Basics of Spyware Removal — Part 1

As I con­tinue to get ques­tions on Spy­ware, it seemed like the next “best topic” to pur­sue in my blog­ging series.   So here we go !

A long long time ago …

Sev­eral years back, a friend of mine had a par­tic­u­larly bad piece of spy­ware on his machine.    I learned a tremen­dous amount about how they worked, and over the years I have helped a num­ber of peo­ple remove spy­ware from their computers.

For those NOT famil­iar with the term Spy­ware — The fol­low­ing link is the Wikipedia descrip­tion (the first 3 para­graphs should suf­fi­ciently describe the topic )

http://en.wikipedia.org/wiki/Spyware

What I am going to do with my next series of blogs is share with you those expe­ri­ences (and what I con­sider to be my “best prac­tices) to help oth­ers remove spy­ware from their com­puter on their own.

The focus of this arti­cle will be on the basics of remov­ing spy­ware — I will get to advanced top­ics in a future entry.

How the heck did you get Spy­ware in the 1^st place ?

There is no sin­gle way that spy­ware gets into a machine.    To keep this at a high level — Spy­ware can end up on your machine from one or more of the following

• You installed a pro­gram from an unknown inter­net site
• You installed one of those “coupon” / “game” / “search” tool­bars in your browser
• You ran a pro­gram a friend sent you in the email

Click here — My blog on the basics of avoid­ing Spyware

And there are dif­fer­ent types of spy­ware — rang­ing from just plain annoy­ing to per­for­mance crip­pling to next to impos­si­ble to get rid of.     And just a heads up — it can take some work AND patience to com­pletely rid a machine of spyware.

Remem­ber :   You can’t spell PAtienCE with­out P A C E !

You don’t know what you don’t know — But you know !

So how do you KNOW you have Spy­ware on your machine?    It is NOT always appar­ent that a machine is “infected”.    So while you can’t always tell at first glance, some tell tale signs include:

• The PC seems very slow to respond
• You have a lot of pop-ups
• Browser doesnt get you to the site you type in
• Some­thing doesn’t seem right (Email)

Please Sir, may I have some more ?

Now here is another tid­bit.   Some spy­ware LOVES to be con­nected to the Inter­net — access to the out­side world not only gives them the oppor­tu­nity to SEND infor­ma­tion out — but they can down­load and INSTALL addi­tional spy­ware pro­grams!.    I remem­ber one instance where a sin­gle spy­ware appli­ca­tion down­loaded at least 10 other related spy­ware appli­ca­tions.  When all of that spy­ware was loaded and run­ning — the PC was barely usable.

So this get us to my next “best prac­tice” — which is espe­cially use­ful with hard to han­dle spyware:

Dis­con­nect your PC from the Net­work (wired and wire­less) BEFORE start­ing a Spy­ware removal scan

This  effec­tively starves the spy­ware and allows the spy­ware removal pro­gram to do its job.

The “main event” — soft­ware that finds and elim­i­nates spyware …

It took a while to get here, but hav­ing an under­stand­ing of the ele­ments of spy­ware makes it that much eas­ier to com­bat it.   So now we can look at the avail­able suite of tools

There are a num­ber of spy­ware prod­ucts on the mar­ket.    They typ­i­cally fall into 2 categories

• Free (Lim­ited for home users)
• Pre­mium (i.e. more fea­tures but it costs you)

For home users you can focus on the free ver­sions.    Busi­ness own­ers should pur­chase the fee based versions

Four tools that should uncover most spy­ware include:

• Mal­ware­Bytes  ( http://www.malwarebytes.org/ )
• Super­An­tiSpy­ware (http://www.superantispyware.com/)
• Adaware (http://www.lavasoft.com/?domain=adware.us)
• Spy­bot Search and Destroy (http://www.safer-networking.org/en/home/index.html)

Installing Spy­ware applications

While it is pos­si­ble to download/install any of the above men­tioned spy­ware tools on an “infected” machine, I have seen instances where the browser is “hijacked” and will not allow you to get to the sites that will effec­tively fix your problem.

So, this leads to my next “Best Practice”

Use a “clean machine” to down­load Spy­ware Removal instal­la­tion pro­grams and copy them to a USB Drive

For PC’s that are really infected, you should run the Spy­ware removal  instal­la­tion pro­grams from the USB key.

Run­ning the Spy­ware programs

There is noth­ing unusual about the instal­la­tion of any of the Spy­ware removal pro­grams men­tioned above (just accept the default set­tings dur­ing the instal­la­tion).    When you run any of the pro­grams for the first time,  most ask if you want to update the sig­na­ture data­base.   This is a judge­ment call largely based on how slow your PC is run­ning — run­ning a scan with­out updat­ing the sig­na­ture data­base isn’t going to hurt any­thing.  Besides you can always update the sig­na­ture data­base later and run another scan.

Also, you need to have your PC con­nected to get the sig­na­ture updates.   Its when you start run­ning the scan that you should con­sid­er­ing dis­con­nect­ing your network.

Some other addi­tional recommendations

1. You should con­sider run­ning each spy­ware pro­gram at least once.  While this may defy logic, I have seen instances where run­ning the same Spy­ware removal pro­gram two times in a row picked up things missed on the 1^st pass
2. You should plan on run­ning mul­ti­ple spy­ware programs
3. You shouldn’t use the machine with an account con­fig­ured as admin­is­tra­tor access  (we cover this more in advanced topics)

Now that wasn’t so bad, was it ?

And this seems like a good place to fin­ish “Part 1″.    Hope­fully you found this rather con­fus­ing topic a lit­tle bit eas­ier to understand.

I really look for­ward to your feed­back — some ques­tions I have

• Was this at the right level
• Any con­cepts that weren’t clear / you want to hear more about

And as always if you found this use­ful pass it along to your friends (at least one of them has spy­ware lurk­ing about)

And feel to become a Face­book fan at Keep Pace Technology

Pop­u­lar­ity: 28%

Category: Articles