1. Uninstall Spyware programs.
It is important to identify spyware which have entries in Control Panel > Add/Remove Programs. This is because the anti-spyware programs listed below will remove spyware components of programs, sometimes breaking the uninstall feature of the program which the spyware came bundled with, leaving no way to remove it. Of course, not all spyware programs have an uninstall option, and the uninstall feature doesn't remove all spyware associated with the listed program, but by uninstalling components in this way, you will avoid leaving unremoveable junk on your computer.
Run one of the programs below to scan your computer for spyware but do not tick the remove box: the program will give information about the spyware program. Check for that program in Add/Remove and uninstall components there before running the anti-spyware program again to remove components which the spyware program tried to leave running.
2. Start your computer in Safe Mode.
Many spyware programs have components which monitor for attempts to remove the program and attempt to prevent removal. Starting the computer in Safe Mode will prevent many of these components from loading (Safe Mode loads only the most essential processes.) Restart the computer and tap F8 continually to get into safe mode, then run the anti-spyware programs.
3. Many is better than one.
Spyware is continually evolving in an attempt to avoid removal by anti-spyware programs. Recent tests and reviews have shown that there is not one anti-spyware program which can remove 100% of spyware. Fortunately, there are now several good free anti-spyware tools available, and trial versions of some excellent pay programs which will remove spyware.
Spyware Removers pcmag.com
Anti-Spyware Testing Spyware Warrior
Beware rogue anti-spyware products.
4. Manual Removal.
New malware is constantly emerging, and the anti-malware programs trying to catch up. You may come across a piece of spyware that none of these programs will yet remove. If all of these programs fail to remove the spyware, manual removal is possible. (See the Microsoft link below.) Most likely a Google search will bring up information about how to remove particular spyware, unless you have something really new, in which case the Wilders Security Forums link below also includes information about how to obtain advice about removing stubborn spyware from the community of experts who inhabit the computer forums.
Expert advice for cleaning a computer of malware and spyware.
The Antivirus Defense-in-depth Guide microsoft.com
General Virus and Trojan removal Instructions Wilders Security Forums
The parasite fight: Finding, Removing & Protecting Yourself From Scumware aumha.org
And advice for experts.
"HijackThis! is a program used by experienced users in order to detect browser hijackers. It allows you to identify any sort of spyware and malware (as well as some trojan horses and worms). This is achieved by scanning special zones of the registry as well as the hard disk drive, the results being listed in a structured window. Another feature of HijackThis! is the creation of a log file, which can be saved as a simple text file and opened by any text editor (notepad as default). Until now, inexperienced users, who could not analyze the log file by themselves, had no other choice than posting it in a specialized forum and to hope that a more experienced user takes some time to analyze it. The script presented on this page is a way to analyze your log without help from the outside."
HijackThis! and HijackThis! Log File Analysis are not recommended for anybody who doesn't know their way round a computer pretty well. They are not recommended as a first line of attack when cleaning a computer. I use them as a last resort, and for cleaning up after removing malware. Don't remove anything you're not 100% sure is malware!
HijackThis! Log File Analysis hijackthis.de
HijackThis! merijn.org
Free adware, spyware and malware removal products.
These are well-known, trusted and effective programs. (Be sure to read the warning about rogue anti-spyware products below.) They all may find spyware the others miss - It is worth running more than one in the case of a spyware infection.
It is not recommended to have more than one anti-spyware program with real-time protection installed at the same time- serious conflicts affecting system security/performance may occur.
Programs without real-time protection (on-demand scanners) will happily co-exist, although some programs have a component running permanently in the background, so having multiple scanners installed may affect system performance. (See appendix below.)
Scan regularly and keep the spyware definitions up to date by running the update command every week.
Ad-aware:
removes adware, spyware and malware from your system- It's free for
home use. (Paid version has real-time protection.)
Lavasoft's Ad-Aware
2008 Free
Spybot Search &
Destroy: another spyware finder and destroyer. This
program can also block your computer from connecting to servers known
for bad behaviour: installing spyware or tracking functions etc. It can
also immunize against malicious ActiveX code and block bad downloads.
The author asks for donations: please support him if you can.
Patrick M. Kolla's Spybot
Search and Destroy
Microsoft AntiSpyware:
the program detects and removes spyware and has real-time protection.)
Microsoft's AntiSpyware
SUPERAntiSpyware: detects and
Removes spyware, adware, malware, Trojans, dialers, worms, keyLoggers
and hijackers. (Paid version has real-time protection.)
SUPERAntiSpyware's SUPERAntiSpyware
Free Edition
SpywareTerminator: Detects and
removes spyware, and has real-time protection.
Crawler's SpywareTerminator
MalwareBytes: Detects and removes malware. Has a good reputation againt Vundo infections- a difficult-to-remove adware program, as well as against scam/fake anti-virus products.
Malwarebytes' Anti-Malware
a-Squared Free:
A free Trojan scanning and removal tool. Also scans for diallers, worms
and spyware. (Paid version has real-time protection.).
Emsisoft's a-Squared
Free
Other products
X-Cleaner Micro Edition: Online spyware
scan. (Requires Internet Explorer.)
FaceTime Security Lab's X-Cleaner
Micro Edition
(BT) Yahoo! Anti-Spy: the BT Yahoo! toolbar or the Yahoo! toolbar come with Yahoo! Anti-Spy, a spyware detection and removal tool from Symantec. toolbar.yahoo.com
NB AVG Anti-Spyware and a-Squared free are also listed on the Anti-Trojan page. Trojan horses sit in the middle of the malware spectrum, between the 'disreputable commercial' and downright criminal extremes. They are used to install spyware without explicit intent, as well as to steal confidential information or allow outside access to a computer.
Infection-specific advice and tools
A scan with an anti-virus, anti-Trojan, or anti-spyware program, or with HijackThis! may discover an infection which cannot be removed. The name of the infection may be indicated, or a Google search for information on an infected file may reveal the name of the infection. In a case like this, it is often worth looking for a tool to remove that specific malware. Here are some tool and anti-malware sites which may help in the removal of stubborn malware:
Essential Tools for Removing Spyware, Adware, and Malware pchell.com
Spyware and Adware Removal Help pchell.com
Atribune.org
(Vundo, Look2Me)
scanwith.com
(About:Buster- removes the Home Search Assistant, CWS.MfPlay and
CWS.SeDll)
jayloden.com
(AIMFix, AuroraFix)
SmiFraudFix
(Removes a long list of desktop hijack malware)
ComboFix
(SurfSideKick, QooLogic, Look2Me or any combination of that group)
Paid adware, spyware and malware removal products.
Free trial versions may be available. In some cases, trial versions detect malware but only the full version will remove it. Please consult the company website for current conditions. These products have real-time protection- do not run more than one or run along side other products with similar protection- conflicts may arise.
Webroot's Spy Sweeper
CA eTrust's Pest Patrol
A free 1 year trial is available from the German site.
(English version).
Trend Micro's AntiSpyware
A free online scan is available which will remove spyware
found.
Trend Micro's Anti-Spyware
for the Web
Sunbelt's CounterSpy
Aluria's Anti-Spyware
Beware rogue anti-spyware products!
There are many products which offer to remove spyware. Some of these are rogue products, as defined by Spyware Warrior:
"Rogue/Suspect" means that these products are of unknown, questionable, or dubious value as anti-spyware protection.
Some of the products listed on this page simply do not provide proven, reliable anti-spyware protection or may be prone to ridiculous false positives. Others may use unfair, deceptive, high pressure sales tactics to scare up sales from gullible, confused users. A very few of these products are either associated with known distributors of spyware/adware or have been known to install spyware/adware themselves.
Rogue/Suspect Anti-Spyware Products & Web Sites Spyware Warrior
Some of these products have similar names to legitimate products, with the intention of confusing the consumer into downloading a rogue product instead of an effective anti-spyware solution.
The very worst rogue products install themselves by drive-by download on a computer where the browser or operating system has not been updated and contains security vulnerabilities, or by tricking the user into downloading an .exe file, often a fake video codec. These products may be detected as malware (Trojan Zlob detection is very common) but are hard to remove. They may produce a warning of malware infection in the notification area which may appear to be a warning from Windows' Security Centre. The program will offer to carry out a scan but will demand you buy the program before malware is removed. Do not buy such a program: it is a scam!
Malware Removal: SpyAxe Removal wiki.castlecops.com
Appendix: Real-time and on-demand scanners.
This table shows which scanners can be installed on the same computer without fear of conflict.
| Real-time protection -one only, if required |
On-demand scanning -multiple scanners may be installed |
|
Free-
Paid-
Real-time protection- may conflict with other anti-spyware products also with real-time protection. Install one only of this type of product. |
Free-
On demand scanning- will not conflict with other scanners with either real-time or on-demand scanning. |