1 of 11

Write now Article Tools

Page 3 of 19

have to boot to DOS or Linux there may not be USB drivers). Have these programs ready to run off removable media (floppy, CD, USB flash drive): a disk imaging program, a program to control auto-started programs, a process monitor, a utility to disable Browser Helper Objects (BHOs) and a firewall. (more on this below) It is best to run this software from removable media both to insure it is not compromised and because some malware may prevent the use of equivalent Windows based software on the infected machine. Also, there are a number of steps that should be taken before connecting the infected machine to the Internet to download any other software.

Backup TOP
Make a disk image backup using bootable removable media. My preference would be for the image backup to reside outside the computer. If the machine does not have an internal CD or DVD burner, use an external model (which means adding drivers for the external burner to the list of software you need up-front). Another options is to copy the Windows partition to a hidden partition on the hard disk.

Make a registry backup too.

Stop Malware From RunningTOP
Boot to Safe Mode via F8.

Stop the obvious malware from running at boot time with a utility that controls auto-started programs. This is best done from Safe Mode because I have seen malware that puts itself back into the list of auto-started programs as soon as its removed.

The AutoRuns program from SysInternals is a free program that controls auto-started programs. It is small, safe program from a reliable source. No installation is needed, you can run autoruns.exe from removable media.
June 22, 2006: According to Didier Stevens, some malware can disable Safe Mode. Ugh.
February 9, 2007: Didier Stevens released a .REG file that can be used to restore Safe Mode. See Restoring Safe Mode with a .REG file

Beware of malware with a good name in a bad directory. For example, the real version of winlogon.exe resides in the C:\Windows\system32 directory. A copy of winlogon.exe in the C:\Windows directory is trouble. Likewise, winlogin.exe (slight name change) in the C:\Windows\system32 directory is also bad news.

Check the "hosts" file and if it has any entries other than 127.0.0.1, comment them out. Sample clean hosts file.

For Windows XP and 2000 look in C:\WINDOWS\SYSTEM32\DRIVERS\ET C
For Windows 98\ME look in C:\WINDOWS
I have seen the hosts file locked by malicious software such that it couldn't be updated, deleted or even renamed.
Check My Network Places and delete anything

• << previous page
• 1
• 2
• 3
• 4
• ...
• 19
• next page >>

Add your voice

Know something about Getting rid of spyware?
We want to hear your view. Write now!