PS spyware/junk removal

[lolBST]

So, my girlfriend's friend's computer has god knows how much spyware and crap put on it from her soon to be ex-husband, and being the boyfriend I am, I have to out-nerd the d-bag and remove the software, rather than her spending 200 bucks at Geek Squad (in a different city, can't go to the Geek Squad where the ex worked).

The Ex has the windows CDs apparently. So I'm gonna have to go through taskmanager and other things to see if I can spot whatever the hell the douche put on her PC (it was a program where he received screencaps from her PC at least, unknown if there is a keylogger, but she has been watching her bank stuff closely).

Looking to see if anyone has some ideas on how to fix this crap so I can get to more important things. Otherwise, I should get the PC on Sunday and start poking around, and will get back if I cannot find what appears to be the screencap program.

[Isiolia]

A lot of malware will run some sort of EXE block/hijack. Some you can get around this by booting into Safe Mode. Some you can make a copy of taskmgr.exe, call it iexplore.exe, and it'll run, allowing you to kill the process. Some of the more recent ones change the association for .exe in the registry, routing them all through the malware - a .reg file restoring the default will usually work fine.

I usually do Combofix, then Malwarebytes (repeated until it doesn't find anything). Double check things like proxy server settings.

If that won't remove it, nuke from orbit. Really, if you're unsure, just reformat. It's a pain to redo everything, but you can pretty well gauge how long it'll take, and can be pretty confident in the results. Sure beats spending all weekend running different tools hoping for results.

If there's other crap that's less, um, malicious, msconfig and/or Hijackthis. Or just plain uninstall it.

[Cephius]

Pretty much what Isiolia said. I wrote a sticky on how to best clean stuff out awhile ago, it contains the links and some more instructions: http://www.bluegartr.com/threads/782...es-and-Malware

Also if you need to reformat, usually you can use any windows XP disk, you don't necessarily need the ones that came with the computer. You can even download and burn one if it comes to that.

[orinthia]

If the computer was made by an oem, like hp, dell, sony, etc, you can make an oem install disc out of normal install media. I did this for my brother's laptop that came with 7 so that he had an install disc without the oem crapware, and had to do this for myself when I got my old win xp laptop that did not come with a disc (off ebay like 6 years ago heh).

If you seriously want to "out nerd" the ex, this is your best route. It's just not safe enough to trust you've deleted an infection when its intention could be malicious like this. A full nuke and reinstall will prevent most any bullshit the ex did (no way a true neckbeard would work at geeksquad, so doubtful there's any hardware infections). I've posted this link many times because it's such a huge resource: http://forums.mydigitallife.info/index.php There's threads in there on how to create oem discs for win xp and 7 if you do some digging (probably vista too). Will take some time to assemble everything, but once it's done, you won't have to worry about activations or loaders or other crap like that. Also take your time as there's a lot of info to absorb and some instructions to follow.

If the comp was not an oem, as in was put together, then turning it into an oem can be tricky. Many use daz loader to fool win7 into thinking it's on an oem system, but a bios mod can be a fully permanent activation route. If you're not fully prepared with methods of shit-pants prevention, ie. bad bios flash recovery, just stick with daz heh.

Just be sure to take note of the installed programs so you can find downloads for them quickly and get things installed. http://ninite.com/ is a nice site that has many commonly installed programs that you can have download and install all at one time without toolbars/bs.

[lolBST]

I'll be fiddling with it tomorrow once my girlfriend gets back in town with it. I honestly think it is probably something simple running in the background that I'll spot in a minute. The ex-wife can basically use a PC to use internet and about nothing else, so i'm betting i'll be able to spot whatever the deal is just by lookinga t taskmanager.

[lolBST]

Found 2 Trojans (one masquerading as svchost.exe) and a keylogger. Not sure what did what, but took care of them and kept the logs for when they go to court for the divorce.