What to Do?

It's easy to difficult to respond to any of these signs of potential spyware. Some malware can be removed immediately by simply (updating and) running your antispyware apps. Make sure you have the good ones. Get Ad-Aware SE Personal and Spy Bot, Super AntiSpyware and Spyware Fighter each are free and effective spyware catchers and removers. Download McAfee AVERT Stinger. It's an effective little tool designed to help people clean out infected PCs. AVERT zeroes in on specific virusses and other malware and is designed to be (almost) immune to certain virusses that can disable security software.
I also recommend Spy Sweeper - download a Spy Sweeper trial here or one of the other reputable payware scanners, for example SpyCatcher - download a trial here , PestPatrol Anti-Spyware from Computer Associates, Ad-Aware SE Plus and Pro which both offer a far higher degree of protection than the free Ad-Aware Personal. McAfee AntiSpyware is good as well. Don't forget to download Microsoft's Windows Defender. It's a good scanner with some additional features to help you manage your system and protect your privacy including a startup editor and a process manager.
One or more of these signs may be indicative of a virus or worm so update and run your Antivirus as well.
You can scan your PC for spyware right here using Pest Patrol's free online scan



At the top left of this page (and other pages on this site) you can scan your PC for virusses and worms etc. with Trend Micro's free online House Call scan and/or you can scan your PC for free right here as well using Panda's free ActiveScan



If you currently don't have a good antivirus, or any antivirus for that matter, installed on your PC, go to my AntiVirus Store and pick out a good one for you. All my Antivirus programs are top rated, some more than others. If you need good antispyware protection, check out my Antispyware page for a good selection of reliable antispyware scanners.

If you can't afford an antivirus or just don't want to pay for one, you can always go for one of the free antivirus programs out there now. I recommend three to you AVG - AVAST! (free email support) and AntiVir.

If problems persist even after you have run your security software, you will have to remove the offending spyware manually.
Some are immune or resistant to detection by security software, for example those that are as yet unidentified or just too new to have been caught by the security software companies.
First, look in your Add/Remove programs list. Most internet nasties can be caught here. Look for new items in the list, items you don't remember installing yourself and items you just don't recognize. Google anything unfamiliar. Look through an online malware database like the one maintained by CA, or McAfee
Here's a list of some well-known spyware nasties. On %99 of computers these are unwelcome, undesirable and can be removed safely:

GAIN Media Access Media Gateway My Web Search MySearch Search Assistant - My Search Secure Delivery Select CashBack Surf Accuracy The Best Offers WebRebates Web Savings from eBates WhenU Save YourSiteBar Zango Source:Small Business Pipeline

180 Search Assistant Apropos Virtumonde SpywareStrike EliteBar ISTbar CoolWebSearch (CWS) PSGuard SurfSideKick DirectRevenue-Abetterinternet Source: Webroot Comet Cursor Xupiter Offer Companion BonziBuddy

After you remove the program, restart your PC. Next go into Program Files (Start>My Computer> Local Disk C >Program Files) and delete the program's folder. For this this job I recommend you use Spy Bot's file shredder which I have found very useful in deleting stubborn files and folders. It's simple to use. First at the top of the interface select Mode. Click on Advanced. Now go to Tools near the bottom of the Spy Bot interface. Click on Tools and select Secure Shredder. Right-click on the white area at the bottom and click on Add file(s) to the list. Follow the menu along at the right until you get to the file you want to delete. Click on it and then click on Open and then in the bottom right hand corner of the interface click on Chop it away!. Careful here. Once Spy Bot deletes the file or folder, it is gone for good (almost). Restart your computer.

If you're still having difficulties, go into Safe Mode and run your security programs there. Safe mode is a useful diagnostic tool. When your PC starts up in safe mode it is running only a few of the programs it runs ordinarily. It's kind of like a patient lying still on the examination table. Only essential Windows processes and programs run in Safe mode. You lose internet access. Don't worry. You get it back when you boot up normally. Most device drivers do not load, for example printer and scanner drivers. Regardless of your video card capabilities, Safe Mode uses standard VGA graphics mode so you will notice immediately that Windows looks different in Safe Mode. As I said, most programs don't run in Safe Mode. That means their files are closed, or not in use. Files that are closed, or not in use are more easily and effectively scanned and repaired. It's like having your doctor remove a mole form your arm while it is stationery as opposed to having him try to remove the mole while you are swinging your arm around in circles if you get my meaning.
Going into Safe Mode is relatively simple. Start up your PC and tap F8 repeatedly until you get the screen with the various boot options. In Windows XP, go up to the top of the menu and select Safe Mode.

Finally, remove the program's entry in the Registry. If there's one way to do do serious damage to a file/program, service or process, it's to hit it in the Registry. The Registry is like your nervous system. Nothing runs on your PC without being present, or registered, in the Registry. The Registry is a huge database that contains information about programs and settings on your PC which your Windows system is continuously consulting as it runs. When you install a program or a piece of hardware information about it is immediately stored in the Registry. Windows refers to this info when the program or hardware is used. If Windows can't find any info on the program or process or piece of hardware in the Registry, it simply won't work. There's simply no info there about the program for Windows to reference and use to make the program run.
Before you work in the Registry, you back it up first. One wrong move in the Registry and you've got a disaster on your hands. Sometimes, if you really goof up, Windows won't even load. Then you've got a really big problem. I won't go into much detail here as I really don't think it advisable to spend too much time hacking away in the Registry, especially if you're looking for a file to delete. I will tell you the one place to look though where you are most likely to find the malware in the Registry.
First go to Start>Run>Type in Regedit. Hit OK. Now go to the HKEY_CURRENT_USER folder. Click on it and go down to Software. Click on Software and cruise down the list of entries until you see the malware's entry in the list. Right-click on the entry and hit Delete. Only hit Delete if you are absolutely sure it is the file you are looking for. Now, close the key and go to HKEY_LOCAL_MACHINE. Do the same thing, if the malware is in the Software sub-key/section. Close Registry Editor and restart your computer.

If problems persist, download and run Hijack This which was created by fellow named Merjin.

Hijack This is a widely used security tool that works well alongside anti-virus and anti-spyware programs. Hijack This scans your PC for rogue autorun and startup programs and home page and browser hijacks among other things. With one click, using Hijack This you can stop, dead in its tracks, almost any program or process running on your PC. It's deadly. You have to be careful with it. If you're not properly guided using Hijack This, you can seriously damage your operating system.

It's easy to use Hijack This. The best thing to do with Hijack This is run it and take your Hijack This log to a forum that deals specifically with Hijack This logs. I recommend Bleeping Computer and Spyware Warrior. If you're not already a member, you will have to register - it's no big deal, post your log and then wait until an expert can help you out with it.

For instructions on downloading,installing and running Hijack This, see Major Geeks. You can view a Hijack This tutorial by Merjin here

PC Health Problems #2

Security Software Conflicts

Sometimes, in our zest to protect our systems and/or because we just don't know any better, we make the "mistake" of installing more than one antivirus (AV) or firewall(fw) on our computer. I say "mistake" advisedly because there are instances where more than one AV or firewall running simultaneously on a system is harmless. For the most part, however, you are risking serious harm to your system if you try to go with more than one AV or fw. You are also running the risk of disabling other programs on your machine including one or both of your AVs.

The problem with running two antiviruses stems from the way the AV sets itself up in your system. AVs you install take up their position in your computer's memory. They are for this reason sometimes called memory resident (mr). The memory resident AV occupies the same places an invading script, or virus, would use to insinuate itself into your system. It has to in order for it to work. If another AV is on your system, chances are it will see the other AV moving into these sensitive areas of your memory and attack it. The first AV will then counterattack that AV, if it's lucky, thinking it has caught a virus designed to disable AVs (they're out there!) or vice-versa. The two competing AVs will quarantine or delete each other's core files. The result is paralyzed AV(s), a system freeze, sometimes damaged memory and an inoperative (but not inoperable )PC.

Even if your two mr AVs are getting along chances are you will have trouble when you try to use one of your programs. (Memory) Resident AVs also monitor your system continuously looking for viruses and (potential) virus activity. It's called real-time protection. For example when you open your email suite and send/receive emails or when you download a file from the internet, your AV swings into action and scans the file(s) for viruses. When you start up a program, your AV checks it out before it loads into the memory. Problems occur when you try to open a program when two mr AVs are running simultaneously and they both clash at the same point, in this case the program you open, say your email suite. Both AVs collide and see each other as malignant script converging on your email program. Here too the result will likely be damage to one or both AVs and a disabled email suite or whichever program you tried to open.

Lastly, even if your two AVs are running smoothly together, and it can happen, you run the risk of exhausting your memory and power supply because AVs tend to be resource hungry. Some of them are more than 20 MBs in size. If you run out of memory and/or power, your PC is likely to crash or freeze. Believe me, folks it's no fun when your system hangs.

The same is likely to happen when you try to run two firewalls. Firewalls are designed to stealth ports and monitor activity into and out of your ports. Firewalls inspect and give or deny permission to data(programs, emails etc.) leaving and entering your PC. If your firewall detects something suspicious or unfamiliar trying to leave or enter your PC, it denies it entry or exit until or unless you grant permission for that data to enter or leave your PC. If you have two firewalls running you often wind up with a loss of internet access or system hang as the two firewalls block and deny programs simultaneously but in an uncoordinated way. That means Internet Explorer or whichever browser you're using can be blocked from getting out to the internet. When you click on the browser icon, you wind up with the dreaded "This Page Can Not Be Displayed" message. Likewise you will be unable to send/receive email as the two firewalls will have combined in a maladaptive way to block internet access to your email suite. To put it simply, you are isolated from the internet.

That's the best case scenario. The worst case scenario is that your PC freezes and crashes due to loss of power (most firewalls consume a lot of power/memory).

How To Get Out Of Trouble

OK. Let's say the worst has happened and you tried to run more than one AV and/or firewall. You're stuck with a machine that has no internet connection (if you're lucky) or has crashed or keeps crashing when you try to use it for anything other than ornamentation.

If your problem is two competing AVs, the solution is Safe Mode, to manually delete every trace of the two AVs in safe mode. The first thing you do is turn your PC off. If you can't do it through Start, Turn Off Computer. Do it manually. Hold the Power button down for a five count or until it shuts down. Wait a minute or two and turn it on again. As the PC boots up, tap F8 repeatedly until the Windows XP Advanced Options menu appears. Using the arrow keys on the keyboard, select Safe mode and then press Enter. Go through the uninstall procedure I outline here except include the steps in the Registry which I describe as optional and reboot only after you have finished all the steps. Your PC shut boot up normally and return you to your desktop with your PC functioning properly or at least well enough to get some help in a forum or email someone who can assist you further. If your problem is two competing firewalls, you may not need Safe Mode but you will have to delete one, (if not both) of the firewalls using the steps outlined as above in order to re-establish internet contact or to get your system running again.




PC Tips at PC1Stop

PC Tips 1	PC tips 2	PC Tips 3	PC Tips 4	PC Tips 5	PC Tips 6
PC Tips 7	PC Tips 8	PC Tips 9	PC Tips 10	PC Tips 11	PC Help Sites and Forums
PC1Stop Personal Tech Support

Internet Tech News



Back to Top



PC 1Stop Site Contents