I would say that 70% to 80 % of all the computer problems we get to fix are spyware related problems. the spyware industry is huge, and to be honest I’m glad it is, because it keeps us employed.

removing spyware is quite easy, and it can be done by anyone regardless of any advanced computer knowledge. we as experienced technicians have developed strategies on how to remove spyware quick and efficiently. and in this post I will write the first steps I take when dealing with a computer infections.

step 1. normally a computer with spyware runs slow. this is the first symptom people notice, and assume spyware is the culprit. working in a slow computer is painful, and time consuming. so the first thing I do is to kill all programs running at the startup. this will free-up some resources ( RAM, Processor, etc. ) in the computer and be a little bit faster. to prevent all programs from running at the startup I use the built-in windows system configuration tool that can be executed by typing the following in the RUN command msconfig

click on the Startup tab, and Disable all programs. reboot the computer.

step 2. hopefully after preventing all the programs from running at start-up the computer will be a little bit faster. now is time to get rid of the spyware. If you can get to the web from the infected computer, download the free version of SuperAntiSpyware from this link http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE and perform a full scan in the computer.

if the spyware infection is severe, most likely the infected computer will be blocked from accessing the Internet. if that’s the case, download the spyware scanning tool from the link above in another computer, put it in a USB thumb drive, and install it in the infected computer. probably you won’t be able to update the definitions, so just run it as is, and hopefully will detect the spyware blocking the internet access, and remove it. if after that you can get to the Internet, update the definitions and run a full scan again.

in a mild spyware infection case, SUPERAntiSpyware should remove all the spyware, and the computer should be fine after that.

step 3. Sometimes when the spyware infection is very severe, spyware or antivirus programs cannot be installed in the infected computer. when this happens getting rid of spyware is a little bit harder. what I do in this case is to reboot the computer in safe mode and run ComboFix. ComboFix can be downloaded from this link and executed without installation. you cannot install programs in safe mode, but because combofix does not require installation it will run in safe mode. if spyware detects combofix and kill it before it runs, change the name of the executable from combofix.exe to CF.EXE and run it again. spyware is smart enough to kill known spyware and antivirus removal tools by detecting processes names, but you can still get around it by using tricks like the above. after running combofix start the computer in normal mode and install SuperAntiSpyware and run a full scan. that should get rid of the spyware.

if you click on the Yes, remove threats button, it will bring you to a website where it will ask you to buy the software with your credit card. all the spammer wants is get your credit card number and give himself a good Christmas present with your money.

if you see this pop-up on your computer, don’t do anything, just close everything you have open. you might get an alert on the system notification bar like this as well:

Removal Instructions

go to malwarebytes.org and download the free version of the software. update the software and restart the computer. at the initial process of the computer restart, press the F8 key on your keyboard.that should make the computer prompt you for the boot options. choose to boot on Safe Mode.

your computer will boot on safe mode. run a full scan with malwarebytes for spyware on your computer. that should fine this fake antivirus and remove it.

These people that write these tools might be living under a rock, or they’re not innovated at all. this stealing credit card method has been used since the birth of the Internet, and they still think they can fool people… I have a message for them..hey assholes, be innovated or leave computers alone, you won’t deceive even my 4 years old son with your dinosaur stealing method, you are just making our lives miserable with your annoying pop-ups… get a job at McDonalds instead, you will make more money frying chicken nuggets.

to all the rest, I’m sorry about that.

So, how do you remove it?

download malwarebytes from this link http://www.malwarebytes.org/ install it and then restart the computer on Safe Mode. ( to start your computer on safe mode, restart the computer, and press the F8 key at the very beginning of the restart. you will get a few options on a black screen, choose Safe Mode from the menu and hit ENTER.

once your computer is loaded on safe mode, open Malwarebytes and run a full scan. that should remove this pesky tool from your computer. if it doesn’t remove it, then let me know in the comments, and I will show you a more advanced method on how to remove it… I’m just too lazy to continue writing here.

Step 1.

download Malwarebytes at http://malwarebytes.org/ update it and do a full scan. if its a “weak” virus or spyware this should remove it. in my case the virus completely killed the mbam.exe file in malwarebytes, so there was no way I could run it. I tried changing the name of the executable file to game the killing monster but it was futile.

Step 2.

Restart the computer in safe mode, and run a full scan with malwarebytes.  when you start the computer in safe mode only the necessary system files are loaded, and most of the time malicious software does not run, so there is a good possibility that any virus or spyware file will be quarantined from there. in my case it was still the same, I tried to reinstall malwarebytes and run it, but it was immediately killed by the virus again. so even in safe mode, this virus was being loaded into memory.

Step 3.

Boot the computer from my  Hiren bootable flash drive, and run a full scan with SuperAntiSpyware tool. Hiren Boot CD comes with Mini Windows XP which allow to boot into the system pretty much the same way a normal windows do, but from a removable media. SuperAntiSpyware gets pretty good reviews on the web, so I guess is not that bad, but in my case it did not find anything. the virus was still there, and I was getting anxious.

Step 4.

download and run ComboFix. ComboFix is very powerful but dangerous virus and spyware removal tool, so I only use it when I have almost exhaust most of other tools available. when I downloaded ComboFix and ran it in normal windows mode, it was immediately killed, but after rebooting the computer in safe mode and changing the name of ComboFix.exe to CF.EXE I was able to run it, and remove the nasty virus. 

another thing I tried before running ComboFix was to spot the virus manually using Process Monitor from Microsoft SysInternals but it was killed at executing as well. what a nasty virus!

Lately we’ve been getting a lot of computers infected with spyware at work, and all trails point to facebook apps as the source of such infections. I don’t think all apps at facebook are injected with spyware, but most likely there are quite many. a couple of users that got their computers infected told me they got an email from a friend from facebook inviting them to download an app, upon clicking on the link they started getting warnings on the status bar about virus infections. one of them had this fake antivirus warning at the status bar:

the good news is that this fake antivirus is easy to remove by using an anti-spyware removal tool like malwarebytes, but still is annoying for users, and extra work for us.

To be honest, since facebook started allowing everyone uploading free apps to facebook I knew these kind of things would happen. I don’t know what sort of restriction facebook has on people uploading apps to their service, but keeping the bad guys out would be a real challenge.

has any of you caught spyware at facebook.com? let me know in the comment section below.

If you are here looking for information about the scam , then let me explain you the chain of events that lead to this scam. it starts like this.

Pointlessly you are browsing some not very popular sites, and all of the sudden a message like the image below pop up on your screen:

at this point you are wondering what’s going on, and still puzzled about what the heck this message is all about, then you click on the cancel button and you are redirected to this fake page:

As you can see this fake page pretends to be scanning your computer for malware, and eventually will display this message:

you still puzzled about what the heck is going on, at this point you are probably thinking if this is legit or not, but your decide to click on the cancel button anyways. right after you click on the cancel button you are greeted with a more colorful and more familiar windows pop-up:

at this point, heck you think, probably my computer is infected, and click on the remove all button. right after the click, you are asked to download the following software:

at this point, you are hooked – with the intention of removing some fake viruses from your computer, you have gotten yourself a real one. after you install this software, you will get bugged the heck out of you to buy the full version of the antivirus in order to remove the threats. some people buy the software just for the relief of getting rid of those bugging pop-ups. what they find out is that even when they activate the full software they still get the pop-ups.

So how do you prevent this scam?

if you don’t download the software the best thing to do is to close the browser. preferably once your see the fake scanning process , press ALT + Control + Delete and kill the ieexplorer.exe process or firefox.exe in case you are using Firefox from the task manager . if you downloaded the software and installed it, and you are getting the annoying pop-ups, then scan your computer with a spyware removal tool like malwarebytes. get it from this link: http://malwarebytes.org

this type of scamming is getting very popular and as a result very sophisticated, so be careful about the links you click on the web. if you are unsure to where such link will lead to, is better not to click it.

So currently, what’s the best spyware removal tool?

the best spyware removal tool right now is malwarebytes. the best free one there is. there might be other good commercial spyware removal tools, but out of all the free ones I have tested and used like ad-adware, spywareblaster, spybot, Windows defender, and some other ones I can’t recall right now, malwarebytes has always come up with better results.

Malwarebytes is very user oriented, a plus for people that are not very computer oriented. Malwarebytes has only two options at the scanner tab. one to perform a quick scan and the other button to do a full scan on your computer. at the end of each scan it displays the malware findings with the option to remove the infections.

as of now ( 2009 ) I believe malwarebytes is the best spyware removal tool. in the future probably another one better than Malwarebytes will come along, but for now Malwarebytes rules.

note – there might be some commercial spyware removal tools that might perform better than malwarebytes, but for those you have to pay, and I normally don’t review commercial software – even though malwarebytes is commercial, they have a free version which is good for most home users spyware problems.

in the worst case scenario, this spyware will disable the registry, task manager, and any system configuration tools making your efforts of removing the spyware very hard, sometimes unsuccessful.

If you haven’t got the spyware yet, I recommend running a tool like spywareblaster to block infected Internet sites.

setting up spywareblaster is very simple. just download it from the link above, and install it. when you open it for the first time, click on the update button to check for updates. then click on the protection status and then click on the Enable all Protection link. that’s it.

if your computer is already infected with spyware follow this instructions.

1. Disable System Restore. this will prevent windows from backing-up any infected files to system restore. after you disable the system restore go to the registry by typing regedit on the RUN command. if the regedit is disable, ( you get a warning saying the registry access has been disabled by the administrator) download and install this tool from Symantec. this tool will enable the registry again: Enable Registy ( right click on the link and save the file to your desktop) right-click it again and click on install.

now you should be able to open the registry. navigate to and delete the following registry entry:

HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\CurrentVersion\Run\”[32 RANDOM NUMBERS]” = “C:\Program Files\Antivirus 2009\av2009.exe”

1. Navigate to and delete the following registry subkey:
   HKEY_CURRENT_USERS\Software\[32 RANDOM NUMBERS]

exit the registry and reboot the computer.

after the computer comes back from the reboot, do a complete scan for spyware on your computer using Malwarebytes. download Malwarebytes from this link http://www.malwarebytes.org/mbam.php after you install it, make sure it gets updated:

run a full scan of on your system files . after the scan is complete, remove whatever spyware malwarebytes finds. reboot the computer if necessary. that should take care of antivirus 2009 scam.