Impossible to remove spyware

[Phillip]

I experienced a spyware problem where my browser was
finally hijacked.
I downloaded the MS Beta software and ran a complete
system scan. The Beta software removed some but not all
of the spyware.
I found several spyware websites that kept popping up
even after I had done everything I could to remove all of
the spyware. They are as follows:
www.onlyfavorite.com
www.oneclicksearches.com
www.antivirus-gold.com
www.cleanupreg.com
www.regproscan.com

These are very tough to remove. I finally had to re-
install my operating system to get them out. These
programs had totally blocked me from going online.

 

[RobbieA]

Hi Phillip:

Well sorry you had to resort to "reinstalling your OS."
Haven't seen that drastic recommendation around here
lately. I cringe when people think they are forced to use
this approach. Your time would have been better spent
reading more of these MSAS threads.

What is your OS?

For the next time consider: A System Restore. Try to run
CCleaner and MSAS in Safe mode twice as Administrator.
Get HiJackThis, AdAware SE, SpyBot S&D., and
SpyWareBlaster, and BHODemon.

Run msconfig and uncheck anything you don't know on the
Startup Tab. Ditto for the Services Tab. If you are
using XPSP2 open IE---->--Tools--->---Manage Add-ons, and
uncheck any BHO's that you don't recognize. To
permanently delete the entry open MSAS, go to Advanced
Tools > System Explorers > Startup Programs. Select the
programs you want and click permanently remove startup
program.

Host Files in the Advanced tools section of MSAS

You can open your hosts file with Notepad.
C:/Windows/System32/Drivers/etc/hosts.file

Delete everything EXCEPT 127.0.0.1 Localhost.
Choose "save as" and overwrite hosts.file. MSAS will now
protect your host files.

Browser Hijack Restore feature in MSAS
The Browser Hijack Restore feature allows users to
quickly restore more than 15 Internet Explorer settings
that are persistently changed by spyware.
http://www.microsoft.com/athome/security/spyware/strategy.
mspx

I just don't believe a "hijacked browser" is cause for an
OS re-install.

Good Luck,

RobbieA

 

[Aaron]

Another option is to use Hijack This. You can create a
big logfile of everything that runs and get a computer
geek to tell you what to do once they look at it and
identify the problem.

Something that takes quite a while but helps is taking a
look at the running processes. Go to google.com and
enter each process name as a separate search and there
will be a website that will tell you if it is a legit
process. If it isnt, write it down. Once you get the
list of bad ones, restart into safe mode and search your
hard disk for those EXEs. Delete them and then you're
probably clean.