|
Trojan Removal - A General Process
#1 If you are using
and operating systems such as Windows XP or ME, you MUST disable your System
Restore before attempting any removal! After successful removal, you can
re-enable System Restore. Here is how to turn off System Restore:
For Windows ME
- Right-click the My Computer icon on the Desktop and click
Properties.
- Click the Performance tab.
- Click the File System button.
- Click the Troubleshooting tab.
- Select Disable System Restore.
- Click Apply > Close > Close.
- When prompted to restart, click Yes.
- Press F8 while the system restarts.
- Choose Safe Mode then hit the Enter key.
- After your system has restarted, continue with the scan/clean
process. Files under the _Restore folder can now be deleted.
- Re-enable System Restore by clearing Disable System Restore and
restarting your system normally.
For Windows XP
- Log on as Administrator.
- Right-click the My Computer icon on the desktop and click
Properties.
- Click the System Restore tab.
- Select Turn off System Restore.
- Click Apply > Yes > OK.
- Continue with the scan/clean process. Files under the _Restore
folder can now be deleted.
- Re-enable System Restore by clearing Turn off System Restore.
|
#2 Make absolutely
sure you have the latest "paid for" versions of removal tools
such as Ad-aware and Spybot Search & Destroy.
#3 Reboot your
system in "safe mode". Here is how:
|
Windows 98/Me
- Restart the computer.
- Just after the POST diagnostics and
memory count, start pressing the F8 key
- On the Startup Menu, choose Safe Mode
OR you
may use the System Configuration Utility Method.
- While in Normal mode, Close all
programs.
- Click Start, Run and type MSCONFIG in
the box and click OK
- In the System Configuration Utility,
on the General Tab, click the Advanced Button
- In the Advanced Troubleshooting
Settings dialog box, check Enable Startup Menu. Click OK. Click OK
again when the System Configuration Utility reappears.
- You will be prompted to restart the
computer. Click Yes. The computer will restart in Safe mode.
- When you are finished with
troubleshooting in Safe mode, open MSCONFIG again and uncheck
"Enable Start-up Menu." under the Advanced Menu, then
click OK and restart your computer
Windows 2000
- If the computer is running, shut down
Windows, and then turn off the power
- Wait 30 seconds, and then turn the
computer on.
- When you see the black-and-white
Starting Windows bar at the bottom of the screen, start tapping
the F8 key. The Windows 2000 Advanced Options Menu appears.
- Ensure that the Safe mode option is
selected. In most cases, it is the first item in the list and is
selected by default.
- Press Enter. The computer then begins
to start in Safe mode.
- When you are finished with all
troubleshooting, close all programs and restart the computer as
you normally would.
Windows XP
If Windows XP is the only operating
system installed on your computer, booting into Safe Mode with these
instructions.
- If the computer is running, shut down
Windows, and then turn off the power
- Wait 30 seconds, and then turn the
computer on.
- Start tapping the F8 key. The Windows
Advanced Options Menu appears. If you begin tapping the F8 key too
soon, some computers display a "keyboard error" message.
To resolve this, restart the computer and try again.
- Ensure that the Safe mode option is
selected.
- Press Enter. The computer then begins
to start in Safe mode.
- When you are finished with all
troubleshooting, close all programs and restart the computer as
you normally would.
|
#4 In "safe
mode", run Ad-aware, and if still needed, Spybot. If you have the
"paid for" versions of these products, make sure you install
the "add-ons" they have. For example, Ad-Aware has a special
add-on to help remove a very nasty Trojan named VX2 (or Transponder).
#5 Reboot your
system in normal mode and rerun Ad-Aware and Spybot. Hopefully you will
get a clean report...
#6 Once your get a
clean report, use the same System Restore procedure as above, but this
time turn System Restore back on.
If This Process Does Not Take of
the Problem, prepare for some more difficult work.
Because there are so many Trojan variations (with new ones showing up
every day) the Trojan and anti-virus removal tools may be unable to perform
automatic removal. If this is the case, we recommend the following
process:
You must be fairly technical to get through the following advanced
process. If you are not at all technical, you have only two other
choices: 1) If you have a "paid for" removal product contact
their technical support; and 2) Buying some more good removal tools and
trying them (working with technical support of course) until you fix the
problem. We know this is a disconcerning statement, but the fact is that
THERE IS NO ONE TOOL that does it all.
The More Technical Approach
#1 Search Google
using the following search term: "hijackthis home page".
You should find a site from which you can download a tool called
HiJackThis.
#2 Download,
install and run HiJackThis. This toll generates a report (called a log)
that contains tons of information on programs (Trojans) that exist on
your system. That's the good news -- the bad news is that it is not a
very good removal tool.
#3 Go to a site
like http://forums.majorgeeks.com/
register, log on and post your HiJackThis report (log) to a forum thread
like:
Spyware Specific
Problems removing spyware, analyzing Hijack This! threads, etc.
#4 If your get
somebody to analyze your log, they may tell you specifically what you
need to do. It may be technical and difficult, but it is one good
solution for the more technical person.
If all else fails, you may also be able to help on the log from a
Google engineer -- they typically charge for this service, but it may be
well worth the charge. From what I have seen they charge very reasonable
amounts. If you decide to go this route check out: http://answers.google.com/answers/
A Few Things to Think
About...
It happened to you once so it's likely to happen to you again. And the
next virus or Trojan could be more harmful than the last. With this in
mind, we are going to repeat something we stress throughout this site:
- Buy GOOD
ANTI-VIRUS / TROJAN SOFTWARE so you get good tools AND TECHNICAL
SUPPORT.
- With this kind of software the ole
saying about "you get what you pay for" is especially true!
- Considering what a virus or Trojan
can do to your system, even the best trojen/anti-virus removal and protection software
systems are cheap by comparison.
Sponsored Ads
|
