Hi Mr Robert J. Young,
I ran into your blog by accident while doing a google search of how to get rid of hidden files.
I was wondering if you had some tips on how to get rid of annoying pop ups. I have the same one that keeps popping up. So I figured they loaded something onto my system.
It really sucks. Anyways I just figured I ask, have nothing lose you seem like a cool guy sharing this info like you are. I downloaded spybot and that was ok and also a pop up blocker called panic ware but none of these are doing the trick. For anybody else reading I found out where to download the two free softwares from G4 website ( I just typed in free software in the search box).
Well thanks in advance if you can help me and thanks anyways if you can’t. I liked reading your blog too!!
Vicky
What you probably have is an adware or spyware trojan which came with something you installed. They can be tricky little buggers to remove, but not impossible. I don’t know what your level of expertise with computers is, but here is an overview of what I do to remove adware and spyware infections from people’s computers — the secrets of the trade.
Uninstall the Offending Software
I know this sounds daft, but a lot of commercial adware packages have an uninstall feature that honestly uninstalls the program. You can find it in the Add/Remove programs applet in the Control Panel. Go down the list and remove anything you don’t know what it does, particularly programs that report their size as being under a megabyte.
Automated Systems
Obviously not all of them will go so willingly.
The first and easiest step to forcibly evict unwanted software is to go through your system with automatic packages. I use three:
Notice how Norton and McAfee are not in this list? That’s a whole other rant, that is. Between these three, you can kill off three-quarters of the bad out there. Another thing you can do is google the problem. There are a lot of forums out there and chances are someone else has had what you have. Bleepingcomputer.com and spywareinfo.com are particularly useful because their forum members often post detailed, semi-automatic fixes. I was able to beat down a nasty VirusBurst infection in record time thanks to their members. Removing it manually would have taken hours.
Manual Detection
If the stuff above doesn’t kill it, you have to up the ante a bit. You have to figure out what the bad program is called and where it is being launched from so you can manually delete the offending files yourself. For this I mostly use:
- msconfig, which comes with Windows (enter msconfig at the “Run” prompt
- the services.msc applet, which comes with Windows (enter services.msc at the “Run” prompt
- HijackThis and StartupList from Merijn, who has lots of little spyware killing programs
- prcview from Igor Nys, which shows running processes and modules
There are numerous others I use on occasion, mostly to save time, but I use these four constantly.
All programs in Windows must have names, if you can find the bad one you can often delete it after restarting Windows in Safe Mode. Like the demons of myth, knowing the true name of a program goes a long way to containing it. The trick is to find the name.
If you get the popups only when using Internet Explorer, the infection is likely a BHO – easy to get rid of. If you are getting spontaneous popups this means the program is running in memory. Those are trickier and unfortunately the trend amongst spyware writers is to use memory resident software. Some residents use droppers to start (eg. one program starts another). In such a scenario the dropper must come up on boot and it is the program you want to delete. Without it, the real infection can’t start, even though it is still on the system.
Use prcview to look at all the running programs. It will give you the true name of the program as well at the path it was launched from. A lot of the bad programs like to hide in the Windows system32 folder, which can complicate things because that’s where a lot of Windows components live too. A particularly useful feature of prcview is the ability to query a program for version information; a lot of spyware programs don’t have any version info, a telltale sign.
The services applet will also tell things about the programs it starts as services. Most legitimate ones have a name and description but most spyware services offer no description. This is not a hard and fast rule, as some Microsoft services offer no description and some spyware programs offer a deceptive description. Since the spyware wants to run, its Startup Type will typically be Automatic. Toggling the service to disabled does exactly what it says.
As for filenames, there are two main strategies for naming spyware these days. The first is a random jumble of letters or numbers, the second is give it an official sounding name so you think it is part of Windows. Some even have names which are the same as proper Windows programs, but launch from a different folder. Knowing what is normal and what is not has taken me years of practise, but when I get stumped I look up process names at websites like sysinfo.org or by simpling googling the name.
One method of detection is to use msconfig to turn off all the startup programs. Uncheck the boxes beside everything in the Startup tab and reboot the computer. If a program has reappeared, it means it was likely running in memory and put itself back in the list. Many spyware and adware systems do this, but on the other hand, so does Quicktime.
If the infection just happened to your computer, another method you can use is to go to the windows and the system32 folders (being certain to tell explorer to show hidden and system files), view the list by details and sort it by date. The files comprising the hostile software are often the newest ones.
A number of particularly nasty ones use a random name, but change the name every reboot. I found a blunt way around this problem by disconnecting the power to the computer so the program didn’t have time to alter its name.
Removal
Hijackthis can remove and/or reset a lot of bad stuff. It gives you a list of various startup vectors and other configuration data, most of which is not bad. As dangerous as this seems, you can get rid of basically everything it shows you without hurting your computer. In practise, though, only delete the stuff you think is bad. Anything labelled as a BHO can go. Any entry in the HOSTS file can go. Kill off anything related to the IE start page and its “reset” default. Carefully look for bad in the various StartUp groups. Check the boxes beside what you want gone and press “Fix Checked”. Then run Hijackthis again to see if anything came back.
If Hijackthis doesn’t work or you can’t use it (because some viruses will actually stop you), you can attempt to manually remove the bad. Windows doesn’t allow you to delete programs which are in use, so you have to stop them. Prcview is useful for this as it has a “Kill” function that terminates processes. Once killed, you can delete the file. It would be nice if it were always that simple, but the many of the spyware guys are smarter than that. They will run their nasties as modules attached to things you can’t kill, like explorer.exe or winlogon.exe (try killing that one some time). You can try running in Safe Mode to get around this, sometimes it works, and other times not. In extreme cases you can boot Windows into Recovery Console mode and delete the file from the prompt (this assumes you know how to use the shell). Here at the shop, we will often disconnect the infected drive, attach it to one of our workstations and delete the bad files from it.
And that’s about it. I’ve never been technically beaten by any adware or spyware system, though I have fought with some to the point that the Windows installation was so badly mangled that re-installation was necessary.
After The Bad Is Gone
Ideally, you wouldn’t run Windows, but I know that isn’t possible for some of you. So the best thing you can do is limit your exposure.
- Turn on a firewall, even if it is just the basic Windows XP one. Better yet, get a hardware firewall (a “router”).
- Go to Windows Update and download every patch they have.
- Patch out any application you use that connects to the Internet.
- Make sure your anti-virus program is up to date
- Run spyware scans with Adaware weekly
- Download and install Firefox and use it as your browser from now on. Always.
- Don’t download anything that claims to make your computer run better like registry cleaners, RAM speederupers, modem speederupers, temp file removers, etc… Big time adware vector.
- Don’t download anything which claims to make MSN Messenger better like smilies, themes or those annoying IMVU things. Also a big time adware vector.
- Don’t download free screensavers or cursors. Again, a vector for adware.
- Don’t click on anything that claims to help you search better.
- Don’t click on anything that claims to get you free porn or see x celebrity naked.
- Don’t click on anything that claims to help you make money.
- Websites that have a .ru on the end tend to be bad.
- Don’t click on anything that begs you to install it. Good software doesn’t tend to solicit you.
- Don’t click on anything claiming to give you access to the USENET.
- Don’t download any kind of music downloading software unless that software is Limewire.
- Don’t download any kind of bittorrent software unless that software is Azureus or uTorrent.
- Don’t look for cracks and warez unless you know what the hell you are doing.