Removing SpyWare Manually - Part1
You may have tried everything, you may have downloaded every Anti Virus program you can think of - nothing works. For whatever the reason lets say you want to try and remove that virus/spyware manually. This tutorial will help you do that. It won't be easy and you may want to pull your hair out, the choice is yours. Remove it manually or take it to a repair shop?
Ok so we want to remove a Spyware program manually, lets get started. First things first when removing Spyware is to find the program that is causing the error. Typically these programs have names that make them really easy to spot such as jlkelekkl.exe or some random string of letters put together. It won't be easy to do this alone so lets get some help.
HiJack This
This program is great, basically a better version of 'msconfig'. HiJack This will show you all the process that are set to startup when your computer boots up. Everything is listed here. I must warn you if you are not careful you could disable the wrong thing and make your operating system unusable so please proceed with caution and I'm making no guarantees.
Lets start HiJack This
HiJack This's start up screen
Lets click on 'Do a system scan and save a logfile'.
Now lets take a look at the output and see what came up. (Note: The option we selected will also bring up a notepad Window with this information - for now we will disregard that information). You can see where I have high lighted below some bad stuff, take a look.
Our 'hosts' file has a ton of static entries. Basically when your computer goes to get on the Internet before it even tries to find out the address it checks a local file first. The virus/spyware has put fake information here, look at the address above you can see its trying to stop you from connecting you to Yahoo and putting a bad IP address in between. That IP address is probably a web server just dying to load you up with more spyware. Make sure all the above check boxes are checked where I have high lighted - you really should not have any static entries in your host file.
Other than that you want to look for anything suspicious. Now what is suspicious? Well anything that looks like jdjllee.exe, 1l1l1kek.dll, you get the idea. Random letters and numbers are pretty much a dead give away. If you are unsure then you may want to ask a professional. Feel free to comment this entry and I'll let you know for sure. You can even send me the log file we created, just email to tom@ccexperts.com.
Scared?
If you think for a second you may be disabling something your computer actually needs you may want to use 'msconfig' instead. It won't show all the detail that HiJack will but it will show some, and the best part is you can always put the check mark back and renable the item. Msconfig is much more forgiving than HiJack This. HiJack this is typically a tool for the pros so please be careful.
Once the bad files have been checked then we hit then 'Fix Checked' and just agree/bypass any of the messages that follow. This will remove them.
What exactly this does
HiJack This will remove the programs so that they do not start up the next time your computer starts. That's exatly what we want, however spyware programs can be more trick and have other tricks, we have to worry about:
- The virus coming back
HiJack doesn't delete anything just removes the reference to the file. Sometimes other hidden files may trigger the virus to return. So what do we do? We have to delete the file. - Unable to delete the file
Yep you guessed it. You can't just right click on the virus and 'Delete'. This programs are very hard to remove and will require additional (free) software and perhaps a boot into Safe Mode. - All Virus programs are not startup based
Some Virus/Spyware programs are extensions of your web browser. Internet Explorer is known for this. How do we clear them out? They really aren't that hard, we'll cover that in the next part.
So this pretty much wraps up part one. First step is to try HiJack This, you can stop here if you want you may get lucky and the spyware programs may not come back. However ... they probably will. That's ok this is only the first part. Whenever I troubleshoot a spyware infection I start with HiJack this and begin to clear it out. Stay tuned for part two!
