By now you should all know that even the best spyware removal
software protects, but seldom removes spyware once it has infected the
computer. The main reason for this is that once your computer is
infected, the spyware loads itself in memory every time the computer is
started. In Windows no program that is actively running in memory can be
erased from the hard drive; it has to be stopped first. This is where
all antivirus tools fail. Another reason is that the spyware disables
most antiviruses and system tools that pose a threat to it, like for
example the Windows task manager.
Lately I’ve discovered a technique to remove almost all malware
infections. A technique that has been working reliably for me in a
surprisingly vast majority of cases and that can be followed step by
step and can be replicated for almost all types of adware or spyware. A
technique that will work better than any spyware removal tool you can
find. This technique works for all versions of Windows XP, Vista and
Windows 7. The pictures that you will see in this article are from
Windows XP, however, the steps are similar for all other versions of
Windows.
How to remove spyware - Method Summary:
- Open Task Manager as soon as you see the desktop.
- Write down the name of the spyware showing up in task manager and kill it.
- Look for spyware on c:\documents and setting\username\local settings\application data and delete it.
- Look for spyware in registry and delete every single entry as it appears.
- Create a new username, log in with new usermane, rename previous username account folder and reboot.
- Log in with your old usernane so that new profile folder can be created.
- Transfer your files from the old account folder to the current.
Step 1: Identify Spyware in memory and kill it
Turn your computer on and
as soon as you login and see your Desktop hit Ctrl-Alt-Del and click on Task Manager,
you have to do this fast otherwise the virus will take control of the
computer and task manager will no longer open. Once Task Manager is open
the spyware will not be able to close it.
Never close Task Manager or else the spyware you will not let you open it again unless you reboot.
As
soon as you see the spyware appear, (usually a fake anti virus
shield on the task bar near the clock) check the Task Manager for any
suspicious programs. It also helps if you sort items in the Task Manager
by memory usage, this way you will see all new applications as they
start popping up. How can you tell the application is suspicious? Use
common sense. The application popping up in this example has the name
“guxprpnshdw.exe”. As you can see, the name is just a bunch of letters
that do not make sense. Now that we have identified our suspicious
program, the next step is to get paper and pencil, and write the whole
name of the suspicious application making sure not to miss any letters.
Then, right click on the application and click “end task” to remove
spyware from memory. Once you do this, hover the cursor of the mouse
over the fake anti virus shield without clicking on it. If the shield
disappears, we know we have killed the fake anti virus in memory. If it
does not, we need to continue our search. Repeat the operation with
another suspicious-looking file in Task Manager until you find the right
one. Make sure to always write down the name of the file before
clicking “end task”.
Step 2: Remove spyware from hard drive and registry
Once you have the name of the file, go to “My Computer” and click on
Tools -> Folder Options -> select “View hidden Files and Folders“
. In Vista and Windows 7 go to Control Panel -> Folder Options and select “View hidden files and folders”.
Go to “C:\Documents and Settings\” or “C:\Users” in Windows 7 or Vista
and look for a folder with your username. If your computer logs in
automatically or you are unsure of your username, you can find out in
Windows XP by clicking Ctrl-Atl-Del and it will display who you are
logged in as. In Windows 7 all you have to do is click on “start” and it
will display your username on the top right corner of the menu; I am
not sure about Vista. Once you have identified your username go to the
following path “C:\Documents and Settings\username\local
settings\application data\”, and in Vista and Windows 7
it should be
either on “C:\Users\username\” or “C:\ProgramData\”. Once there, look
for a folder with a suspicious name. In this example our folder name is
“xyfbofkle”. Again, notice that its name does not make any sense. Go
into the folder and you should find a program with the name of our
previously discovered spyware, in this case “guxprpnshdw.exe”. If you
find the spyware,
write down the name of the folder and delete it.
Open the registry by clicking start -> run -> type “regedit” and click enter.
Look for every instance of the spyware’s filename using the registry’s
search utility and delete it. When you get to the end of the registry
repeat the operation, this time using the spyware’s folder name. This
should remove the spyware on your computer for good. However, there is
one extra step we must take to lessen the possibility of future
recurrence.
Step 3: Disable your old profile and create new one
To be on the safe side and prevent malware from ever coming back, we are
going to create a new user profile folder and delete your current one.
To do this, create a username and make sure to give it administrator
rights. Reboot your computer, (don’t just log off or switch users) and
log into your newly
created account. Then, go to your “C:\Documents and
Settings\” or “C:\Users\” (in Vista and Windows 7) and rename your
previous username account folder. I usually rename it with a “.old” at
the end. Example, if my original account folder is named
“\administrator\”, I rename it to “\administrator.old\” so it is no
longer recognized by Windows. Now reboot your computer again and log in
with your old usermane. This will create a brand new account folder
with your old usermane. Now, transfer everything you want to save from
your “.old” account folder to your new one. Don’t transfer absolutely
everything because you run into the risk of transferring whats left of
the spyware to your new account. I usually transfer the “My Documents”,
“Desktop”, “My Favorites” and nothing else. When finished you can
delete the “.old” folder and the account folder you created at the
beginning.
And you are done! as easy as that. No more spyware. This will not work
100% of the time because not all spyware behave exactly same, some can’t
even be terminated in the task manager; they just won’t close. However
it will work in the big majority of cases. and as I said before it will
work better than even the best spyware removal program available in the
market today. I can say with certainty that 90% (or probably more) of
the malware infections you encounter can be removed using this method.
