Let's Kill Some Spyware!!

I recently had to help some people remove some serious spyware/malware/virii.
No normally if I can't 'kill' the bad stuff fairly quickly. I will simply get the persons 'data' - documents, pics, music etc. - off the machine and then delete the partitions. wipe the drives, re-format and re-install the operatiing system clean.
But sometimes in a business situation this is not always possible.
Or sometimes all the needed applications are not available for 're-install'
For this you must try and 'save' your system without the 'nuclear option'.
So here is one of the best methods I use on a 'running' active system.
Read all the instructions and download ALL of the suggested applications from a 'non-infected' machine 1st.
Then place them on a portable drive - usb or a directory on the infected system [c:\killmalwareapps or something]
Ok let's start.
1st on the infected machine delete the 'hosts' and 'lmhost' files.
They will be located in the c:\windows\system32\drivers\etc folder.
[Possibly c:\winnt\system32\drivers\etc]
First try an online scan from Trend Micro.
To do this safely - using an 'external non-infected browser' you need to run 'Firefox portable' off USB drive.
This will allow a 'clean run' of a browser for a live malware/spyware scan:
How To:
The article here:
http://firefox-fangirl.livejournal.com/1977.html
explains how to download the latest portable Firefox builds and how to correctly install it as a 'portable app' on a separate folder or usb drive. I 'install' it to a directory called 'portablefirefox' and then I copy that to my USB drive.

Then go to Trend Micro USING THE PORTABLE FIREFOX and run their housecall application and run a scan:
http://housecall65.trendmicro.com/
Make sure you do NOT use any browser installed on the infected system!!!
Use the 'Firefox Portable' application to get to the web.

Other tools to have on hand (on your usb drive) before starting.
From Sysinterals
http://technet.microsoft.com/en-us/sysinternals/default.aspx

Get the following apps. Download on clean system and transfer to usb.
Autoruns - Finds all the crap actually loading at startup.
You will finds all kinds of 'crap' that shouldn't be there.
http://download.sysinternals.com/Files/Autoruns.zip
Extract and run this to show EVERYTHING that is loaded at start up.
This includes applications, scripts, drivers, active X controls, dll's and more.

Process Explorer
http://download.sysinternals.com/Files/ProcessExplorer.zip
This helps find unwanted running strigs and helps in there termination.
Run the application to see every currently running process/application on your system.

You will often need some or all of the following applications to 'kill' bad processes.
That is, malicious programs that are running 'un-authorized' processes.

unlocker
http://ccollomb.free.fr/unlocker/

wholockme
http://www.dr-hoiby.com/WhoLockMe/

file assassin
http://www.malwarebytes.org/fileassassin.php

A great spyware finder:

spybot s&d
http://www.safer-networking.org/en/spybotsd/index.html
I install this as my online scan is running (if possible).
Don't confuse this application with other that are trading on the 'Spybot' name and are in and of themselves ACTUALLY spyware. The one and only original FREEWARE application is here.
http://www.spybotupdates.biz/files/spybotsd162.exe

Remember to have all these files already downloaded and copied to your portable drive.

And to assist in cleaning our all 'temp' type files:
CCleaner
Especially usefull if there is an 'unseen' internet app (ie or firefox) downloading malware in the background continually
I will run this over and over while running spybot scans.

http://www.filehippo.com/download_ccleaner/download/d1565b7fb77b48a3692a199d871845fd/

Anyhow this is just a quick but I think fairly thorough way of cleaning an infected system if you don't have a 'Live' type of utility or rescue disk available such as UBCD (ultimate boot cd), Hiren's, or a custom Bart PE disk.