Expert: Lorry - 8/18/2005

Question
i got a bunch of addware the other day due to my brother using my computer but i was able to remove most of it. altho there are still a few problems one being my gaming windows lowing ever few seconds. i believe it is due to the proceses that are starting up, the processes are a bunch of gibberish. i have ran spybot and norton 2005 and niether have been able to get rid of it. i am using windows professional.
              please help :(

Answer
Hi Robert,

Do you have Tea Timer enabled with Spybot Search & Destroy? If not, check it out at:

http://www.bleepingcomputer.com/forums/tutorial43.html

Many people use both Spybot and Ad-aware SE, what one misses, the other catches. Download Ad-Aware® SE Personal Edition, a free program that you can download at:

http://www.lavasoftusa.com/support/download/

Check for updates before running program. Then follow the directions here to do a full scan:

1. In the 'General' window make sure the following are selected with a checkmark and are green:

· Automatically save log-file
· Automatically quarantine objects prior to removal
· Safe Mode (always request confirmation)

2. Click on the 'Scanning' button on the left and select :

· Scan Within Archives
· Scan Active Processes
· Scan Registry
· Deep Scan Registry
· Scan my IE favorites for banned URL's
· Scan my Hosts file
· Under 'Click here to select drives + folders, choose: All of your hard drives.

3. Click on the 'Advanced' button on the left and select:

· Include additional file information
· Include additional object details
· Include environment information

4. Click the 'Tweak' button and select:

Under the 'Scanning Engine' be sure a checkmark is beside:

· Unload recognized processes & modules during scanning
· Scan registry for all users instead of current user only
· Obtain command line of scanned processes

Under the 'Cleaning Engine' be sure a checkmark is beside:

· Automatically try to unregister objects prior to deletion
· Let Windows remove files in use at next reboot
· Always try to unload modules before deletion
· During removal, unload explorer and IE if necessary
· Delete quarantined objects after restoring

5. Click on 'Safety Settings' and select "Write-protect system files after repair (Hosts file, etc)"

6. Click on 'Proceed' to save the settings.

7. Click 'Start' and on the next screen choose 'Activate in-depth Scan' at the bottom of the page and then choose:

· Perform full system scan

8. Close all programs except Ad-Aware.

Click on "Next" in the bottom right corner to start the scan.

Run the Ad-Aware scan and allow it to remove everything it finds and then REBOOT - Even if not prompted.

After you log back in, Ad-Aware may run to finalize the scan and remove any locked files that it may of found. Allow it to finish.

When you first open Ad-aware, click "Check for updates now", click Connect, if there any updates available - get them, when done click Next or Finish.

Now click Start, Next and let it run.

When it is done scanning, you will see the Scanning results window, check all of the boxes, then click Next.

The next window will say "X" number of objects will be removed - click OK.

Anything that is removed is quarantined, making the computer safe.

Hope this helps!
Lorry