Steps to take if you have spyware that is not removed by
Microsoft Windows
AntiSpyware (beta)
1) Open up AntiSpyware
2) Click Tools at the top
3) Click "Submit a Suspected Spyware Report"
4) Fill out the form with as much detail so we can analyze
quickly
By doing these steps before trying something new, you make
the product better.
Thanks again for testing the beta!!!!
Generally, in a case where the item is identified, but not
properly removed, the next steps are:
1) update both Microsoft Antispyware and your antivirus
application.
2) restart in safe mode by pressing the F8 function key
before the first Windows screen appears at startup.
3) do full deep scans with Microsoft Antispyware. Repeat
scanning until a complete scan comes through clean. Ditto
with the antivirus.
This isn't guaranteed, but it works for a great many items
that at first appear not to be cleaned in normal mode.
Empty your IE cache and your other temporary file folders,
eg: c:\temp, c:\windows\temp or C:\Documents and
Settings\<name>\Local Settings\Temp (the path to your temp
folder will change depending on your name) - sometimes
programmes can be hidden in there - watch out for
mysterious *.exe files or *.dll files in those folders.
http://www.mvps.org/winhelp2002/delcache.htm
Open Internet Explorer
Select Tools > Internet Options
In the Temporary Internet Files section, click the Delete
Files button
Check Delete all offline content, and then click OK
Go to IE Tools, Internet Options, Temporary Internet Files
{Settings Button}, View Objects, Downloaded Program Files.
Check for unrecognised objects there.
If you are running SP2, open IE--->Tools--->Manage Add-
ons, and uncheck any BHO's that you don't recognize.
A BHO disabler such as BHO Cop, BHO Demon or BHOCaptor
(non XP SP2 users only)
http://www.pcmag.com/article2/0,4149,270,00.asp
http://www.definitivesolutions.com/bhodemon.htm
http://www.webattack.com/get/bho.shtml
Do a full, deep scan with Microsoft Antispyware (and,
ideally, your antivirus as well) Is your antivirus
application also up tº date?
Download the following AntiSpyware utilities and run them
along with Microsoft AntiSpyware in safe mode:
Empty temp folders
http://www.danish-shareware.dk
WinPatrol 9.5.0.1
http://www.winpatrol.com
Ad-Aware -
http://www.lavasoft.com/software/adaware/
Spybot -
http://www.spybot.info/en/index.html
CWShredder -
http://www.intermute.com/products/cwshredder.html
Spy Sweeper -
http://www.webroot.com
Go here:
http://www.aurora.com/
Please note that this company is not related to the
Aurora malware stuff, just has the same name.
So, because many people still think that company is the
cause of their problems, they try to help and have some
useful information/solutions/links available on how to
get rid of the malware.
After those setps, if the malware still show, follow
Andy´s procedure:
Theres Now quite a few fixes available for Aurora so you
can take your pick and see what works best for you
racooper has a great fix available at
http://www.noidea.us/
You can also post a 'Hijack This' log on there and
recieve help on removing the malware entries
Then there is manual removal methods using 'Hijack
This','Ewido' & 'Ccleaner' which works fine on the tests
I've done in the past.
The new one thats just come out is 'AuroraFix' from
http://www.jayloden.com/aurorafix.htm
This is the Author of 'AIMFix' which has been very
popular removing AIM viruses, I believe he has used
racoopers file 'Nailfix' and changed it to C++ but Ive
not tested his fix yet, Its from a trusted source though
so well worth trying if you have Aurora problems.
All the best
