=>Your Guide to Spyware - by Nahirean

[nahirean]

Spyware Destruction Guide by Nahirean


"What is the difference between unethical and ethical advertising? Unethical advertising uses falsehoods to deceive the public; ethical advertising uses truth to deceive the public."

Vilhjalmur Stefansson (1879 - 1962), "Discovery", 1964


Section 1: The best defense is prevention.


As the title of this section states, the best defense against *ANY* malware is prevention. If you aquire spyware on your machine it is almost certainly the fault of the user. Before I begin, I'd like to describe what "firewall" and/or "special" software I have on my machine to prevent the aquisition of virii and malware:

I have none. I don't have any virus scanners, no firewalls, zero - zip. And I have absolutely no spyware or virus issues. You are in absolute control of

your machine until you allow a program to compromise that. The key is not doing so.

Onward then! Into the breach!


[Please note, if your machine is laden with spyware/malware scroll down to the section of this guide that deals with eliminating it.]


Section 2: Immunization.


Many (and I mean thousands) of known spyware exploits, registry modifications and programs can be stopped dead in their tracks by certain forms on immunization. For this you'll need a few programs that do this quickly for you. (Assuming you don't want to research every variant of spyware and make the changes yourself.)

Here are the applications that are essentional to IMMUNIZATION:

Spybot - Search and Destroy. Link: http://www.safer-networking.org/en/download/

This application not only detects and removes spyware, but it also IMMUNIZES your machine against many common threats. Download the application, update the routines, and immunize if you've not already done so.

Spyware Blaster. Link: http://www.javacoolsoftware.com/spywareblaster.html

This is another excellent application that provides all sorts of immunization and browser tweaks. Another essential. Download this, update it and immunize against everything.

With these two applications you can make your machine invulnerable to over 3,000 known spyware and malware exploits. A good place to start.

Here are the applications that are essential to eradicating spyware forever:


Microsoft Anti-Spyware Beta. Link: http://www.microsoft.com/athome/secu...e/default.mspx

It may be somewhat surprising to learn that Microsoft has taken over the license for a product that provides decent spyware removal and prevention. Here it is, another essential. Download it and run it.


HijackThis. Link: http://www.spywareinfo.com/~merijn/downloads.html

This is a brilliant application. It allows you to check for alternate data steams, and most importantly allows you to easily access the registry entries pertaining to Internet Explorer. This is where *MANY* spyware threats tend to hide themselves, with this you can track them down and remove them.

AboutBuster. Link: http://www.besttechie.net/tools/AboutBuster5.zip

It can be a bit hard to find a link for this software, so I suggest you download this now. This is *THE* tool from removing bad data steams. These are feeds to the advertising companies that monitor you. If you detect alternate data streams, you KNOW you have spyware installed and need to use the above programs to attempt to remove it.


Trend Macro Web Antivirus. Link: http://www.antivirus.com

This is the ONLY virus scanner I use. There are several reasons.

#1: Running a local Virus application only subjects it to attack by trojans and malware.

#2: They constantly update their virus database.

#3: This application now searchs for all known SPYWARE in their database. This is a great service, and it's offered FREE through their web site and I've been using it for years. Use it often.. it's a lifesaver.


Easycleaner. Link: http://personal.inet.fi/business/toniarts/ecleane.htm

This is not for spyware, but it's a nice tool to quickly access what's in your windows startup, registry errors, et cetera. Download it.

All of these applications are wonderful pieces of software, and they're all freeware.


Section 3: Regular Maintainence.


Evil companies are constantly trying to formulate new ways to infect your machine with all sorts of negative software. This gives you a choice if you wish to use the Internet: Maintain your machine against such innovation, or subject yourself to alternate data streams. Running the aforementioned programs (Spybot, and Spyware Blaster) at least weekly is an excellent way to prevent your machine from being compromised. It's essential to note that some spyware applications take active measures to DISABLE or crash these applications, so it's good to catch problems before they occur. Run your applications, and run them often.

I do *NOT* suggest running them with Task Scheduler or leaving them in Windows Startup. Leaving them in the startup reduces your system resources and many malware applications modify your windows startup which can cause them to inbed themselves further if they detect counter-measures.

Run these and run them often. Aside from your competence, it's your front line defense against malware.


Every week I suggest running the applications in this order.

1: Easycleaner. Check for anything odd or suspicious in the Startup list. Also it can't hurt to clean out your Registry.

2: Microsoft Anti-Spyware. This application is quite powerful and will help you remove problems.

3: Spybot Search and Destroy. Once a week check for updates to the immunization database and run the scans, obviously - remove the culprits.

4: Trend Macro Antivirus. The best way to scan for Virii and threats to your machine.

5: Spyware Blaster. Run this often to check for updates, install them if they exist and immunize your machine.


Section 4: Common sense.


I am not trying to insult anyone here, but many infections can simply be avoided by using common sense. Don't open the e-mail attached file that says "penis.scr.zip" or, "AmericanFlagYay.zip.vbs" and the like. I am not here to judge the web content you browse, but you should know that many genres of web sites are much more pronse to distribution malware. Here's a small list.

Porn
Warez
Many "video game" sites

If it doesn't look official DON'T OPEN THE PAGE. I don't suggest referring to links given to your through alternate sources unless you absolutely trust whoever gave you the link.


Section 5: I'm infected.


You probably realize that you're infected with a horde of spyware if you are. Your machine is slow, you have all sorts of icons placed on your desktop that you didn't authorize, your homepage in IE keeps changing, you get popups even though you have a popup blocker, your machine randomly reboots, you get MS Messager messages popping up for no reason, etc.

You're going to have to attack these problems. Contrary to what some people will tell you it is possible to recover from almost any malware infection without having to reinstall your operating system. Sometimes it's simply easier to do so, but not everyone has the luxury of backed up data. Here are my suggestions. First, boot up normally and download every application that I cited. Do not visit www.antivirus.com yet.

Second, once every application is downloaded reboot your machine and enter Safe Mode. You can do this by tapping the F8 key while your machine is booting and choosing "Safe Mode" from the list. Once you've done this, install every application I listed above.

Once installed, the first thing you need to run is Easycleaner. Open it up and navigate to the "Startup" icon and take a look at everything that is running when your machines boots up. Chances are, if you have an infection this list is going to be riddled with odd programs and dll files. Now you've confirmed it.

Close easy cleaner for now and run Aboutbuster. Let is go through it's process and it will close down any bad data streams that. It will run again, and let is close down explorer.exe. After this is completed (chances are you found at least 1.) run Spybot.

Run a system scan with spybot and delete every infection you find. After doing this close Spybot. After closing Spybot repeat this process again, and chances are you'll find some more than either Spybot missed - or have since replicated themselves.

Now run HijackThis and take a look at the installed BHOs (browser helper objects) that appear. Remove anything that looks suspect. Scan for bad MD5 streams with HijackThis as well.

Open up Easycleaner again and remove ANYTHING that is even remotely suspect from your Startup Menu. In this case, it's better to be safe than sorry - so be liberal. After you've done this, you need to give your machine a COLD BOOT. This means flipping the power switch on the power supply, or simply unplugging the machine. The reason for this is that many malware applications will replicate themselves upon Windows Shutdown. So switch your machine off (NOT BY HOLDING THE POWER button.)

Boot up normally.

Run Spybot again, and see if it comes up clean or if your machine is riddled with spyware again. Clean it if it is, and Immunize.

Run SpywareBlaster and immunize.

Go to Trend Macro www.antivirus.com and run a Free Online scan for both Virii and Spyware. Remove any infections you have.

Open up Easycleaner again and check your startup list. Are they back? If so they're replicating themselves and the problems are imbedded.

Run Microsoft Anti-Spyware Beta and remove any infections it finds.

Run Aboutbuster again. This time it may find even MORE bad data streams because you're not in safe mode.

Run HiJackThis again and remove any bad BHOS and check for MD5.

COLD BOOT your machine again (by switching it off from the PSU, or unplugging it.)

Now repeat the above steps until you're satisfied with your start-up menu and results from all of the applications.

[a note on embedded malware]

If you follow this process to a "T" then you will eradicate 99% of the spyware on your machine. If you happen to be one of the unlucky ones who has what I like to call an "embedded" piece of malware, then it's going to be an uphill battle to remove this. You'll need to search the web and hit up the anti-spyware forums for your specific information. You have all the tools you'll need, and they will most likely ask your for your HiJackThis logs. By their nature embedded pieces of software are notoriously difficult to eliminate - but I know from experience that it can be done. It's going to be a hassle, but you can learn a lot from this experience. The reason they are so difficult to eliminate is that they're constantly altering themselves and changing.

They are also littering your machine with plauged .DLL files that future versions of the mutant-program can accesss and use. Those guys at the forums have a long history of dealing with these issues and can be a good help for you. Here are some good forums to start with: http://forums.net-integration.net/

You can also check out the forums for the various applications I listed above.

Thank you for your time. If you need help with a specific trojan or piece of malware, feel free to PM me here on the forums.


Section 6: Disclaimer.


This document cannot be reproduced in any shape or form without written permission from myself, (Nahirean). I am not responsible for any damages incurred on your system as the result of following this guide. I do not claim that you can be safe from spyware of virii.

[Lee1026]

Much easier way:
1. Run some kind of program that let you keep track of what programs are being run when you first start a machine.
2. Forbade the spyware from running.
3. there is no step 3.

[nahirean]

Sometimes these "Applications" aren't actual applications. They can be registry settings, BHOs, many different things. That will not work at all as a preventitive measure. Some of them activate when IE is activated, which is not when the machine boots.


[edit]

If you'll provide a link to this "some kind of program" I'd be happy to check it out and see if it can be useful. I've used these methods for a long time and have succesfully and completely removed spyware from many different machines.

[Lee1026]

well, microsoft anti-spyware does the job of telling me what runs when I first boot up the thing.
As for booting up when IE starts, I was under the impression that everyone on planet earth that knows about spyware is also using firefox by now.

[nahirean]

Right. Microsoft Anti-Spyware is the solution to all of the spyware needs? You've obviously not encountered some really bad ones. I don't use firefox, I use Internet Explorer.. the fact is there are many people out there that can use this guide and can benefit from it. By the way, Mozilla is not immune to spyware either.

[edit] Also, Microsoft Anti-Spyware does nothing to prevent the more advanced malware that does not embed itself in the startup list.

[Lee1026]

It does the trick for most of the spyware needs. You can name all the "really bad ones" that you want, but a quick scan though the task manager list will still expose them. After that, it is a simple matter of writing down the name, safe mode, search and then delete. (I only had to do this once)

and while firefox is not exactly immune to spyware, I have yet to see any spyware attaching it self to firefox. And spyware won't exactly be very useful if it does not start ever, now would it?

[nahirean]

It does the trick for most of the spyware needs. You can name all the "really bad ones" that you want, but a quick scan though the task manager list will still expose them. After that, it is a simple matter of writing down the name, safe mode, search and then delete. (I only had to do this once)

Ok, this is absolutely false. I cannot even begin to explain how wrong you are. Some of the pieces of malware I am talking about replicate themselves, go ahead and delete the exe you see. It will still be there next time you reboot, just with a different name. Next time you run the Windows shutdown script, it replicates itself three or four more times. I've seen this time and time again. Are you speaking from your experience with your own computer, or do you work in this field? There are things that embed themselves on multiple levels, and a solution like that will fix it for about 5 seconds.

and while firefox is not exactly immune to spyware, I have yet to see any spyware attaching it self to firefox. And spyware won't exactly be very useful if it does not start ever, now would it?

Wrong again. There is spyware that specifically targets Firefox that behaves the same way, even Spybot finds the Mozilla stuff that acts in that manner.

The fact is my guide will do more to eleviate spyware than what you're suggesting.

http://searchsecurity.techtarget.com...104416,00.html here's a guide that basically points out that folks who trumpet Firefox are a bit shortsighted. It's had many security flaws just like Internet Explorer.

[Lee1026]

well, it does say that firefox have not been targeted yet, and the speed of its upgrade will probably ensure there will never be any spyware that can attach to firefox.

Ok, this is absolutely false. I cannot even begin to explain how wrong you are. Some of the pieces of malware I am talking about replicate themselves, go ahead and delete the exe you see. It will still be there next time you reboot, just with a different name. Next time you run the Windows shutdown script, it replicates itself three or four more times. I've seen this time and time again. Are you speaking from your experience with your own computer, or do you work in this field? There are things that embed themselves on multiple levels, and a solution like that will fix it for about 5 seconds.

how wide spread are they? what are the chances of any of us getting hit by it? (betting it is astronomically low)
edit - so it replicates itself when I shut down the computer? so what if I use the reset key on my case? problem 1. problem 2: they need to start sometime. I made sure that nothing can start when I start the machine. the link that you pointed to says nothing attachs to firefox, then how in the hell are they supposed to start? attaching themselves to doom3 or something?

[Marshal Qin]

does it matter? If there is a chance, then thats more chances than I'm willing to take.

I have thousands of amateur hackers where I live in central China who attempt to destroy people's computers just for the 'fun' of it. If only I had some way to pay them back for all the trouble I've had with my computer....

thanks nahirean

[Pent uP Rage]

Good guide, dude. Potentially very heplful. Somebody ought to pin this one. I see you didn't mention Ad-Aware though. Adaware with Spybot has NEVER failed me. I also like to run the Adwatch that comes with Adaware. This runs in the background as you're surfing and will notfy you of malicious script before it gets in.

[haloband]

Wow lee1026, why would you want to argue against nahirean's helpful spyware guide? All he is doing is providing people with a guide to make their computers more secure. Not everyone here has the "know how” and nahirean has provided them with a solid foundation to work from. Instead of arguing, why not contribute to his list, or start your own.

I very much appreciate the list of programs, I knew about most of them but I will definitely give a couple of the others a try.

[nahirean]

Thanks PUR,Halo and MQ.

To PUR: The reason I didn't include Ad-Aware is that sometimes Spybot and Ad-Aware have had counter issues. I think these have been resolved, but with so much overlapping spyware protection I didn't think it was necessary. If you wish, I can include it. Also.. I am a bit "Overzealous" when it comes to optimizing my machine - I don't have anything running in the background and I didn't want to suggest that. But I am certain it's quite useful. I'm glad someone got some use out of this anyhow..

[Emperor Dimitricus]

i too have always used spybot with ad-aware, never had any problemss. altough after reading your guide, i installed spyblaster, and was surprised when i opened up spybot with it saying somthing like "you have spyblaster installed. spyblaster features better protecion against active-x controls. click here to start spyblaster"
very good guide, and i agree with haloband, not everyone has the know-how to keep on goin into task manager and shutting down the program etc...
like you said, it only closes the .exe, the spy/mal/adware is still there.
nice one

[sunsmountain]

First off, halleluja! Finally a good/excellent guide to Spyware!

In the end it comes down to immunizing your system, as you have pointed out. I currently have 2 solutions, a hardware router (effectively a firewall), and firefox. I don't think your guide is complete without at least mentioning Firefox.
www.mozila.org/firefox

After using 1 year of Internet Explorer:
More than 200 forms of spy/adware on my system. Especially the hacker/trojanware motivated me to format hard disk and re-install windows xp. Deleting one file surely doesn't help, the software only needs to nestle itself into your registry (in usually 20 different keys, which you are NOT going to remove by hand - too laborous).

After the next 1 year of Firefox, same behaviour, sites, bad sites included :
1 adware program installed itself, and that with my explicit consent. (came with other software i wanted to install)

The facts speak for themselves, even though spy- and malware MAY be written for Firefox, it is inherently safer, natively a Gecko engine with far fewer vulnerabilities that need immunization. If you don't need immunization in the first place, then why would you need to install 5 programs to patch up IE? (there is a reason, wait i'll get to it)

I agree, i have had good experience with Spybot, and Adaware (though that is shareware, iirc). The most important thing for me is windows performance: If the program needs to start up everytime i boot windows, it's a nono. If it's shareware, it's a nono. But the 5 are freeware and they only run when you tell them to, right? Intuitively, i feel the Microsoft antispyware and the spyware OR spyblaster to be enough. If you're hijacked, you need HijackThis and some level of understanding the registry to cure it.
Always use a good antivirus scanner of course, i use AVG from www.grisoft.com (their scanner also tracks spy and adware)

For some sites, IE is the only solution. Think about network folder sharing, or internet explorer mail through institutions like universities/schools, that are only made and possible to use with Internet Explorer. The way i tackle that is through first reading on the site whether the helpdesk reports infection, if the school network isn't infected, i can temporarily use IE. But i prefer Firefox, it is just inherently safer.

Also, I don't like updating windows too much with service packs and hot fixes, most of which are intended solely for Internet Explorer. Since i don't use that except in safe environments, i have nothing to fear. Of course Firefox has some vulnerabilities, but it's patched more often and more clearly, with far less patching needed (ie patches are small).

[makeshift52]

Thanks very much nahirean, has helped me lots!

[Tacticalwithdrawal]

many thanks for this, just followed all your steps and got a clean bill of health.

About to send the doc to my dad who is seriously infected

[nahirean]

Glad I could do my small part to help.

[fatsheep]

Very nice guide, this should help alot of people.

[NobleNick]

Nahirean,

Thanks! Very interesting guide. I am not having problems atm (because I follow your "prevention" regimen, fairly closely); but your guide has inspired me to go check again.

Using the "cold shutdown" in tandem with SAFE mode is something I hadn't thought of. I've used both, but not together. Neat.

I work for a very large company that is constantly the target of the entire spectrum of malware attacks. As a consequence, we have a small army of experts dedicated to prevention and cure. No, I am not one of them. But I did ask lots of questions and took copious notes when one of them was sent out to recover control of Internet Explorer after an attack on my machine. They fixed IE and a whole lot more. Here are a few things I found out:

IF prevention has failed, the first action by these pros is:

1.) Physically disconnect the machine from the office LAN.
2.) Run Spybot
3.) Run Ad Aware
4.) Run Webroot Spysweeper

I know there were some reboots in there as well, but I didn't take notes on that. There is lots of overlap between these three independently maintained products; but there are lots of areas that only one covers (and those areas change constantly); so use all three. Webroot is not freeware. If you surf a lot and have not ever run these, then expect to find HUNDREDS of malware entries.

As an aside: The last and ONLY time I needed help for my company machine, was before Microsoft's A/V beta was out. I have since then used it at home, with excellent results. If I had a problem today, I'd run MicroSoft's product along with the rest that are listed above.

5.) If that doesn't get everything, our experts resort to a small suite of in-house developed SW tools (which I won't go into, since I can't even get my hands on them, let alone you). It sounds like some of the tools you listed, Nahirean, perform similar functions to the custom in-house tools I saw being used.

6.) If even the specialized tools don't work, then the pros reformat the HDD. The tech that came out to help me said that she has had to reformat only one machine, out of the hundreds of calls to which she has responded.

[nahirean]

I certainly need to update this guide. It's a bit dated now. Hopefully I will have an update posted in a week or two.