP.)

1. Update and run any anti-virus (AV), anti-trojan (AT), and anti-spyware (AS) products you already have installed on your computer. Do full scans of your computer.

Record exactly the malware names, and file names and locations, of any malware the scans turn up. Quarantine then cure (repair, rename or delete) any malware found.

If the scanners say you have Sasser, you need to take some extra steps before you carry on to see what else you have: Click here.

If you can't access security web sites, check your "Hosts" file.

2. Run two or three free web based AV scanners. (This scanning is the most time consuming step in this checklist, but it is important.) Go to web based AV scanners

Record exactly the malware names, and file names and locations, of any malware the scans turn up. Quarantine then cure (repair, rename or delete) any malware found.


3. Download, install, update and run all 4 of the following free anti-hijacking and anti-spyware (AS) products. Be sure to both download and install the latest version of the program, and then update each products database.

When running the scan, record exactly the details of any problems turned up. (Tracking cookies are easily cleaned-up by deleting them, so don't bother recording them.) Quarantine then cure the malware.

3.1 CWShredder (free):

Download it here:
»cwshredder.net/bin/CWShredder.exe
or here:
http://www.majorgeek...wnload3019.html

This is a special tool for removing CoolWebSearch and its variants.

a) Download and run CWShredder.
;) Click the "Check for Update" button and download any update found.
c) Click the "Fix" button to run it. It will scan for and delete any bad files found.


3.2 About:Buster (Free)

Download it here:
http://www.malwareby...AboutBuster.zip
http://www.downloads...AboutBuster.zip

This program removes the Home Search Assistant.
a) Unzip all files in the .zip folder/file to a folder such as C:\Aboutbuster.
^_^ Run AboutBuster.exe, then click "OK".
c) Click "Update" and "Check for Update".
d) If there is a newer version click "Download Update" and wait while it downloads
e) Click "Start". Read the caution and click "OK".
The program should start scanning and removing bad files.
f) Save the log by clicking the "Save Log" button. Post a copy of the log in your new topic in the forum (see step 5 below).
g) Restart your computer.
h) Run AboutBuster again to ensure that the malware has been successfully removed.

(KAV users: About:Buster is compatible with KAV 5 ADS.)


3.3 Spybot S&D (donationware):

Download it here:
www.safer-networking.org/
www.1usa.com/downloads/spybotsd/index.html

a) Download and install Spybot S&D.
;) Click on "Update" in the left column.
c) Click on "Search for Updates".
d) Select a download location (usually one close to you).
e) Click "Download Updates" and wait of the updating process to finish.
f) Check that all Internet Explorer (web browser) windows are closed.
g) Click "Search and Destroy" in the left column.
h) Click "Check for Problems".
i) Have Spybot remove/fix all the problems it identifies in RED. The items not listed in red should not be touched at this time.

3.4 Ad-aware (freeware):

Download it here:
www.lavasoftusa.com/software/adaware/
majorgeeks.com

a) Download and install Ad-Aware SE Personal Edition (or Professional Edition). If you previously had Ad-aware installed, grant the installer permission to uninstall it when it asks.
B) As the installation ends, leave these boxes checked: (i) Perform a full scan now, (ii) Update definition file now, (iii) Open the help file now. Click "finish".
c) Close all programs except Ad-Aware.
d) Wait for the scanning process to complete. (Optionally glance through the Ad-aware Help window that has popped up. Close Ad-aware Help when done.)
e) Click "Next".
f) Click "Critical Objects" and select all the items found for removal. ("Removal" actually puts things in quarantine, so you can generally recover them if you need to.)
g) Click "Negligible Objects". "MRU list" refers to history lists of "Most recently used" files for different programs. You can review this now and note anything that appears suspicious to post a question about later.
h) Reboot your computer.
i) From Start, All Programs, Lavasoft Ad-aware SE Personal, re-run Ad-aware.
j) Repeat steps © through (i) until no more items are found



4. If problem seems to be gone, you may skip this step. Otherwise download, install and update one of these 3 anti-trojan (AT) programs. Record exactly the names of any problems it turns up. Then quarantine and cure the malware.

TDS-3 (30 day free trial):

Download it here:
www.diamondcs.com.au

Do a trojan scan:
a) Download TDS-3.
B) Download and install the latest TDS-3 trojan database.
- If you have the trial vesion of TDS-3:
(i) Close TDS-3 if it is running.
(ii) Right-click here and choose Save Target As to download the latest Radius.td3 trojan database.
(iii) Save the downloaded radius.td3 file to your TDS directory, over-writing the existing radius.td3 file.
(iv) Start TDS-3.
- If you have the registered version of TDS-3, start TDS-3, click "TDS" in the upper left, and select "Update TDS Databases Now".
c) Click "System Testing" and select a "Full System Scan".
d) Record the results.
e) Follow the instructions to quarantine and cure the any unexplained files.
f) Reboot and re-scan.
g) Repeat steps © through (j) until nothing new is detected.

Investigate open ports:
Steps (h) through (q) are an additional method for locating new trojans and hidden illegally installed legitimate software.
- Skip steps (h) through (q) the first time you go through these instructions.
- If later instructions bring you back to this step, and if there appears to be something on your computer even after the other products say it is clean, these steps will help you locate unauthorized programs listening to the internet.
h) Unplug your computer from the Internet.
i) Disable any software firewall you may be running (for example, ZoneAlarm, Sygate, Kerio, NPF).
j) Click "Network" and select "LocalHostScanner".
k) In the targeted ports tab, select "trojan.txt".
l) Make sure the IP/Hostname is 127.0.0.1.
m) On the scanner tab, click start and wait for the scan to complete.
n) Note which ports it says are open (listening) (it is normal to have some ports open, so don't be alarmed).
o) Determine what programs are listening on the open ports using the procedures here: click here
p) Save the information above and include it in your posting in the BBR Security forum.
q) Now you may re-activate your software firewall, and then plug back into the Internet.


TrojanHunter (30 day free trial):

Download it here:
www.misec.net/products/

Be sure to update TrojanHunter's detection rules before starting the scan.
(a) Follow the rule update instructions here: www.misec.net/trojanhunter/updating/.
(B) Shutdown and re-start TrojanHunter.
© Run a scan with TrojanHunter.


BOClean:

Download it here:
http://www.nsclean.com/boclean.html

BOClean comes with a "starter" database and will automatically update itself within four minutes of installation.
(a) Be sure you are running the latest version of BOClean by checking here: www.nsclean.com/upgrade
(B) Follow the rule update instructions here: www.nsclean.com/update.html.
©BOClean will monitor your computer for trojan activity and automatically neutralize them as you carry on with the other steps in these instructions.

(Shutdown and restart are not necessary.)


5. If the problem seems to be gone, skip this step. Otherwise, download and run HijackThis (HJT) (freeware):

Download it here:
www.tomcoyote.org/hjt/
www.majorgeeks.com

a) In Windows Explorer create new a permanent folder just for HijackThis. C:\HJT is a good folder name.
B) Download HijackThis from one of the websites above. Move hijackthis.exe to the folder you created (for example C:\HJT).
(Putting HJT in its own permanent folder ensures that HJT will make backups before it deletes something, and that you can locate the backups later. Do not run HJT from a temporary internet files folder.)
c) Double-click hijackthis.exe click "Scan", and wait for the scan to finish.
d) When the scan is finished, the "Scan" button will change into a "Save Log" button. Click the "Save Log" button.
e) Copy the contents of the log you just saved and get ready to post it in the BBR Security Forum

- The format of your post must be exactly as follows with no deviation or your post will be locked or deleted. This is to ensure you have followed the steps correctly and thoroughly, and to provide our helpful members as much information as possible, so they can help you faster and more effectively.

Start your own thread. Do not interrupt other similar threads with your problem.

i) Start the title of your post with "HJT Log" followed by a short remark regarding your problem.

ii) The first paragraph of your post should explain exactly what the problem is. For example, is it a system slow down? Is it Pop ups or ads? Is your computer trying to call out or send emails? etc...

iii) The second paragraph should tell us in detail, which one of the above steps you followed and what the results were. Which steps you had to skip and why, etc... Please note the phrase "in detail". "I've followed all the steps.", may not be enough information for those who are here to help.

iv) The third paragraph should contain the HijackThis log you copied in step
5.e.

- Most of what HJT lists will be harmless or even essential, don't fix anything yet. Someone will be along to tell you what steps to take after you post the contents of the scan results.

f) Carry on with the steps 6, 7 and 8 while you wait for feedback from HJT specialists in the forum.

Remember that filenames suggest what a program file is, but files can be changed or renamed. It is file contents that determine what a file actually does. So it is important to run the scans in the earlier steps before creating the HJT log.


6. Submit the suspected malware to AV and AT vendors. This will probably be the one thing you can do to "get back at" the virus writer.

All Anti-virus, anti-trojan and anti-spyware (AV, AT and AS) vendors are interested in samples of possible new or re-emerging malware, because viruses are often changed and adapted over time by hackers.

In particular, be sure to submit copies of suspect files that:
- Got onto your system undetected by an up-to-date AV monitor.
- Are not consistently detected by some AV scans.
- Are acting differently from what was described in the AV company's write up.
- The scanner says are generically or heuristically detected (have no specific signature).
- Are heuristically detected, because heuristic methods are prone to false alarms.
- That you have continuing doubts about.
- If you don't submit a malware file, retain it in quarantine for at least 2 weeks, in case later computer behavior indicates that the file may not be what it was initially identified as.

Filenames suggest what is in a file, but files can be renamed. Also, friendly files can have extra functions added. Only an internal analysis of the file can reveal what it really does. Your AV and AT vendors cannot reliably protect you from new malware until they receive a copy of it.




To Submit Suspected Malware:

(a) Copy the suspected malware files to a compressed folder (a .zip file). This will prevent the file accidentally being activated. It will also stop the suspected malware being disinfected by email servers when you submit it for analysis.

In Windows XP right-click the file and select "send to compressed (zipped) folder". Then select the .zip file, and do File / Add a password. Make the password "infected".

In earlier versions of Windows you need some third party software. WinZip is very easy to use and comes with a free trial period. Simply install WinZip and follow the wizard. Be sure to add "infected" as the password. (How do I create a password protected zip file?)

(B) Click here to submit the suspected malware file. (Outlook, Outlook Express and most other email clients)

Some Outlook clients may have a problem with the link above, in that case Click here.

© Attach the password protected zip file and send. You're done.

(The above method sends your file to 30 anti-malware vendors. However, if the above is too complex for you, Hispasec lab's free multi-engine single file scan and submission tool www.virustotal.com is much simpler to use. It will scan your file and submit it to 15 anti-malware vendors.)



7. Even if the problem seems resolved, run security analysis products to check your settings and installed software. These analysis products are definitely not 100% thorough in the checks they do, they only check for common problems. Also, the messages that are produced are usually cautions to check that something is as you want it to be, and are not definite instructions to change something.

7.1 Install and run Belarc Advisor (free): www.belarc.com

When you run Belarc Advisor, look for:

7.1.1 Users you didn't add. Check whether your computer maker or re-seller added the users for support purposes before you bought the computer. Otherwise they indicate a hacker has accessed your system.

7.1.2 Microsoft Hotfixes with red Xs beside them, indicating they can be verified by the automated process, but failed verification. The earlier the version of Windows, the more likely the fix came off "innocently" when new software was added or upgraded. Click on "details". This will take you to a Microsoft webpage explaining the fix, and allowing you to re-apply it.

7.1.3 Under software versions, software you didn't install. Many software packages include other third party software. So installing one product can make 3 or 4 products show up in Belarc – and this is not a problem. On the other hand, hackers often install legitimate FTP server or email server software, and because the server software is legitimate it will not show up in a virus scan.

7.1.4 Save a copy of the Belarc Advisor results. In a few weeks, compare your saved scan with a new scan, looking for unexpected changes.

7.1.5 Ask in the BBR Security or Software Forums before making changes, other than re-applying hotfixes. BBR Security Forum

7.2 Install and run Microsoft Baseline Security Analyzer (MBSA) (free):
www.microsoft.com/technet/security/tools/mbsahome.mspx

7.2.1 Review the results to see that they correspond with how you have set your computer up.
- Changes might indicate that someone has altered settings. Or the settings may have been altered when other software was added or updated.
- Security updates with reason "306460" simply cannot be verified by the automated process.
- "File version is greater than expected" just means your software has updates MBSA doesn't know about yet.
- You may notice invalid password attempts in your security log. MBSA causes them when it checks for weak passwords.
- The messages above are not normally problems.

7.2.2 Save a copy of the results. Compare them with the results in a few weeks, looking for unexpected changes.

7.2.3 Ask in the BBR Security or Software Forums before making changes, other than re-applying hotfixes.


8. Different vendors have different names and version identifiers for the same virus, so first look up the virus in the encyclopedia of the scanner's vendor for specific disinfection instructions:
Go to virus encyclopedias

This is also a good time to re-visit the topic your started in the BBR Security Forum, post an update on what you've found, and see what advice has come in: BBR Security Forum


9. To end a process (program) that won't terminate any other way, use Advanced Process Termination (freeware): www.diamondcs.com.au/index.php?page=products


10. Depending on the instructions in the virus encyclopedia for your scanner, it may be necessary to use auxiliary virus removal tools.

10.1 First be sure to submit a copy of any malware that is not consistently detected or that doesn't behave as excepted. Submit suspected malware.

10.2 If a removal tool is required, it is best to first try the tool of the scanner's vendor. If you need to use another AV maker's removal tool, use one of the multi-engine scanners here to find the name other vendors give the virus.

10.3 Read the complete write-up of the virus in the encyclopedia of the removal tool's vendor to find the disinfection instructions. In addition to running the scanner or removal tool, there may be a few manual steps required.

10.4 Generally each removal tool will only detect and effectively remove the virus variants it says it will.

10.5 For very new virus versions, it may be advisable to wait a half-day for the AV maker to update the removal tool.

Removal Tool Links
www.avast.com
www.f-secure.com
www.grisoft.com AVG
www.kaspersky.com
vil.nai.com McAfee
Panda & ActiveScan
securityresponse.symantec.com Norton
www.sophos.com
PC-cillin & Housecall


11. In Windows XP and Me, to prevent important system files being deleted accidentally, System Restore makes backups of them and restores the backups if the original file goes missing.

To prevent malware being restored by the operating system, it is often necessary to clear the backup files from System Restore after the malware is deleted. (This is called "clearing the System Restore points". To do this, turn System Restore off, wait 30 seconds, and then turn System Restore back on.

Waiting until after cleaning to clear the System Restore points means that if there is a problem during cleaning, System Restore can be used to try to correct it.

The instructions on turning System Restore off and on are here:
Microsoft System Restore Instructions (KB 842839) --OR --
Symantec System Restore Instructions


12. If you removed any malware, re-boot and repeat the scans that revealed it earlier. This is to make sure that the malware has not managed to re-install itself.

If the malware did come back, use this sequence of actions:
a) Turn off System Restore.
B) Repeat the cleaning procedure used earlier.
c) Re-boot.
d) Only then turn on System Restore.
e) Re-boot.
f) Re-scan.

If the malware comes back a second time, it is likely that the malware is in multiple files, each of which will replace the others if they go missing. In that case, additional research into your malware is required before cleaning can be successful. Post fully describing your problem here BBR Security Forum.


13. Re-secure your computer and accounts. The ideas in the following step-by-step guide are useful for cleaning any version of Windows: CERT Guide to Recovering from System Compromises

13.1 In particular, if private information is kept on or entered into the computer, and if the description of the malware uses the words or phrases: "backdoor", "allows arbitrary code to be run", or "remote access trojan", and if it is likely that a hacker may have used the backdoor, strong consideration should be given to backing-up data to be retained, and then re-formatting and re-installing programs on the computer from trusted sources.

This is because a backdoor allows a hacker to make other changes that may reduce your security settings, but that are not readily detectable with current tools.
- After what kinds of viruses and trojans should one re-format and re-install?
- Security Program Manager Microsoft Corporation: Help: I Got Hacked. Now What Do I Do?

13.2 If a keystroke logger or backdoor was detected then hackers may have access to what was typed into your computer, including passwords, credit card numbers, and account numbers.

13.2.1 Immediately cancel any credit cards used on the computer while the keystroke logger or backdoor may have been active, and ask for replacements with new account numbers.

13.2.2 Using an uninfected computer, change any website and server passwords that were entered on the infected computer.

13.2.3 Depending on what information you have typed into your computer in the past, you may need to report a possible "identity theft".


14. Check that your anti-virus software is working again.


15. Go to How to Secure (and Keep Secure) My (New) Computer(s): A Layered Approach for tips on preventing re-infection.

In addition to a firewall and anti-virus scanner, SpywareBlaster, and SpywareGuard will help keep malware off of your computer. Weekly scans by your anti-virus scanner, Spybot S&D, Ad-aware, and Belarc Advisor will help detect malware that gets on your computer.

Remember to keep your operating system, security software, and Internet-capable software up-to-date.

[Elliott]

A link would have been sufficient l3uemage, I'll give that a shot when I have spare time.

[Izar]

nick1presta, on Jun 10 2005, 10:57 PM, said:

IF you're getting pop ups with your browser closed, you have spyware and adware problems.

Download 'Spybot: Search and Destory' and 'Adaware SE' and run those. That should fix it.

Spybot, yes. It's your best bet against nwanted spyware(who reall does want it?). Our school uses it, and it's better than alot of programs you gotta pay for.

Agatio, Betrayer didn't post that, l3luemage did.

[My Best Wishes]

Agatio, on Jun 11 2005, 11:29 AM, said:

Even with Firefox, and doing my best to sopt IE from accessing the internet, I still get IE pop ups, usually 3 or 4 an hour. Not a huge deal, but it's still a pain. Never had a pop up from firefox :) .

Well i'm getting them ALL the time. Even on firefox, it's only been the last week or so they come up. Any ideas?

[Elliott]

Best just to leave it as it is, and get a pop up blocker, or something like Zone Alarm (I don't think I've had one since I did a spyware check and installed ZA).

[Andross]

Before I start, GO HERE!!!!!!!!!!!!

http://www.petitiono...l/petition.html



The absolute BEST method, I have found, is the following. NOTE: You should write down what is found (specifically what Ad-Aware finds, as that gives specific groups), so you can do a Registry trick later.

1. Download Ad-Aware Personal SE (Lavasoft), Spybot Search and Destroy, trial of Spy Sweeper (Webroot), trial of Counter Spy, trial of Windows Washer (Webroot), HiJack This! and SpywareBlaster. (GOOGLE THEM! It's not that hard people)

2. Install the programs (do not restart if they ask you to) (HiJack This! Is just an .exe file, not a true install)

2. DISCONNECT YOUR INTERNET

3. Restart your computer

4. IMMEDIATELY hit Ctrl+Alt+Delete to bring up the Task Manager, as you might have to kill spyware processes, and you could get locked out of it; OPTIONAL, Go to processes tab, kill any processes run by the user (not system), and if you have any PC sense, you'll know which ones not to kill

4. Run Ad-Aware Personal SE , and do a scan for everything possible; delete all items found; anything that can't be removed is in the memory, let Ad-Aware run on next boot

5. Run Spy Sweeper, scan for everything, let it quarantine, then remove the items; let it run on boot like Ad-Aware if it can't get rid of everything

6. Run Counter Spy; ditto on deletions once again

7. Run Spybot S&D; you know what to do

8. After you've done all the scanning, open Spy Sweeper, goto Shields > Startup Programs tab > Check the Edit Startitems box > Uncheck anything you know is bad, Save

9. Run HiJack This!, save a log, paste it here if you don't know what to delete

10. Restart computer again, you'll probably have several anti-spyware programs boot like I told you, and they'll scan. They should delete anything there now.

11. Run Windows Washer, USE BLEACH, it'll clean up tons of crap (or should anyway)

12. If you wrote down everything like I said (from Ad-Aware), you should now go to Start > Run > regedit.exe

13. Here's the tricky part. Or, really long and annoying part. You need to hit Ctrl+F, type in the adware/spyware group (IST, Internet Optimizer, SearchAssistant, etc.) and delete the folders they are in. When you find an entry, you should look in the left column for a folder icon that's open. Click on it, delete it.

14. Shut down your computer. Connect the internet (if you disabled it, rather than yanked a cable, enable it and restart)

15. Boot up, run another round of scans. If you found nothing, that's a good sign. But nontheless, good luck.

------

THIS IS A VERY COMPLICATED, LONG, AND DIFFICULT PROCESS. The reason for this is you usually have to know what's a necessary file and what's a malicious process or file (mainly for the process killing, HiJack This!, and last regedit part). But it removes the toughest spyware, which can hide in many different places, such as your registry, system files, and startup, and the system restore.

[Elliott]

Another method is doing an annual, or 6 monthly back up and re-format. This way you remove every single adware, spyware, malware and virus possible on your computer. Only takes a day tops to back up, re-format, then re-install. I may do that soon.

[Golden Djinn13]

I know it has to be a spyware, so what i would get Microsoft Anti-Spyware and run it, after the scan, un-hijack your settings back to your original Homepage. Microsofts the BEST!!!!!!!!!!!!!!

[Andross]

GoldenDjinn, that's in no way the method you'll be able to get rid of ALL spyware. It takes multiple programs and manual cleaning. BTW, MS's antispyware program isn't made by them, it's made by BIG Software - MS merely bought them.

[Nemphtis]

I don't get any popups, when you download AIM you have to accept some popups from that but other than that I just use Adaware to get rid of all that kind of crap and I just generally lookout for what I click.

[Kwesi]

Yeah i used to get mad pop-ups but now i use zonealarm and adware.

[Eugine]

My IE stops pop ups good enough for me :).

*Waits for Andross to fire at me for using IE* :(

[Kwesi]

Lucky you i have to use mad Adware and firewall junk to protect my computer.

[Golden Djinn13]

My computor is barely protected now, I still get pop-ups. What type of blocker is really good?

[Kwesi]

Try Pop-up stopper anti spyware its what helped me get my computer under control. Also try zonealarm, it has one of the best firewalls you can find.

[Golden Djinn13]

Can I download them somwhere, or do I buy them?

[Kwesi]

for pop-up anti spyware u can download it and zonealarm u can get for free but only with the firewall. The upgraded version of it is called ZOnealarm Pro it has email protection, warns you if programs are trying to acces the internet and a whole bunch of other usefull stuff. Go to www.zonelabs.com to download it.

[Golden Djinn13]

Are both of them at that website, and are they both the full version and not trial?

[Kwesi]

No on zonelabs you can't get pop anti spy ware i think u can search on google for pop up blockers

[Golden Djinn13]

I guess i'll try the one on zonelabs, because I really need a pop-up blocker.

[Kwesi]

Yeah do that then use the 30 day free try for zone alarm pro. its really good.

[Golden Djinn13]

I used to use the pop-up blocker from the yahoo toolbar, but that was only for 2 days, because the thing drove me insane.

[Kwesi]

lol instead of yahoo. Also get the google toolbar its real good.

[Golden Djinn13]

I was gonna get it, but I thought it would be the same as the yahoo one. The pop-up blocker for yahoo always makes annoying noises, and I couldn't figure out how to turn the volume off.

[Kwesi]

googles toolbar doesn't make noises. I had yahoos toolbar but i hade now need for it because google caught all the pop-ups before yahoo could. :)

[Golden Djinn13]

So google is another one i'll try. Thanks for the tips.

[Kwesi]

Your welcome enjoy.

[Eugine]

Google is the best IMO, you get a pop-up blocker along with a google tool bar which is awesome on ur browser.

Do not get Yahoo! it sucks IMHO!

[Golden Djinn13]

Does the toolbar give you other types of protection?

[Andross]

Jeebus dude, Get Firefox and all major search engines will be available to you in one single bar next to the address bar. And you get popup blocking with Firefox in the first place. And it owns IE hundreds of times over.

[Golden Djinn13]

You know, i'll just get that instead. I HATE Internet Explorer, and i've wanted to try Firefox since it came out, but I just didn't feel like downloading it. ( i'm lazy...sometimes :blink: )

[Kwesi]

Ok then i still prefer everything i said. I also have firefox.