Spyware Removal Instructions

NOTE: The steps must be followed as mentioned and in the order given below. After every step restart the computer and confirm that the spyware still exists and then continue with the next step. Try and follow all the steps given below in safe mode.

Warning:

Please check all the entries listed by the anti-spyware software to make sure you do not delete any entry used by a legitimate software eg: A remote administration software provided by the computer manufacturer.

* Download, install and run ad aware. Delete any infections found.

* Download, install and run spybot. Delete any infections found.

* This step is specifically for removing spyaxe. If your problem is being caused due to this software then follow the steps given below otherwise skip to the next step. Before we move forward with the removal here's some information about the program:

Spyaxe is a anti-spyware program that is known to issue fake warnings on your computer in order to manipulate you into buying its full commercial version. If you are infected with this program you may receive warnings in your task bar that appear to be from Microsoft Security Center stating that you are infected with spyware and to run its special anti-spyware tool. This tool turns out to be the commercial version of Spyaxe. These warnings are fake and are a goad to have you buy the commercial version of this software.

Download the smitrem tool.
Double-click on the smitRem.exe file. You will now see a screen similar to the one below.
Click on the Start button and the program will start extracting the files into a folder on your desktop called smitRem. When it is finished, click on the OK button. If you look on your desktop you will now see a folder called smitRem.
Next, please reboot your computer into Safe Mode by doing the following:
- Restart your computer.
- After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
- Instead of Windows loading as normal, a menu should appear
- Select the first option, to run Windows in Safe Mode.
When your computer has started in safe mode open the smitRem folder on your desktop and the contents of the folder will be similar to the image below.

Double-click on the RunThis.bat file, as shown by the arrow in the image above, to start the tool.
When the tool starts you will see a series of screens with information on them. Read each screen, and when you are finished reading it, simply press any key on your keyboard. After reading the various screens that appear, the program will start the removal process.

If there is an uninstaller present for the infection you are removing, smitRem will start this uninstaller which will looks similar to the image below.

Simply click on the Uninstall button and allow the uninstaller to finish. When it is completed, it will close automatically and smitRem will prompt you to continue. Now you should press any key to continue.

When no more uninstallers can be found, the tool will continue. Your desktop will disappear and you will start seeing text scroll across the screen. This is normal and nothing to be concerned about. When smitRem has finished running it will automatically start the Disk Cleanup program as shown by the image below.

This program will remove all Temp, Temporary Internet Files, and empty your Recycle Bin in order to remove any leftover files installed by this infection. This process can take up to a few hours depending on your computer, so please be patient. When it is complete, it will close automatically and you will be back at your desktop.

When the tool is finished, it will will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or the partition where your operating system is installed. Examining that log should show that the infection was cleaned.

Reboot your computer back to normal mode.

Your computer should now be free of the SpyAxe infection.

* Download the trial version of ewido.

Install Ewido, and update the definitions to the newest files. Do NOT run a scan yet.
Please reboot your computer in SafeMode by doing the following:
- Restart your computer
- After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
- Instead of Windows loading as normal, a menu should appear
- Select the first option, to run Windows in Safe Mode.
Once in safe mode run ewido:
- Click on scanner
- Click on Complete System Scan and the scan will begin.
  NOTE: During some scans with ewido it is finding cases of false positives.
- You will need to step through the process of cleaning files one-by-one.
- If ewido detects a file you KNOW to be legitimate, select none as the action.
- DO NOT select "Perform action on all infections"
- If you are unsure of any entry found select none for now.
- When the scan is finished, click the Save report button at the bottom of the screen.
- Close ewido

* Uninstall the programs listed below: (if present)

Security IGuard
Virtual Maid
Search Maid
PSGuard

Then exit the Add/Remove Programs screen and the Control Panel.

Right-click: HERE and select Save As (in Internet Explorer it's labeled Save Target As) in order to download the Smitfraud.reg file. Save this file to your desktop.
Locate the smitfraud.reg file on your desktop and double-click it. When asked if you want to merge with the registry, click the YES button. Wait for the "merged successfully" prompt then follow the rest of the instructions below.
Configure your computer so you can see all hidden files.
Download the Killbox by Option^Explicit and save it to your desktop. Extract killbox.zip to your desktop. Then double-click on the killbox.exe program.
When the program is open, select the option labeled Delete on reboot.
Do not close killbox, and open open notepad, by clicking on Start, then Run, and typing notepad.exe and pressing the OK button.
When notepad is open, copy and paste the following bolded text into the notepad screen. You do this by highlighting each of the below bolded filenames and then pressing Control-C on your keyboard. Then click on the open notepad windows and press Control-V to paste the contents into the notepad.

C:\wp.exe
C:\wp.bmp
C:\bsw.exe
C:\Windows\sites.ini
C:\Windows\popuper.exe
C:\Windows\zloader3.exe
C:\Windows\system32\wp.bmp
C:\Windows\System32\hhk.dll
C:\Windows\System32\wldr.dll
C:\Windows\System32\helper.exe
C:\Windows\System32\intmon.exe
C:\Windows\System32\shnlog.exe
C:\Windows\system32\perfcii.ini
C:\Windows\System32\intmonp.exe
C:\Windows\System32\msmsgs.exe
C:\Windows\system32\msole32.exe
C:\Windows\System32\ole32vbs.exe
C:\WINDOWS\system32\oleadm.dll
C:\WINDOWS\system32\oleadm32.dll

Return to Killbox, go to the File menu and select Paste from Clipboard.
Still in Killbox, click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click No at the Pending Operations prompt.

If your computer does not restart automatically, please restart it manually.

Using Windows Explorer, delete the following files, if found, (please do NOT try to find them by "search" because they will not show up that way)

Search Maid

Virtual Maid

Log Files

Security IGuard

PSGuard

* In some cases spywares create entries in the hosts file. To automatically repair the hosts file download The hoster and run hoster.exe. Press the Restore Original Hosts button and then press the OK button. When it's done exit the program.

* There might be situations wherein a website like the one for an online virus scan may not open or the other way around a malicious website is shown as a trusted site in internet explorer. To correct this download the DelDomains.inf file by right clicking on the link and select save as and save it to the desktop. Once the file is downloaded locate it on the desktop. Right click on the file and select install.

Important: You do not get any confirmation message or screen activity after you click on install. Please take care while performing this step because this will remove all entries in the trusted and restricted sites and ranges.

* Download, install and run CleanUp!

* Run the online panda virus scan called ActiveScan to clean up any left over traces of these infections.

* In most cases the steps performed above should solve the problem. If your spyware problem is not solved even after performing the above mentioned steps you can download HijackThis and post the log files on the HijackThis Forum that is dedicated to solving queries regarding these log files.

§§§ This is a self help guide and is provided as is. Use it at your own risk §§§

Hosted by www.Geocities.ws