Right - here's my average user's guide to manually removing what you can. Often AV and anti-malware programs won't remove or detect a lot of things, so the only option is to do it yourself.
This guide is by no means for idiots; you will need to know what you're doing, but you can't really do any damage. It's also not entirely comprehensive but seems, in my experience, to often be all I need to do. After having cleaned many a malware off the office PCs I have a little idea.
----
Before you start
* ensure you have up-to-date versions and definitions for Adaware and Spybot S&D. Run automatic scans using both (not at the same time) and remove anything they find.
* try - though spyware may have buggered it - to install all the latest Windows Updates
If you use IE, make that safe first
Internet Explorer users should close all but one IE windows and go into their settings (Tools > Internet Options). There:
1. on the first tab, delete cookies and temporary files
2. on the security tab, click on each content zone icon and choose 'Default Level'
3. on the Programs tab, click 'Manage Addons' and choose 'Currently Loaded'. Disable everything you don't recognise.
4. on the Advanced tab, click 'Restore Defaults'
This should have helped secure your current IE environment. However I strongly recommend switching to another browser such as
Firefox before you go any further. If not, careful not to visit any sites bar the Google results before you finish making it safe!
Loaded Processes
Next, press Control-Alt-Delete and choose Task Manager. On the Processes tab, sort them by name and run through the list. Google anything suspicious; for example, on mine, what is 'mcvsftsn.exe'? The first Google takes me
here where I find it is part of McAfee Virusscan, which I run and expect to be there. However let's say I have smsss.exe (note the three trailing Ss) running too. This takes me
here and I find it is a worm.
Write the process names down. Make sure you read the Googled descriptions carefully and assess if it really is a worm. If a little technically savvy, you should also look at certain Google results like Symantec to assess what damage it has already done; for instance sharing all of your computer's drives on the network.
If sure, end the task in Task Manager. When you're confident that they're
all ended, your current working environment is safer.
Delete the process files
With anything you do find and
are sure about, you need to search 'My Computer' for that filename - including hidden or system files - and delete it. It will not let you delete it unless you have successfully ended its process, or associated processes, in Task Manager. The search is guaranteed to find at least one result if you have done it correctly.
If you are turning up results located somewhere within the Program Files directory, e.g. 'C:\Program Files\Generic Web Helper\', it is probably safe to delete the folder that contains them; judge for yourself.
There are more things to check in this area. A nasty example I had is that some malware had put an installer in C:\. It also put an autorun.inf on C:, so that every time you clicked the drive, it would launch the dodgy software. It should have remained as a process, so now has been deleted, BUT, of course it's still a potential way for it to get back.
Remove the links to them
That should have partially prevented them from loading. You now want to remove the broken links that started these things up in the first place. There are a number of different ways. The first thing to check is Start > Programs > Startup. Delete any shortcuts you don't recognise/need. Those were the easy ones. The harder ones are buried in the registry.
The simplest, safest way is to run 'msconfig'. On the 'Startup' tab, check through each entry and uncheck the box where necessary to prevent it loading. The 'command' column gives you a good idea what is dodgy as it tells you where the program is located. For advanced users, the 'location' column tells you what registry entries to delete should you desire - if you don't understand this, don't do it!
Having done that, each time you boot up, the system will tell you that you are not loading all configuration items. It is easy to suppress this warning via the presented options. The proper way to do it is to remove them permanently from the registry but as said, this is more complex.
Check again after reboot
Now reboot, and run through the Task Manager checking part of this process again. You should be clean; if not, you haven't cleared everything properly and you'll have to run through the rest of the steps again for those process names.
As mentioned previously, now would be a good time to check and repair the damage. Unshare network drives in case other machines on your network are still going to infect you - though any good anti-virus should pick this up as it occurs.
Hope that helps.
I want my pc back
