The Mudcat Café TM
Thread #78402   Message #1409165
Posted By: JohnInKansas
14-Feb-05 - 08:51 AM
Thread Name: Tech: Can this be fixed without a technician?
Subject: RE: BS: Can this be fixed without a technician?
To answer, sort of, Ranger Steve's original question, "Is there a way to fix this without taking the computer to a repair shop?":

1. Fixing most such problems is relatively simple, since there is some good free software available that will do most of it for you.

2. Fixing problems of this sort yourself is good for you because it will help you understand what is "out there" that is dangerous.

3. Fixing the worst of such problems can be among the most difficult "mainenance" things you'll need to get done, if you've run into a particularly nasty case; and even experienced users often need help.

One of the first things you should do is to make notes about what your crudware does. Check the address bar and write down where the new toolbar is connecting you, and any "labels" that apply to the toolbar. If you can remember, make a note of where you were when the popup appeared.

DO NOT start blindly deleting things until you have made a plan, and figured out what needs to be done.

Since you haven't said what operating system you're using, I'll assume WinXP. Specific steps may differ if you use something else, but the general principles are the same.

In WinXP and/or WinME you should turn off System Restore before starting a cleanup. Right-Click on My Computer, either the desktop icon or in Windows Explorer. Click the System Restore tab and click to put a check mark in the box for "Turn off System Restore on All Drives." Click "Apply" and then "OK" to exit. System Restore keeps copies of Registry entries in a restricted folder that CANNOT be accessed by any external programs. If a Reg copy has been made since your machine was attacked, System Restore could put an "infected Registry" back into use, effectively reinstalling what you've removed. Turning it off deletes all old copies. AFTER you're cleaned up, turn it back on and new backups will be made everytime you turn off or restart the computer.

It's a good idea to run a disk cleanup (Start – Programs – Accessories – System Tools – Disk Cleanup) and clear all the temp files, especially temporary internet files, before doing any general maintenance.

Some hijacker programs will actually "register" themselves in Windows so that you can uninstall them. You should go to Start – Settings – Control Panel, double-click Add or Remove Programs and look to see if you can identify the toolbar that was installed. If you do see something here, you should click on it and uninstall it. If the program is here, it means that a log was made during installation, and removing it here can read back the log and is most likely to do a complete removal.
a. Don't be surprised if it doesn't appear, since much spyware hides it's installation.
b. Even if the program "uninstalls," stuff like this often has additional associated malware that is hidden from Windows.

Download one or more of the recognized AntiSpyware programs. Note that some malware of the kind you described may try to prevent you from going to AntiSpyware download sites, although it's fairly rare.

Recommended Practice: When downloading programs, you should generally save the download to disk. Install, usually just by double-clicking the downloaded file, only after the download is complete. Make a "Downloads" folder, and put each download in a separate subfolder with the program name on it so you'll remember what it is later.

Spybot S&D has been highly recommended by most tech resources in recent months. It has some of the best removal capabilities around, and you should have it on your machine to scan regularly even when you don't have a problem. (Take a moment to read messages at this site to get an idea of how dirty this business is.) READ the tutorial. Then READ the tutorial. Then download the file. Install and Run.

Since there is no general agreement on what actually is spyware, and since new ones appear almost daily, it is strongly recommended that you scan with more than one program on a regular basis, and of course any time you have, or recently had, a problem. For general users, Lavasoft Ad-Aware is probably the most commonly recommended second program. You should go to their site. READ their tutorial/instructions, Download, install, and run the program. Do this even if it looks like Spybot cleaned up your problem.

Note that Ad-Aware uses a "more paranoid" definition of what actually is spyware. It likely will find a lot of "adware" that other AntiSpyware programs ignore as "annoying but harmless." "Fixing" this stuff is also "mostly harmless," but Ad-Aware does also do a pretty good job on the real malware.

Also note that most "file sharing" and "music sharing" programs contain spyware, and letting an AntiSpyware program remove the spyware component will probably make the programs stop working. Kazaa is the notorious example, but most music download programs track everything you download (so they can let the RIAA sue you instead of them).

If running Spybot and Ad-Aware doesn't clear your problem, then you probably don't have one of the easy ones. The best help for more serious problems can be found at one of the support sites like Major Geeks. This is also where you get "advanced user" programs like Hijack This. The usual procedure on such sites is that they will tell you what things you should do first, they will specify a particular program you should run to make a log of what's on your machine and what it's doing. You post a request and the log, and an expert volunteer tells you what to do next.

If you need to proceed, you should go to the Hijack This link above and read the "Basic Spyware, Trojan And Virus Removal tutorial" from the link about halfway down the page. If you want help from this site, or other similar sites, it is imperative that you follow instructions exactly. No shortcuts. If you follow the instructions in the "Basic tutorial," including downloading and running all 12 of the specified AntiSpyware programs (including the 2 above), and still have a problem, then READ AND FOLLOW the "official Hijack This Tutorial And How To Post Your Log File" from the link just below the "tutorial" link. In their words, this "can help you analyze your log file or explain how to post it so we can analyze it for you."

If you've reached this point, and you don't think you can follow the instructions, then the answer is "take it to the shop," although most of these volunteers appear to be pretty good.

As supplemental info, for others who might need help, or just want to look at what's "out there, "there's Alliance of Security Analysts which provides links to similar (mostly) volunteer sites. Take your pick from any in the "Recommended Sites" sidebar on the left. I haven't looked at many of them, so I can't make any recommendations.

John