Scumware Removal

1
Scumware Removal
2
Are you Infected?

• How do you know if you are infected with
  scumware?
• If any of the following sound familiar

3
Popups

• A gangload of popups, even when not connected to
  the Internet.

4
Toolbars

• Internet Explorer toolbars added to your browser
  view and/or file explorer window. 95 of these
  toolbars are scumware.

5
Homepage Hijacking

• The inability to change your homepage, or if you
  can it is quickly changed to something else
  without you doing anything.

6
Modem Activity

• Internet Activity from modem when no Internet
  applications are running.

7
Too Many Processes

• Numerous processes running that have seemingly
  random names.
• Check for processes you dont know here
• http//www.liutilities.com/products/wintaskspro/p
  rocesslibrary/

8
Adult Processes

• A process that has XxX or adult in its name.

9
System Performance

• You notice a serious decay in system speed.

10
What to do?

• If you notice any of these, more than likely you
  are infected with scumware.
• What to do next?
• Lets get rid of it. All of it.

11
Removal

• Clean house Go to Control Panel, then
  Add/Remove programs
• Uninstall the scumware (check list,
  programs2Remove.doc)
• Empty any quarantine folders for antivirus and
  antispyware applications. How to for Norton.

12
Removal

• If you are a Symantec/Norton user make sure you
  empty their Norton Nprotect folder guarding the
  Recycle Bin. How to.
• Empty your Recycle Bin
• Download and install CCleaner
• Doing this before running cleaning procedures may
  help to give better more complete cleaning
  results and could even speed things up

13
Removal

• Download, install, and UPDATE removal programs.
• Make a folder like C\SpywareTools\ to download
  the programs to.
• It is extremely important for you to manually
  update these programs because some do not have
  the latest definitions when you download them.

14
Programs to Download

• SpyBot-Search Destroy http//www.majorgeeks.com
  /download2471.html
• Install, Update. Use Immunize. Dont use
  TeaTimer.
• SpyBot select ModeAdvanced mode. Select
  Settings, in the left column select Ignore
  Products. In the right window, right click your
  mouse and choose "Deselect all". Now exit Spybot.
  We will run a scan later.

15
Programs to Download

• Microsoft Windows Defender http//www.majorgeeks.c
  om/Microsoft_Windows_Defender_d4466.html
• Install it and update it.
• This can only be used with Windows 2000 SP4/XP
  SP2 /2003 SP1

16
Programs to Download

• Microsoft Windows Malicious Software Removal Tool
  http//www.majorgeeks.com/Microsoft_Malicious_Soft
  ware_Removal_Tool_d4471.html
• Install it and update it.
• This can only be used with Windows 2000/xp/2003

17
Programs to Download

• CounterSpy http//www.majorgeeks.com/CounterSpy_d4
  520.html
• Only install and run CounterSpy if you cannot run
  Microsoft Windows Defender which is only for
  Windows 2000 SP4/XP SP2 /2003 SP1.
• Install it and update it.

18
Programs to Download

• HijackThis - http//majorgeeks.com/download3155.ht
  ml
• AntiVir Personal Edition - http//www.majorgeeks.c
  om/download.php?det955
• Ad-Aware -http//www.majorgeeks.com/download506.ht
  ml

19
Get Started

• Restart your computer in Safe Mode(hit F8 before
  the Windows splash screen comes up)

20
Ccleaner

• Run Ccleaner with the default options to clean
  out temp files.
• Only use the Default Scan on the Windows Tab and
  select Run Cleaner.
• Do not run any other options from other tabs.

21
Microsoft Windows Malicious Software Removal Tool

• Run it and clean ALL that it finds.

22
SpyBot SD

• Run SpyBot and it will scan the registry and
  files for scumware
• Allow it to fix all that it finds.
• Make sure you use the Immunize feature and use
  the SDHelper function(default) but do not use
  Teatimer.

23
Microsoft Windows Defender

• Run Defender and allow it to fix all that it
  finds.
• If it will not run in safe mode, run it later
  after booting into normal mode.
• Windows 9x ME users run CounterSpy instead of
  Defender.

24
Online Virus and Trojan Scanning

• Reconnect your internet cable and boot to either
  Safe Mode with Networking or Normal mode.
• You will need to use Internet Explorer
• Should have latest version of Sun JAVA installed.

25
Online Virus and Trojan Scanning

• Bitdefender - http//www.bitdefender.com/scan8/ie.
  html
• Agree to the license then select Scan.

26
Online Virus and Trojan Scanning

• Panda ActiveScan - http//www.pandasoftware.com/ac
  tivescan/
• Reboot in Normal Mode
• Scroll down to the bottom and choose Scan your
  PC
• Enter info and choose Scan.
• You will have to download the ActiveX controls
  automatically the first time.
• Click Local Disks to start

27
HijackThis

• Install HijackThis to C\Program Files\HJT,
  Double-Click on "My Computer", Double-Click on
  "(C)" navigate to "C\Program Files\HJT",
  Right-Click on "hijackthis.exe", select "Rename",
  rename to "analyse.exe" ( do not rename to
  analyse.exe.exe ) click inside the window to
  complete the renaming operation, close Windows
  Explorer.
• This is extremely important as there is a new
  variant of Virtumonde (Vundo), aka "Winfixer",
  that will not be detected unless you do the
  above.

28
HijackThis

• At the menu select Scan and it will display a
  complete list of BHOs, browser toolbars, Startup
  items, and extra buttons added to browser.
• Be sure you understand each entry BEFORE you
  remove it. You may want to keep many of these
  entries.
• Check the Hijackthis tutorial file included in
  archive (HiJackThisTutorial.doc)

29
Ad-Aware

• Run the program
• Select smart system scan
• Ad-Aware will search through the registry and
  files for scumware
• This scan can take anywhere from 10 minutes to 3
  hours

30
AntiVir

• AntiVir in my opinion is an excellent virus
  scanner and it is FREE
• Only use AntiVir if you are not using another
  virus scanner like
• McAfee, Symantec, AVG, Avast, AntiVir,
  Kaspersky, etc.

31
Kazaa

• Did you ever have Kazaa installed on your
  computer?
• Go to http//www.spychecker.com/program/kazaagone.
  html and download KazaaBegone
• This will eliminate all traces of Kazaa along
  with the bundles software that came with it.

32
Internet Explorer

• Sick of Internet Explorer?
• Install Mozilla FireFox from http//www.mozilla.co
  m/firefox/
• There are less programs targeted at FireFox as of
  right now

33
Summary

• Your computer should now run much faster since
  you freed up a lot of processing power from
  worthless processes.
• At this point I usually remove all the
  applications except SpySweeper and AntiVir.

34
What more can I do?

• You can free up space by
• Deleting you internet cache
• Removing unused programs
• Empty your recycle bin
• Use windows system tools Disk CleanUp and Disk
  Defragmenter