I have noticed an increase in the CoolWeb spyware and the About:blank spyware. These are not something that an automated tool can remove at this point. Spybot and AdAware can remove a lot of stuff, so they are still very useful. However, there are some that currently take some manual intervention. Here are the steps I take (program locations are at the bottom). Sorry for any weird line breaks:
*****STEP BY STEP INSTRUCTIONS FOR SPYWARE REMOVAL*****
A typical Spyware removal session will take around an hour to complete, if done correctly (thoroughly). Don't let the number
of steps or programs intimidate you. These are powerful tools and will remove all known spyware if used correctly. I
recommend you do the steps in the order given.
1. Stop and disable the Messenger service in Computer Management. This service is not needed for instant messaging, but does
provide an avenue for popups that appear without being in Internet Explorer. If a popup happens that fills the screen or you
can't seem to kill, use CTRL+ALT+DEL and use Task Manager to kill the process TREE, not just the process.
2. Run the miniremoval_coolwebsearch_smartkiller.exe first.
This enables SpyBot to run in case a particular Trojan has disabled it. Usually it will not find anything.
3. Run CoolWeb Shredder (Be sure to close all browser windows first). Be aware that this will remove the "hosts" file. People
rarely use the hosts file. If you have never heard of "hosts", then you probably aren't using it.
4. HiJackThis! will list all the objects that could be redirecting or hijacking your browser. Be careful what you remove,
because some could be legitimate. There are a few that legitimate ones, such as AcrolEFavClient.dll and AcrolEHelper.dll,
which are Adobe Acrobat tie-ins to Internet Explorer. Check and remove any that don't link to files, any that link to
"search" files, and any that look weird.
5. Run AboutBuster.exe (in the About_blank folder). This removes a version of CoolWeb that is particularly difficult to
remove otherwise.
If it gives an error about missing files, run the vbrun60sp5.exe file to install the visual basic runtime files
needed to run the program. If that doesn't work, run the "missingfilesetup.exe". (See bottom of this text for locations under
AboutBuster)
6. Install AdAware (ad_aware6181.exe), check for updates, and run it-- customize-- Scan within Archives,Scan My IE Favorites,
Scan my Hosts file
If you can't get it to update to the current reference file, use the file called "reflist.ref". Copy it to the "C:\Program
Files\Lavasoft\Ad-aware 6" folder. This is also downloadable from the Lavasoft website, as is the plugin mentioned next.
Close AdAware and run the PLVX2Cleaner.exe plugin to install it. Open AdAware and click on the plugin button. Choose the
plvx2cleaner plugin and run it. If there is an infection:
*Scan your computer with Ad-Aware
*Remove any VX2 objects detected
*Reboot your computer again
*Run a second scan to make sure the files have been removed from your computer
7. Install Spybot 1.3 (spybotsd13.exe), check for updates, and run it. Be sure to use the Immunize function to prevent many
kinds of infection. (If you can't update it, close Spybot. Run the spybot_includes.exe file. It will extract the updates into
Spybot. Then run Spybot again, immunize, etc.) Spybot can also show what the computer runs at startup and allows you to
disable and delete files that you don't want to run. Run Spybot in Advanced mode to make these tools available. The
"includes" file can be downloaded from the Spybot website mentioned below.
8. Stinger is an antivirus program that can be used to remove certain virus infections, particularly the latest.
9. IE-SpyAd installs several registry entries that Internet Explorer will use as restricted sites. This means that the sites
will not be accessible through Internet Explorer, thus blocking attempts to redirect to those sites or load any popups from
those sites. Run the "Install.bat" file to load the registry entries. This requires administrator privileges. There could
possibly be software conflicts with this program, use with caution.
IMPORTANT NOTE: All of these programs have to be kept up to date. Using old versions can give you a false sense of security.
Optional
--------
9. Spyware Blaster is designed to prevent future infection by spyware. It needs to be updated prior to immunizing. It may
duplicate some of the other programs, but may catch things the others miss.
10. StartupList.exe will create a text list of all the programs that load when you start your computer. This is intended as a
reference utility for experienced users only.
11. BHODemon20Setup.exe detects "Browser Helper Objects", which may or may not be spyware. Be careful what you remove,
because some could be legitimate.
******************************************
Where to get the programs:
Miniremoval and CoolWeb Shredder: http://www.spywareinfo.com/~merijn/downloads.html
AdAware: http://www.lavasoftusa.com/
Spybot: http://www.safer-networking.org/index.php?page=download
AboutBuster: http://www.malwarebytes.biz/index.php?page=downloads
(Missing files? VB Runtimes--> http://tinyurl.com/4758 or OCX--> http://tinyurl.com/z4lx)
Stinger: http://vil.nai.com/vil/stinger/
BHO_Demon: http://www.definitivesolutions.com/bhodemon.htm
HiJackThis!: http://www.tomcoyote.com/hjt/
IE-SpyAd: https://netfiles.uiuc.edu/ehowes/www/resource.htm
Spyware Blaster: http://www.javacoolsoftware.com/sbgettingstarted.html
Other resources:
Computer Cops: http://www.computercops.biz/downloads.html
SpyWareInfo: http://forums.spywareinfo.com/index.php
(For posting HiJackThis logs and getting feedback)
