How to Find and Remove Spyware

How to Find and Remove Spyware Welcome to PCWizTech.Talk. Today, I wanted to show you how I find and remove Spyware, Trojans and viruses when my antivirus program isn’t working properly or not finding it on my Windows PC. I stop it from running. I delete the registry values and I delete the files manually. That’s the only way you can truly make sure that it’s gone if your antivirus software is not doing the job but before you do any of this backup your system, do a checkpoint, restore and back it up. Now the first thing that I do to stop things from running that could be malwares, you know spyware and viruses is run the MS config System configuration tool, right. In there there’s a start up tab. So when you click on the Start up tab you’re going to see a whole bunch of items there that are starting up. Right, they’re all checked off. If you see something checked you uncheck it. So that way you know that it’s not going to start up the next time you restart your computer, right. So that’s how I find things that are useless sometimes that are running whenever you log in to Windows and you don’t want it there anymore and you see, “Oh yeah, I know what that path is.” I don’t need that program anymore to start up or maybe you think it’s something suspicious then you can find out where it’s located in the registry from here as well and then go back and delete the references to that file and delete the file from your computer. So this is the first place that you go in to start removing things. The second place is the Task Manager, so you press Ctrl-Alt-Delete in Windows and under there it shows you all the different things that are running whenever you log in to your Windows. So under the process tab here at the top, you cannot find, that’s where the key loggers spyware, Trojans are always running there and they’ll be listed there, right? So that’s why you would go and you would kill the process by right clicking all one of this guys that you know is suspicious, that doesn’t have any name associated with there is suspicious like I said and then you end the task, right. I’m pretty familiar with what’s writing in here because I go in there quite often to check and see so I know what to look for but if you’re not sure there’s always a description too on the side. Sometimes you can tell that there’s no description or you can tell that the filename is kind of funny and it doesn’t make sense. Now the other thing is that you want to do is go into the registry itself and delete whatever that file that is starting up every single time is referenced, delete that from the registry and one of the places you can go to, to see if it’s in there already is in the H key current user and then under that expand that and go down to software and then expand that and then go under Microsoft and then under that expand that and go to Windows and then expand that and go into current version and then run. So under run you would have tons of things there under that, on the right hand side so I have here under run ones for example there’s one thing here on the right so if you wanted to get rid of that then you would just press the delete button here after you select that. So you select that press delete and then say yes to delete it. Okay if you don’t want it of if you know it’s suspicious but I already deleted everything under my run. It’s empty there’s nothing there. So I don’t have anything there specified in the registry. You can always do a search and find that exe or dlo or whatever it is that is reference in the registry and after it finds it then delete it so that way it doesn’t look for it next time when you restart. Then the next thing of course is to find the actual files on your computer so go into Windows Explorer and go into the directories where those files are and delete them or copy them somewhere else where they cannot be found or accessed. One of the places that I usually go to is the Windows System 32 folder so let’s just say you had a problem that started yesterday and it could be a Trojan. It could be something that you installed and if you go in System 32 folder sometimes you’ll be able to sort everything by date and see which dlo’s or exe files are running and yesterday’s date when I first installed that program or did this and it’s coincidental that I have here this file now running at the exact same time when the problem happens. Usually I go through a lot of problem determination to figure out what is related and what could be safe to remove. So it’s not easy necessarily to figure these things out. That’s why we got antivirus programs and all these other tools that try to figure these things out for us and look for these associations and remove them for us but what I’m showing you right now is basically doing what an antivirus programs does right manually going through all of these things and removing them completely but it does sometimes it doesn’t get everything. One place that I know a lot of Trojans and Spyware hides is in the sequel and max/documents and settings administrators/local settings/temp and that temp folder here’s the temp folder, everything in there you can blow it away right just delete it all, it’s just temporary files but Trojans and exe files for example will hide in there right and they’ll be accessed whenever they need to and there’s another folder Windows/pre fetched things hide in there as well so there’s lots of different places to go and look for to delete these files basically. Once you’ve done that and remove every reference from the registry form the msconfig, from your Windows Explorer then you basically covered all the basis. Next time you restart your computer, the problem should be solved. So anyways those are some suggestions on how you would do it manually if you have to, so I hope you enjoyed this video and thank you for watching.