The Mudcat Café TM
Thread #108827   Message #2280716
Posted By: JohnInKansas
05-Mar-08 - 07:36 PM
Thread Name: Tech: Unwanted 'Spyware Remover' (& cat)
Subject: RE: Tech: Unwanted 'Spyware Remover' (& cat)
Joe -

If Spybot S&D finds new stuff on a second run, assuming you haven't been browsing and pickup something new between the runs, it's likely that something that Spybot removed has been reinstalling itself. This would be most likely to happen with a reboot.

Some spyware/malware can do this by putting an "install file" in the Startup folder - the launch platform for stuff that's loaded at each reboot. It can also come from a Registry entry that calls for a reinstall.

System Restore can be very helpful if needed, but can reinstall malware at reboot in some cases. When you boot, the Registry is examined for changes, and if something has been removed that's "needed" (a file that's set to run asks for it?) the system looks for a backup Registry copy made by System Restore and puts the Registry entry, and sometimes the file, back in place.

To avoid "comebacks," when trying to remove seriously embedded malware, it's necessary to TURN OFF SYSTEM RESTORE before going through the motions to try to remove stuff. When you turn off System Restore, all prior Registry copies it's made are DELETED so they can't be used to put the malware back.

The usual recommendation is that you make a manual backup of the Registry somewhere so that you can (manually) restore from it if everything turns to shit. Then turn off System Restore to remove any other possibly infected copies so the system can't automatically reinstall the malware every time you reboot.

The "MalwareAlarm" link above at 04 Mar 08 - 09:36 PM tells you what to delete for one of the problems you've probably been fighting with. Note that you can't delete a program that's running so you may have to fight with using Task Manager to turn things off, or may have to resort to a Safe Boot to be able to get rid of some things. Also note that when searching for files in Win Explorer you need to turn on the "Search Hidden and System Files" in the "Advanced" section of the search input.

If you can delete enough of the files the malware uses to get it crippled, and can prevent System Restore from putting them back, you may get "Registry Errors" saying something like "File Not Found" when you reboot. An accurate identification of the "missing file" usually will let you search the Registry for the entry that's calling for it, so you can clean up the Reg files, if that's also needed.

Even if the cat did it, she's probably too subtle to tell you how or to offer help. (Even waterboarding is generally ineffective for cats, and more likely will cause injury to the interrogators.)

John