What is Spyware/Malware?

In general, spyware is any technology that aids in gathering information about a person or organization without their knowledge. On the Internet, spyware is programming that is put in someone's computer to secretly gather information about the user and relay it to advertisers or other interested parties. Spyware can get in a computer as a virus or through a Web page, or it can come bundled with newly installed programs.

Malware is the term used for malicious software – software designed to specifically damage a system or its users.

Primary entrance points are where the malware can enter a system without requiring any pre-existing presence on that system. Such entrance points are: human operators, removable disks in the boot process, files incoming via diskettes, LAN shares, downloads or e-mail attachments, removable disks where AutoRun.inf is supported, data files (Office and HTML) where scripts are auto-executed, and, finally, hacking in through Networks such as the LAN or Internet.

How to Get Rid of It

There are many spyware removal programs available for free downloading. A couple of the most commonly used programs are Ad-Aware and Spybot (both available for free download at www.download.com).

These programs scan your system for known spyware/malware programs, display the list of offending items, and then offer to remove the problems. IMPORTANT: These programs need to be kept up-to-date to remove the newest spyware.

While these programs are very effective, sometimes they cannot remove all spyware. If you’ve run multiple scans with the updated software and still have a problem, you may need to seek professional assistance.

NOTE: While each program does a great job of removing malicious software, it is a good idea to run multiple programs, because each search scans differently (but don’t do multiple scans at the same time).

NOTE: Both programs are more effective when run in SAFE MODE. Install and update the programs in normal WinXP, but running the scans in SAFE MODE greatly increase their effectiveness.

Installing Ad-Aware SE
Running a Scan with Ad-Aware SE 1.06
Installing Spybot Search & Destroy
Running a Scan with Spybot 1.4

Ad-Aware

Ad-Aware is a free program by Lavasoft. It can be downloaded by searching for "ad-aware” (careful of the spelling) at http://www.download.com.

Installing Ad-Aware SE 1.06

• After downloading Ad-Aware (see paragraph above), double click the aawsepersonal icon.
• If a security warning pops up, click Run

  
• Click Next at the first screen to get to the License Agreement screen.
•  Read the License Agreement. If you accept the terms, check the “I accept the license agreement” box and then click Next.
• Make sure the “Yes” option is selected and click Next to uninstall previous Ad-Aware versions before installing the newest one.
• You should get a message that says “Uninstall Successful!” Click Next.
• Click Browse if you want to change the install’s Destination Folder. Click Next.
• Select the “Anyone who uses this computer” option (that way, everyone who logs into your computer will be able to use the program), and
  click Next.
• Click Finish on the next screen.

  

Running a Scan with Ad-Aware SE

• Start the program by clicking on Start, All Programs, Lavasoft Ad-Aware SE Personal, Ad-Aware SE Personal
• Click the in the top right corner to update the definition files.
  • These definitions tell Ad-Aware what to scan for.
    • If the definitions are more than 15 days old this step is done automatically for you. You’ll see this screen and click OK.
• In the Performing WebUpdate screen, click Connect to being the update.
• If there is an update, it will ask if you want to install the new update.
  Click OK.
• WebUpdate will update the definitions and the Connect button will become a Finish button. Click Finish to continue.
• We are now ready to start the scan. Click Start at the main Ad-Aware screen.
• Choose “Perform full system scan” and “Search for low-risk threats” to maximize search thoroughness. Click Next to continue.

  
• Ad-Aware should now be scanning your computer. As your computer is scanned, it will be sluggish. It’s a good idea not to use your computer at this time so that you don’t interrupt the scan. NOTE: All the bad numbers will show up in red. Don’t worry if the “Process Modules” or “Objects Scanned” numbers get very high.
• Once the scan is finished, your computer will sound an alert (through your speakers). The screen gives you a short summary of what was found during the scan. Click Next to move to the next screen.
•  In the Scanning Results screen, right-click below the list (in the Scan Summary) to get a menu of options. Choose Select All Objects from
  the options.
  
• Verify that all items are checked under the Scan Summary tab and
  click Next.
• Ad-Aware will ask you to confirm the number of objects to be removed. Click OK.
• Some spyware cannot removed unless the scan is run after the computer has rebooted. If you are asked to run a scan at next boot, click Yes or OK and then reboot the computer when you are ready. Otherwise, Ad-Aware will take you back to the main screen. Click the Red X in the top right corner to close the program.    

Spybot Search and Destroy 1.4

Spybot is a free program by Safer Networking Limited. It can be downloaded by searching for “Spybot” at http://www.download.com.

Installing Spybot Search and Destroy 1.4

• After downloading Spybot (see paragraph above), start the install by double-clicking the spybotsd14 icon.
• If a security warning pops up, click Run.
  
• In the next window, choose your desired language and click OK.
• Click Next at the first setup screen to bring up the License Agreement. screen.
• Read the license agreement. If you accept the terms, choose “I accept the agreement” option and click Next.
• Click Browse if you want to change the install’s Destination Folder.
  Click Next.
• Select the options you want to install (everything except Main files is optional), and click Next to continue.
  
• In the Select Start Menu Folder screen, make sure the “Don’t create a Start Menu folder” box is unchecked, and then click Next.
• Uncheck all the options on the Select Additional Tasks screen (especially the SDHelper and TeaTimer options) and click Next.
  
• The Ready to Install screen should now be open. Click Install to begin installation.
• Click Finish to finish the installation.

Running a Scan with Spybot

• Start the program by clicking Start, All Programs, Spybot – Search & Destroy, Spybot – Search & Destroy.
• The first time you run the program it will go through a Wizard. You can follow the Wizard if you wish, but it will only show up the first time, so this handout goes through the standard steps.
• Click the Update button on the toolbar on the left side of the screen.
  
• In the Update window, click Search for Updates to see if there are any new updates.
• Right-click on the listing in the bottom (where it shows all the updates) and choose Select All from the pop-up menu.
  
• Click Download Updates to begin the downloading and installation of the definition updates.
• After it is finished updating, evaluate the lower part of the window. If any of the items do not have green checkmarks by them, repeat steps 3-5.
  
• Click Search & Destroy from the toolbar on the left side of the screen.
  
• Click Check for Problems to begin the scan.
• During the scan, Spybot will list the spyware it finds in the lower part of
  the window.
•  After the scan is complete, make sure all the items in the list are selected, and then click Fix Selected Problems to begin spyware removal.
• Spybot will ask you to verify that you want to remove all the entries.
  Click Yes.
• Spybot will create a System Restore point and then remove all the entries. It will bring up a box to let you know when it is finished. Click OK.
•  Some spyware cannot be removed unless the scan is run after the computer has rebooted. If you are asked to run a scan at next boot, click Yes or OK and then reboot the computer when you are ready. Otherwise click the Red X at the top right of the screen to close.
• Immunizing with Spybot

Spybot has an additional feature that helps keep known pests from installing themselves on a system. The action, rightfully called “Immunize,” is quick, easy, and built into Spybot

• To immunize, click the Immunize button on the toolbar on the left of the screen.
  
• Spybot will automatically run a quick check to see how many items are blocked or able to be blocked. If additional spyware is able to be blocked, Spybot will pop up a message that asks you to immunize. Click OK.
• Click the Immunize button on the top toolbar to have Spybot immunize with the current definitions.
  
• Spybot will finish immunizing and then alert you it is done. You can close Spybot by clicking the Red X at the top right corner of the screen.

 

Advanced Spybot Tools

• Click the “Mode” menu button and choose advanced mode.

• Click the “Tools” button to bring up selectable options on the right side

• Make sure the “ActiveX” and “BHOs” options are checked
• Click ActiveX in the left hand menu to display the installed ActiveX controls

• Click on each control to get its Name and information.
• Remove everything except the “Microsoft Genuine Advantage Validation Tool”
• You are removing programs installed in IE.
• You CAN remove everything, when you go back to the site that is looking for the control, it will just ask to reinstall it.
• Click “BHOs” in the left hand menu to display the installed Browser Helper Objects

• Click on each item to get its Name and information
• Remove all  entries you don’t want.
• BHOs are the toolbars and add-ins in your web browser. Unless you absolutely HAVE to have the toolbar, it’s better to uninstall it.
• The less BHOs you have, the faster your browser will run.
• Click “Hosts” in the left hand menu to display the Windows Hosts file

• The hosts file should be empty except for “localhost….127.0.0.1”
• Remove all other entries in the hosts area.
• After you remove all the other entries, you can optionally choose add a safe-list of addresses that are damaging to your computer
• By adding them into the hosts file, your computer will not be able to get to the sites, keeping you safe.
• You can close Spybot by clicking the X at the top right corner of the screen.

 

Getting into Safe Mode

There are two ways to get into Safe Mode:

1. Tap the "F8" key on the keyboard at the very first screen when booting up your computer (when it says DELL or TOSHIBA or GATEWAY)

or

2. Click START and then click RUN

• Type "msconfig" and press OK

• Click the BOOT.INI tab
• At the bottom, put a check in the box with "safeboot"

• Click APPLY and then OK. You will be asked to restart your computer.
• Click RESTART to restart your computer
• UNCHECK THIS BOX TO GO BACK TO REGULAR WINDOWS!!!!