Removing Spyware

Unfortunately once you're infected with spyware, it may be an involved process removing it. In the best case scenario, you already know the program which came with the spyware and uninstalling that program can also uninstall the spyware. But given spyware's purposes under the guise of benign features, such as remembering all your passwords, a program dependent on the spyware may leave it intact even if the program is uninstalled. Thus, removal tools were designed by third parties to clean up after this spyware.

The first step to spyware removal is always to attempt an uninstallation of any recent programs that may have come with spyware. There are no hard and fast answers here. You will just need to think about when problems started and what were the last programs you installed. If problems persist, then it's time to move onto the specialized removal tools.

LavaSoft's AdAware

AdAware is one of the more constantly updated removal tools. As such, it should be one of the first removal tools used since it covers so much spyware.

1. Click on the following link: LavaSoft AdAware SE. Choose either to open or run it.

2. Click "Next" on the first page, then "Next" again to agree to the license. "Next" again to agree to the install location and again to start the installation.

3. Click "Finish" and now look for the icon the installer placed on your desktop, launch the program with that icon.

4. Always check for updates before scanning. Click on "Check for updates now" which is above the "->Start" button in the program. "Click Connect" and it will check for updates. If it finds a new one, click "OK" and it will begin updating. Click "Finish" when the updates are complete.

5. To begin a scan, just click on that "->Start" button that was below "Check for updates now". Click on "Customize". We want all the memory and registry scanning options so click on each icon that is an X with a red circle on it, they should change to checkmarks with green circles. Click "Proceed" to save the settings. Now click "Next" to begin the scans.

6. When the scan is complete, click "Next". You'll be presented with a list of all the objects found. Right click anywhere inside the list and choose the second item in the list "Select all objects" to check all of them. Click "Next" to remove them. Click "OK" at the prompt to begin removal. Once it's complete, you're done and can close the program.

Spybot Search & Destroy

(Although AdAware has a large detection database and Spybot's database mostly overlaps, it's still important to use both removal tools as each still has some spyware that it misses which the other tool detects.)

1. Click on the following link: Spybot S&D setup. You can choose to open or run it right from there.

2. Click "OK" to select the default English installation. Then "Next". Choose to accept the license agreement then click "Next" again. "Next" again to install to the default location. Click "Next" again on the next page because the default install options are fine. And "Next" again for the default program group.

3. Here you may want to choose not to install the SDHelper for Internet Explorer. Its protection cannot be disabled and may lead to certain web pages not loading properly as well as prompts informing you when anything is blocked. The "TeaTimer" system settings protection should not be checked unless you want a program that will prompt you for most registry changes (you'll receive a lot of prompts when you install almost any program). If you choose to install these, they can be removed by uninstalling Spybot. Click "Next" after you have made your choices and then click "Install".

4. Leave the "Run SpybotSD.exe" checked, and click "Finish". Click "OK" to dismiss the legal warning. It essentially says that whatever spyware you remove may affect the program dependent on it. So if you remove all the spyware that comes with KaZaA, you may find that KaZaA no longer runs properly.

5. Spybot will launch with a wizard that will walk you through protection. Choose to create the registry back-up (for your own safety), then click "Next." Click "Search for Updates" and then "Download all available Updates" if it finds any, then click "Next". Click the "Immunize this system" and then "Next." You can now click "Start Using this Program"

6. Click on "Check for Problems" and Spybot will begin scanning. When it finishes, click "Fix selected problems", be careful not to click on "Check for problems" because it will begin checking all over again. Click "OK" and it will fix the checked entries.

Spyware Specific Removal Tools

Cool Web Shredder

This is a removal tool targeting the series of CoolWeb hijackers. These are programs that essentially change your homepage and search pages to whatever the CoolWeb variant wants.

1. Click on the following link to download the removal tool: Cool Web Shredder (Choose either to run/open it, but you can always save it to your hard drive and then run it if you prefer that).

2. Before clicking "Fix", close all your internet browser programs (none of the windows should be open, including this one). It will quickly scan for everything, then you can click "Next", then "Exit" and you're done.

Winsock Fix

Certain spyware programs actually modify the Winsock layers. They essentially do the same thing as the hijackers except at a more basic level. Redirecting your web page requests and searches through Winsock means removal programs like AdAware and Spybot are helpless and may only remove parts of the spyware. Sometimes this results in a loss of internet connection until the last parts are removed from the Winsock layers.

1. Click on the following link: Winsock Fix (Choose either to run/open it, but you can always save it to your hard drive and then run it if you prefer that).

2. Click "ReG-Backup", Click "OK", make sure all three boxes are checked (the last one is the only one unchecked by default). Click "OK". Click "Yes" to create the folder. Click "OK" on the message telling you that the backup is complete.

3. Click "Fix" then "Yes" on the prompt following it. When it's done, click "OK" to reboot.