Cleaning up your computer.....

A plea for help that I often hear from my friends, co-workers and others is, "I think something bad got onto my computer! I'm not sure when or where, but it's [just not working right] [rebooting frequently] [not connecting to the Internet] [taking me places on the Internet that I don't want to go to] ..."

Over the course of some time I have put together this approach to isolating and cleaning spyware, adware, viruses, worms and Trojans from computers. In order to so so effectively and quickly I prefer to do the following in this order:

1. Isolate the system. Get it off the network/Internet. Stop it from spreading ill will to others and/or being reinfected during the cleaning process.

2. Tackle the most likely suspects. Clean the most common spyware/adware threats, get the most likely viruses and worms off the system.

3. Get a firewall in place. Get positive control over what goes into or out of your computer. Then you can relax a little and clean more thoroughly.

4. Perform in-depth cleaning. Do thorough scans with your spyware/adware removal tools, get your antivirus up to date and scan with a couple different programs. Get as much baggage off your system as you can.

5. Consult with experts on anything left over you're not sure about. I am by no means a computer neophyte, I deal with complex LAN and WAN issues every day. I build my own computers rather than buying them. However, I don't wait a moment to consult with the folks who deal every day with cleaning unwanted guests off computers when I'm faced with something I don't know about. On this subject I bow to their expertise and experience. So should you.

You may wish to modify these steps depending on your particular needs. For example, you may be certain you're not dealing with a virus, worm or Trojan threat. In that case you may wish to concentrate first on dealing with the adware/spyware threats and defer thorough virus scanning until later. Or, you may be certain that you don't have an adware or spyware problem. In that case you may want to start by working the virus/worm/Trojan issues first and delaying any spyware or adware cleaning for after you've cleaned up other messes. It doesn't really matter which you concentrate on first, as long as you make sure that you do a thorough job of it and cover all the bases before you finish.

Tools for Success!

You will need certain tools in order to accomplish the cleaning tasks ahead of you. It would be best to get them using a known-clean computer and directly from the source, then put them on a CD or other media and take them to your computer.

The tools listed below are ones that I have used and am comfortable with. You can substitute other tools in their places if you have them handy and/or have your own preferences. By and large it's more important to be up-to-date than to stick with brand names. The best spyware/adware or antivirus scanner is of no use if it's not the latest version and fully updated.

AdAware SE - http://www.lavasoftusa.com/
Get the latest version of AdAware SE, and also get the latest signature files for that version from their download section.


Spybot Search - http://www.spybot.info/
Get the latest version along with the latest signatures. 
(Personally I do not recommend Spybot for the first-time user as it will want to remove items that I don't think it should be removing, and its advanced features can cause problems that are tricky to solve if you don't know how to reverse the changes it makes. But if you prefer it and are comfortable with it, then by all means go ahead.)

McAfee Stinger - http://vil.nai.com/vil/stinger/
Get the latest version to remove the most common worms and viruses.

SpywareBlaster - http://www.javacoolsoftware.com/spywareblaster.html
You'll need to download the latest version and install it, then download the updates for it.

eTrust security products:
eTrust EZ Antivirus - http://www.my-etrust.com/products/Antivirus.cfm
eTrust EZ Firewall - http://www.my-etrust.com/products/Firewall.cfm
eTrust EZ Armor - http://www.my-etrust.com/products/Armor.cfm
(EZ Armor is a package containing both antivirus and firewall software, get it if you have no current antivirus/firewall software or yours has been damaged. Otherwise you can get one or the other, or substitute your own favorites instead.)

Or, if you don't mind registering for a copy (providing some personal information) there is currently a one-year free offer for the EZ Armor products courtesy of eTrust and Microsoft (through February 2005).  You can get the one-year trial version from http://www.my-etrust.com/microsoft/.

If you need the Blaster or Sasser cleaning tools/patches from Microsoft:

Microsoft's Blaster Cleaning Tool: Windows-KB833330-ENU.exe
KB823980 Security Update for XP: WindowsXP-KB823980-x86-ENU.exe
KB823980 Security Update for Windows 2000: Windows2000-KB823980-x86-ENU.exe 

Microsoft's Sasser cleaning tool: Windows-KB841720-ENU-V4.exe
KB835732 Security Update for XP: WindowsXP-KB835732-x86-ENU.EXE
KB835732 Security Update for Windows 2000: Windows2000-KB835732-x86-ENU.EXE 

Got your tools? Printed out a copy of the guide? Then let's begin ...

Before we start, isolate your computer

The first thing you need to do before we start is to disconnect your computer from the Internet or your home network. If you have a dial-up modem, disconnect the telephone line from it, then open Internet Explorer and click Tools on the menu, then Options, then on the Connections tab click the "Never Dial a Connection" box. Click Apply, then OK. If your computer is connected to a cable or DSL modem or any type of network device, disconnect the Ethernet (network cable) from the back of the computer.

Please note that you are going to do a couple of things with the computer disconnected from the Internet. Until you have a fairly good idea that you've isolated or removed most of the threats present on your computer you don't want to connect to the Internet again. Many viruses, adware or spyware programs can "repair" themselves using your Internet connection until they are fully removed, and many of the worms and Trojans in circulation these days are also capable of using the Internet to repair themselves or allow remote access to your computer. So let's stay disconnected until you've cleaned up as many of them as we can. That makes it a little more inconvenient, but much safer.

Blaster and Sasser Worms

Now that you have the computer isolated you need to look at two issues specific to Windows XP and Windows 2000 computers. (If you do not have Windows 2000 or XP you may skip this section.) If you have not kept up on your security updates you may see a window that pops up as soon as you connect to the Internet that says your computer will restart in 60 seconds, then counts down to zero and the computer restarts. This window will mention either the RPC or LSASS service as the cause of the shutdown.

If RPC is mentioned as the cause for the shutdown you have the Blaster worm. You need to clear this up before you proceed by first running the Microsoft Blaster cleaning tool ( Windows-KB833330-ENU.exe), then by applying the KB823980 Security Update ( WindowsXP-KB823980-x86-ENU.exe for Windows XP, or Windows2000-KB823980-x86-ENU.exe for Windows 2000).

If LSASS is mentioned as the cause for the shutdown you have the Sasser worm. You need to clear this up before you proceed by first running the Microsoft Sasser cleaning tool ( Windows-KB841720-ENU-V4.exe), then by applying the KB835732 Security Update ( WindowsXP-KB835732-x86-ENU.EXE for Windows XP, or Windows2000-KB835732-x86-ENU.EXE for Windows 2000).

BEFORE YOU BEGIN - Empty Temporary Internet Files

Not only will it make the scanning and cleaning processes faster, but a number of the pests we want to get rid of will use the Temporary Internet Files folder to hide in.  It would also probably be wise to restart the system after you do this, then locate and delete any files in the \Windows\Temp or \WinNT\Temp folder (depending on what version of Windows you have).  Windows 2000 and Windows XP users will also want to check the \Documents and Settings\\Local Settings\Temp folder and delete anything in that folder.  Note that you will need to have the option to view hidden files in Explorer turned on to find and empty this folder.

To eliminate the Temporary Internet Files, right-click the Internet Explorer icon on your desktop and select "Properties" from the pop-up menu (for Windows XP users, if you didn't put the Internet Explorer icon on your desktop click the Start button, right-click the Internet Explorer icon near the top of the Start menu, then select "Internet Properties" from the pop-up menu). Look under the section titled "Temporary Internet files" for the button to delete files, and then click it. This process may take several minutes to complete.

STEP ONE - Find and unload known spyware or adware

Start by installing the AdAware program you downloaded earlier. When the installation is complete you should find the AdAware program files (this will usually be C:\Program Files\Lavasoft\Ad-Aware 6) and copy the file "reflist.ref" from the AdAware update ZIP file into this folder. You should be warned that you are replacing a file - if so, say yes and replace the file; if not you're not in the right place. Copying this file will install the latest AdAware updates.

Start up AdAware and click the 'Start' button. The option to perform a smart computer scan should be selected as the default setting. That's OK for now; it will catch most of the spyware and adware on your computer. Click the 'Begin' button to begin scanning. This may take quite a while. When the scan is done, if any spyware or adware was found AdAware will display an alert and play a sound over your speakers. Click the Next button to see the results. 

If all the items found in the scan were marked as "Tracking Cookies" you are in pretty good shape right now - at least as far as adware and spyware go. You may also see an item marked as "Alexa" - this is a default search setting in Internet Explorer and is marked because the search service does track all searches you perform but DOES NOT install any spyware or adware on your computer. Any other items found are things that you need to be concerned about and we will get rid of them.

Right-click any item in the list and pick "Select all object" from the pop-up menu, then click the "Next" button. This will remove all the items found in the scan from your computer. This process may take some time, especially if more than a few dozen items were found in the scan.

If all the items found were either "Tracking Cookies" or the "Alexa" entry, you are ready to continue to the next step. If any other items were found and cleaned you need to restart your computer and repeat the AdAware scan again as above, then restart the computer and repeat the scan. The idea is to get to the point that no items are found when you run AdAware. 

If two or three scans continue to find items on your computer you need to start your computer in Safe Mode and run a scan and clean cycle. The reason you want to run a scan in Safe Mode because this mode starts only a minimal set of drivers and software - so most of the adware and spyware programs won't be started in Safe Mode. With them out of the way cleaning will be much easier. You may also need to run AdAware in Safe Mode if the computer "hangs" or "freezes up" while AdAware is cleaning the items it found. Some nasty programs prefer to lock your computer up rather than be removed. Safe Mode should get most of them out of the way so you can clean them off.

For most computers you can tap the F8 key every second after restarting but before the Windows startup screen appears, and this should cause the Windows Startup Menu to appear where you can reach Safe Mode. Repeat the AdAware scan in Safe Mode once as above, removing everything found; then restart in Safe Mode and scan again to ensure that the computer is clean.

Once you've cleaned everything off you can with AdAware it's time to move on to the next step.

STEP TWO - Limited Antivirus Clean-Up

Before you proceed, you need to try to eliminate the common viruses from your computer. Most of them can sense antivirus or firewall software and either disable or damage them so they won't work correctly.

First, run the McAfee Stinger (STINGER.EXE) virus cleaner you downloaded earlier. This tool can remove many common viruses, but it can't prevent virus infection. It will target and remove many viruses that disable or damage antivirus and firewall software.

When done, reboot if you are told to.

STEP THREE - Install a Firewall

Before you can safely get back onto the Internet, you need a way to stop any remaining adware or spyware programs from getting access to the Internet. If you have a virus, worm or Trojan on your system you definitely don't want them to be able to get onto the Internet. The easiest way to do this is to install a firewall program that will block them from being able to get outside your computer.

Even though you may already be using the firewall built into Windows XP or your Internet access device, you still need a second firewall for at least the time being. The Windows XP firewall and the firewall built into some routers and Cable/DSL modems are only 'one-way' firewalls, designed to prevent access from the Internet to your computer. They won't prevent programs already on your system from getting out, and once these programs reach the Internet the one-way firewall will allow them to bring whatever they want to back onto your system. You need to stop them before they get out and this is what a true firewall will do.

It's now time to get your firewall software installed and protecting you.

Assuming you go ahead with the EZ Armor/EZ Firewall installation, run the installer from the CD and either allow the default installation or un-check the "EZ Armor" box and select only the EZ Firewall part of the software. You may wish to wait to install the antivirus software if you think you have a virus, worm or Trojan now since these may disable or damage the antivirus software. The EZ Armor installer may try to 'phone home' to eTrust for program updates and cause an error message - you should be expecting this because you currently have Internet access turned off. Don't worry, go ahead with the installation. Take a look at the quick start and tutorial information so you're familiar with how the program looks and feels. Restart when indicated.

STEP FOUR - Re-enable Internet Access

Now that you've done what you can to clean off the most common threats, let's get connected to the Internet again. If you have a modem, re-connect your phone line and go back into Internet Connections and turn your favorite dialing option (autodial or dial if no connection is present) back on again. If you have an Ethernet network connection, connect it back up and restart the computer.

STEP FIVE - Install SpywareBlaster

SpywareBlaster is an excellent program to install and keep installed on your computer. It has only one purpose - it blocks known spyware programs from being installed, or if they're already installed, it blocks them from running. It does this by changing the settings in Windows to block these programs from running (in technical terms, it sets a 'kill bit' that prevents the spyware program or spyware installer from running at all).

If it's so good, why didn't we install it before? Oh, because you need to have Internet access to get the latest list of known programs for it to block. It doesn't have a downloadable update like AdAware does.

So let's install it now. When it's installed, start it up and click the "Updates" button. Note that when you tell SpywareBlaster to look for updates, your firewall will alert you that SpywareBlaster is trying to connect to the Internet. Since we trust this program, click the box to remember that you said it's OK to do so, and then click the button to allow it to connect. Once the updates are loaded, click the "Protection" and select to "Enable all protection". This will block all known spyware programs from loading and prevent your browser from going to certain Web sites that install spyware on your computer. You should restart your computer once SpywareBlaster is installed so you start clean with blocking turned on. You should periodically run SpywareBlaster and download and apply the latest updates to be sure that you keep updated on new threats that may appear.

STEP SIX - Remove Viruses

Now that you have blocked all the spyware you can, let's get to work on viruses and such. Since it's possible that any virus software you have now could have been damaged or destroyed by your unwanted guests, let's use some of the free online virus scanners to do a quick scan-and-clean. I would recommend using at least two of these web sites:

http://housecall.trendmicro.com/
http://www.pandasoftware.com/activescan/com/activescan_principal.htm 
http://www.bitdefender.com/scan/licence.php 
http://security.symantec.com/sscv6/home.asp
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx 

Remember that you still have our firewall on and active, so you'll see some warnings as these pages load the online scanners and run them. Again, it's OK to trust them, so let's do so.

After you've run the online scans and removed the viruses you can remove, it's time to either install an antivirus program (if you didn't have one already) or uninstall and reinstall your current antivirus program (if the online scans found viruses, then your virus scanner is either outdated or damaged). You can either install the EZ Armor antivirus scanner from the CD, or check out the above web sites since each of them also offer trial/free antivirus scanners for home use.

A WORD OF WARNING - Before, I indicated that having more than one firewall was a good thing if your primary firewall (Windows XP or Internet device) provides only limited protection. With antivirus software this is not the case - you need to pick one antivirus program and have it installed. Installing more than one can cause system instability, lock-ups of your computer, or false alarms that may cause damage to the antivirus software. This is a case where "enough is enough" and one is enough.

STEP SEVEN - What have I missed?

Depending on the nature of the invader you're trying to get rid of, you may still not be done with the process. The steps you've taken to date will get rid of most viruses, worms, Trojans, adware and spyware. But you're not out of the woods yet.

Some viruses, worms or Trojans install a program known as a 'backdoor', on your computer. In some cases these backdoor programs are software that's meant for a legitimate use - to allow someone remote access to your computer - so no antivirus or spyware/adware scanner will pick it up.

Another possible leftover threat is a 'keylogger' program that watches everything you type and records it for later review or use. This tactic is commonly used to capture account names, passwords and credit card numbers. And again, since some of this software is legally sold for whatever purpose you would use it for, adware/spyware or virus scanners might not find it.

How likely is it that you've picked up one of these unwanted guests? Not very. But if you're still experiencing unusual firewall access warnings it's possible. So you need a way to find out. And this is where you'll need the expert help I mentioned earlier to help you sort it out.

Fortunately there's a very powerful tool, called "HijackThis", that can spot every program that's loading and running on your system and allow you to clean them up. Sounds good, doesn't it? Well, the problem is that it does, literally, show pretty much EVERYTHING that loads and runs. And the vast majority of the things that are loading and running are there for a reason. If you remove them, your computer won't work correctly.

That's why there are people who specialize in reading HijackThis logs. You must consult with them after running the log and before cleaning anything up, so that you don't kill anything necessary. 

You'll find details on how to download and run HijackThis at these sites:

http://www.aumha.org/a/hjttutor.htm
http://www.tomcoyote.org/hjt/

But again - very important! - don't try to clean anything up until you consult with the experts at these Web sites:

http://www.computercops.biz/forums
http://www.tomcoyote.org/forums
http://www.spywareinfo.com/forums
http://forum.aumha.org/viewforum.php?f=30
http://www.lavasoftsupport.com/index.php?s=1570453ec76bc9f7c1f73a9a19440d6f&showforum=44

(From time to time the locations/links to these forums may change.  You'll find the latest support forum lists at Aumha.org or Tomcoyote.org along with the instructions on installing and using HijackThis.)

Note that some of these forums may be difficult to get to. Since the forum operators are outspoken about the threats of spyware, adware and other parasites sometimes the folks who try to infect you with them get a bit nasty and attack their Web sites to make them unavailable.

STEP EIGHT - Okay, what now?

If you've reached this point, I'm hoping that your system is clean and behaving well and you're breathing a sigh of relief. If so, let's take some steps to try to ensure that this is the last time you'll need to go through this!

1. KEEP YOUR ANTIVIRUS PROTECTION UP-TO-DATE. Most have an autoupdate feature. Turn it on and use it. Once a day isn't too often.

2. KEEP YOUR ADWARE/SPYWARE PROTECTION UP-TO-DATE. Run AdAware and SpywareBlaster on a regular basis and be sure you get the latest updates for each one every time you run them.

3. KEEP THAT FIREWALL ON. Yeah, it gets annoying from time to time, when it keeps popping up every time you run a program that wants to access the Internet. But once you know which programs need Internet access and which ones don't, and use the "Remember" box to keep those settings, the pop-ups will come less and less frequently. Soon it will be only new software that will trigger alerts - and if YOU didn't install that new software, where did it come from?

4. KEEP YOUR COMPUTER UP-TO-DATE. Unfortunately this isn't as easy as it used to be. Microsoft recently withdrew from distribution a "Security Update CD" that would load all the security updates through October 2003 onto your computer. The CD included updated versions of Internet Explorer (essential to keep updated!), Windows Media Player and DirectX (not as important, but worth considering) as well as other assorted security updates.

Windows XP Users - With the recent release of Service Pack 2 for Windows XP you can fully update your Windows XP (Home, Professional, Media Center Edition or Tablet Edition) computer by applying Service Pack 2.  You can find more details about Service Pack 2  and how to get ready to install it at http://www.microsoft.com/athome/security/protect/default.aspx

All Windows Updates for all supported versions of Windows can be found at the Windows Updates site, and I recommend that you visit there and get all the critical and security updates, at the very least. Either use the Windows Update link on your Start menu, or go to http://www.windowsupdate.microsoft.com/ to get started.

The single biggest update you need is Internet Explorer 6 Service Pack 1. It is big in terms of security since it closes a lot of holes that are present in older versions of Internet Explorer. Unfortunately it's also the biggest in terms of size. But luckily you can order it on CD if you don't have a high-speed Internet connection:

http://www.microsoft.com/windows/ie/ordercd/ie6sp1.mspx

If you do have a high-speed Internet account you can download it from here:

http://www.microsoft.com/windows/ie/downloads/critical/ie6sp1/default.mspx

Once you get this version loaded there are still some updates you will need. The Windows Updates site will take care of that for you.

5. CONSIDER INSTALLING OR TURNING ON AUTOMATIC UPDATES. For Windows 2000 and XP you can have updates downloaded to your computer in the background, when you're not doing other things on the Internet. When they're downloaded and ready to be installed you can either manually install them or set them up to be automatically installed. You'll find the settings for this in your Control Panel. For Windows 98 and Windows Me computers you can install the Critical Update Notification tool, which won't download updates but will tell you when there are updates available. You'll find this tool at the Windows Update site.

6. NOTHING SUBSTITUTES FOR COMMON SENSE! Even if you follow all the above steps, you're still not safe. The biggest cause of problems with your computer is YOU (or your family members, if you are as pure as the driven snow). Some handy tips to keep in mind:

"If it seems to good to be true, it probably is." Anyone who offers you something for nothing has something in mind, especially if it's not obvious what it is on its surface. In the case of the free antivirus and firewall tools we're using their goal is clear enough - they hope that once you use their free software that you'll either buy the paid version, or perhaps consider their other products, when you're ready to buy software. On that basis you can trust them. But why does some company you've never heard of want to offer you a free toolbar, or free graphics/smileys for your email, or a free tool for your computer? If you can't see the hook then it probably means that they want to get some spyware or adware onto your computer. So, don't. Just don't.

"What do you mean, you didn't send that picture to me?" Many of the recent viruses and worms use an infected computer to send copies of themselves from the infected computer.  In some cases they make up a fake email address for the "From" address, in others they select a name randomly from the infected computer's email address book and put that name in the "From" address.  Then the virus or worm sends itself to every email address known to the infected computer using the fake "From" address.  They hope that when you see an email from someone you know you will be more likely to open it.  So you should be suspicious of any mail message that contains a file attachment that isn't either explicitly described or that doesn't come with a separate message describing the contents.  When you send email to your friends with a file attached you should either explicitly describe the attachment (not just "Here's a funny joke!", because that doesn't tell anyone a thing about the attachment) or send a second email confirming that you did indeed send the one with the file attached.

"But it said 'I Love You'!" No one in his or her right mind would click on a link or install software that says, "HEY! I'm a VIRUS! Wanna have fun?" So these miscreants instead use what's called "social engineering" to try to trick you into installing their nasty little present. They put someone else's name on the message, or put dire warnings that you're in danger if you don't install it, or claim that it's nekked pictures of some celebrity or another. In other words, they try to exploit your trust of someone else in order to get your guard down. In this case the key is, "Mistrust until verified." If a mail message says Citibank needs information from you right away, call or email Citibank and ask them if it's so. If a message says it's a joke from a friend or pictures from someone you know, ask them if they sent them to you. If a program says it's from Microsoft and is necessary to protect your computer, go to the Windows Updates site and see if Microsoft says you need it or not. (HINT - Microsoft NEVER EVER sends out program updates via email, so you can discard those right away.)

"Wait a minute, that isn't Madonna!" The Internet is a great place to find friends, be educated, be entertained, and generally waste time. Unfortunately it's also a great place to pick up unwanted guests. There are actions that are inherently risky just because of their nature, like the many 'file sharing networks' that share movies, music and software illegally. Some of the files in these networks are actually viruses or worms that have the name of a hot new movie or hit single or album, and until you let it in it may be too late to know the difference. To avoid these traps, avoid them. Don't traffic in file sharing networks.

"How did I get HERE?!?" Porn sites are also notorious flytraps, since they often hide behind names that are almost the same as other popular sites. For a long time, if you went to www.whitehouse.com instead of www.whitehouse.gov, you would wind up with free porno 'gifts' on your computer. If you encounter one of these pits, you may be better off just turning your computer off immediately before they can get you to click on anything. Some of those message windows that look like you can close them are a trap - no matter what you click you wind up with their junk on your computer.

"Education is the key to a happy, fulfilling life." If you're the only person who uses your computer then we're almost there. But if family members or friends share your computer, you need to let THEM know what you've learned here today. Explain why some actions they may be taking are risky and propose safe alternatives. For example, instead of downloading music from file-sharing sites get them a subscription to a legal music site like http://www.napster.com/ (yep, the same folks who started it all, but now they've gone legitimate!), http://www.pressplay.com/, http://www.listen.com/, http://www.streamland.com/ or others. If they like playing free online games, encourage them to stay with known-safe online game sites run by reputable companies like Yahoo, MSN, Disney and others.

EPILOGUE:

There are many places you can learn more about security threats and safe computing. The list below is culled from just a few of the many sites I've found recently.

http://windowsupdate.microsoft.com/ (did I mention, free Windows Updates here?)

http://www.microsoft.com/downloads (download Microsoft cleaners/patches)

http://www.microsoft.com/technet/security/default.mspx (business and technical security information)
http://www.microsoft.com/athome/security/default.mspx (home security information)

http://www.antiphishing.org/ (tips to avoid identity theft and fraud, alerts on widespread scams)
http://www.ftc.gov/infosecurity/ (Federal Trade Commission, more tips on theft/fraud)
http://www.cert.org/homeusers/HomeComputerSecurity/ (lots of in-depth stuff)
http://www.staysafeonline.info/ (part of the National Cyberspace Security Alliance)

POSTSCRIPT:

There's a particular item known as "CoolWeb Search" or "CoolWWW Search" that many users have problems with and is somewhat difficult to remove.  There used to be a tool called CoolWeb Shredder that did a decent job of keeping up with the frequent variations and mutations of this pest, but the author of CoolWeb Shredder had to drop development of the package to regain balance in his personal life.  With the demise of this tool, detection and removal of this product has become a bit more difficult.

For those with some technical knowledge and who aren't afraid to roll their sleeves up, Silent Runners has published information on removing CoolWeb Search manually.  Otherwise, all I can recommend is the use of HijackThis and some expert advice from the folks experienced in its use.