Little tricks of Windows XP, 7,8 operating systems, Internet and computer. How to completely clean your computer of viruses How to get rid of parasite programs

Find and neutralize

Uninvited guests

After some time of browsing the Internet, you may find a real inn on your hard drive: thousands of guests have come and settled here without your knowledge (kilobytes of information). Some are harmless and just take up space, but there are also harmful varieties. We list them in order of increasing risk.

Copies of visited resources

The browser stores not only the addresses of web pages that the user has visited, but also copies of them. Such files can remain on your hard drive from several days to several weeks (depending on your browser settings) and generally do not threaten anyone or anything - unless you do not want other computer users (for example, family members) to know. which nodes are you visiting?

Cookies

“Cookies” are small informational text files that in themselves do not pose any particular danger. However, they can tell others about your travels on the Internet - just like "Journal" and copies of web pages. In addition, with the help of these files, certain commercial nodes collect information about the habits and interests of users literally bit by bit. There is probably no big problem in this. But perhaps you don't want to advertise this information. Finally, there are simply poorly designed Web sites where information files store user access data (for example, profiles created when visiting a site).

Viruses and worms

Internet users are well aware of viruses and worms. However, now they are created not only to simply multiply and destroy data from time to time. Many of them have become distributors of spyware, which are installed on PCs in order to transfer control to the virus developer. Unless your computer doesn't have any antivirus software or a firewall (a very dangerous situation!), the likelihood of getting a virus these days is relatively low. The fact is that special modern software products protect against them very effectively, and the viruses themselves are relatively simple in design. On the other hand, if you have been using the Windows XP operating system for a long time, there may be a dormant virus hidden in the standard Windows recovery module. There is no need to worry too much - the pest that has entered here will not activate itself. It is in a hibernating state, but can come to life if the user performs a system restore.

Advertising programs

Adware programs vary greatly in how they penetrate your system. Two common search bars - Slotchbar and WinTools - do not display the End User License Agreement (EULA), which usually stipulates that the programs may “give” you additional components. Both are installed without your consent and are the hardest to get rid of: they use multiple processes that restart each other when you try to remove them. And common adware programs like WhenUSearch (a search bar) and Bonzi Buddy (a desktop program that offers search assistance) come with an easy-to-understand license agreement and allow you to easily remove them using Windows' Add or Remove Programs utility.

Spyware

Spyware is very dangerous - perhaps no less than viruses. They can be divided into two large groups: those that monitor user actions in order to obtain confidential information (about access to online banking accounts, online stores, electronic auctions, etc.), and those that try to seize control of the computer so that hackers can use it to send advertising messages ( spam) or attack websites (“denial of service”). Spyware, like adware, can be installed on a computer by taking advantage of a browser vulnerability, but more often it is caused by a virus.

How to deal with this scourge? PC World magazine tested seven anti-spyware software products in the $20 to $40 price range from large and small vendors: Internet Cleanup from Allume Systems (formerly Aladdin Systems), Spyware Eliminator from Aluria Software, ETrust PestPatrol AntiSpyware from Computer Associates, SpySubtract Pro from InterMute, AntiSpyware from McAfee, CounterSpy from Sunbelt Software, and Spy Sweeper from Webroot Software. In addition, two popular free programs were tested - Ad-Aware SE Personal from Lavasoft and Spybot Search&Destroy, produced by Safer Networking, as well as a free program that works completely differently, but no less effectively - HijackThis from Merijn.org. The latter program was not included in the comparison tables because, unlike the others tested, it does not scan your computer for infections. Another product tested in beta is Microsoft's new Windows AntiSpyware utility, which until late last year was released under the same name by Giant Software (see "Beta Update: Upcoming Windows AntiSpyware Looks a Winner" below) .

Anti-spyware utilities were targeted against 45 adware and spyware programs that interfere with PC operation. The number of individual files these applications created and the processes they launched totaled 81, and deleting them all proved to be a major test for the utilities we tested.

Cleaning

To begin with, a test was conducted to determine how effectively a particular program removes active components of spyware. Each application was then scanned for real-time protection (intended to prevent spyware from being installed in the first place).

Sunbelt Software's CounterSpy utility was the smartest of the bunch, finding and blocking 93% of all running processes launched by 45 spyware and adware programs it tested. CounterSpy was the only product tested that was able to “kill” and remove from the system the amazingly resilient WinTools program. The Spy Sweeper utility finished second slightly behind, cleaning out 89% of all active processes, but leaving program elements associated with both WinTools and Slotchbar. The most ineffective were AntiSpyware from McAfee and Internet Cleanup from Allume Systems, eliminating only 33 and 11% of active processes, respectively.

Spyware often “hijacks” the user's browser home page in such a way that when you try to access the Internet or find something there, you will be redirected to porn resources or some other unwanted sites. Worst of all, canceling such automatic redirects while active processes are restoring them can be very difficult. As it turned out, the tested utilities cope with correcting modifications of the browser's source and search pages with great difficulty. Internet Cleanup, McAfee AntiSpyware, Computer Associates' ETrust PestPatrol AntiSpyware, and InterMute's SpySubtract Pro were unable to detect any such changes, and Aluria Software's Spyware Eliminator corrected only 7% of them. The CounterSpy utility was the leader here too, but with only 53% success rate.

Browser Helper Objects (literally means something like “browser helper objects”, or “browser helpers”), abbreviated as BHO, are programs that modify Internet Explorer and other browsers in a certain way, usually for completely legitimate and good purposes. For example, Google Toolbar is also a BHO. However, spyware and adware developers use BHO to write toolbar components that are loaded with Internet Explorer and use ActiveX controls to record and install BHO on a PC. Thanks to this, attackers are able to create their own toolbars on our PCs, usually unwanted ones. They evade the firewalls that ask for permission to install them and gain unhindered access to the Internet.

When testing anti-spyware programs CounterSpy and Spy Sweeper to detect potentially unwanted BHOs, both caught 100%. Ad-Aware, ETrust PestPatrol Anti-Spyware, Spybot and SpySubtract tackled 62% of BHOs, while McAfee AntiSpyware and Spyware Eliminator tackled 31%. Internet Cleanup did not detect any of the BHOs ​​or toolbars.

Windows Registry keys and system startup folders are also favorite landing sites for adware and spyware. Items added to these critical areas start working every time Windows starts. Unfortunately, anti-spyware scanners in this category performed much worse than we would like. The best, with 86% detection, was again CounterSpy. It is followed by Spy Sweeper with 82% and Ad-Aware with 77%. The Internet Cleanup utility detected only 5% of Registry changes.

We also tested how these scanners track browser menu additions. These types of changes do not automatically download spyware, but if the user selects an item they add to the menu, infection may begin. For the CounterSpy and Spy Sweeper programs, the detection rate for such buttons and menu items was 100%. SpySubtract and Ad-Aware managed to detect 75% of unsolicited buttons and positions. The results of Internet Cleanup, ETrust PestPatrol and McAfee AntiSpyware in this category were zero.

A different path to success

The tenth program to take part in the trial was Merijn.org's HijackThis. It is not a regular scanner and provides a report on active processes, startup keys in the Windows Registry, contents of startup folders, BHO and services detected in the system. Armed with this program's protocol, you can find suspicious or unwanted startup menu items and remove them. Although only an experienced and confident user can identify suspicious findings, it is not difficult for even a beginner to run this program: in the future, you can post the received reports on various forums on the Internet and ask for help from specialists in identifying unwanted processes.

During testing, HijackThis was used in conjunction with the Add or Remove Programs utility included in the Windows Control Panel. It turned out that almost all 45 adware and spyware programs that infected the test system had a corresponding removal tool in Add or Remove Programs. True, for uninstallers to work effectively, it would be good to know exactly what programs they belong to, and this is not always obvious. By using uninstall programs and following HijackThis's recommendations, the best results were obtained - 100% of the active components of adware and spyware that infected the PC were eliminated. Similar success was achieved by backing up a scan conducted by the CounterSpy utility with HijackThis. No other combination was 100% successful: WinTools processes that other scanners could not detect interfered with cleanup efforts, and HijackThis alone was unable to stop processes.

Not only in skill, but also in numbers

The speed at which enemies are detected also varies significantly. The most effective program, CounterSpy, also turned out to be the fastest: it took only 1 minute to fully scan a system with 2.7 GB of data. Spybot and Spy Sweeper also showed agility, each of which scanned the test system in a little more than 2 minutes. But Spyware Eliminator was the slowest, and besides, it worked at different speeds: it took from 10 minutes to 1 hour to scan (scanning was carried out several times). The rest of the utilities took from 4 to 5 minutes to work.

The infection reports produced by the various scanners were disconcertingly varied. For example, the installed WhenUSearch toolbar was recognized by the CounterSpy scanner as two different objects from the adware category: WhenUSearch and SaveNow. For comparison, Ad-Aware detected the same toolbar as a collection of 73 objects. And even after CounterSpy removed all active WhenUSearch components, Ad-Aware continued to report five “critical” objects, which actually turned out to be three empty Registry keys and two empty folders. False alarm warnings like these can make your spyware problem appear more serious than it actually is.

Real-time monitoring

The ability to eliminate spyware threats after a machine has been infected is undoubtedly important. But timely prevention of infection is much more important. In this regard, the Spybot program has proven to be one of the most effective tools. Using the included Resident TeaTimer add-on component, this utility alerted us to any attempts by various programs to make changes to critical areas of the Registry. In this way, it was possible to avoid changing the Registry even by spyware that can write itself into memory. They were quickly eliminated by simply rebooting the system. Spybot also includes a tamper protection feature for the Hosts file (hosts.sam on Windows 95/98/Me), which acts as a roadmap for the browser: each entry consists of a website address and a corresponding IP address. to which the browser should be redirected. Attackers often use this file to prevent people from visiting security-related Internet pages, such as those of antivirus companies.

The CounterSpy and Spy Sweeper scanners also blocked attempts to modify the Hosts file, stopped editing the System Registry, prevented changes to the home page and search pages of our browser, and also detected suspicious processes in memory.

Ad-Aware SE Personal does not offer real-time protection, although the scanner can be configured to block changes to the Hosts file. However, the paid versions of Ad-Aware—SE Plus and SE Professional ($27 and $40, respectively)—include the Ad-Watch module, which has features similar to those of CounterSpy and Spy Sweeper. The ETrust PestPatrol Anti-Spyware scanner was able to detect suspicious processes in memory, but was unable to warn about changes to critical system settings. SpySubtract Pro raised an alarm when changes were made to the browser's home and search pages and detected attempts to launch suspicious processes. Real-time protection is also provided in the McAfee AntiSpyware scanner, but the effectiveness of this function is reduced due to the low recognition abilities of the program.

Neither Spyware Eliminator nor Internet Cleanup can offer anything special in terms of real-time protection. Spyware Eliminator simply creates a blacklist of suspicious websites and ActiveX controls. Although such a unique list of aggressive sites and controls never hurts. Internet Cleanup, like Spyware Eliminator, ignores changes to the home and search pages, is unable to detect suspicious processes and does not have Hosts file protection. It does, however, block pop-ups and offer privacy blocking to prevent sensitive information from being accidentally shared.

Ease of use

The interface of the CounterSpy utility is simple and pleasant. The Scan Now button is clearly visible on the welcome screen, menus are easy to navigate, and closing the program doesn't cause you to lose real-time protection. Ad-Aware's interface is equally attractive, but the program's menu options are hidden behind unlabeled icons and require some cleverness to find. Spybot forces the user to first switch to Advanced mode, and then navigate through various options to find the most useful settings and options for using tools. Both Ad-Aware and CounterSpy generate easy-to-read reports, but Ad-Aware reports classify a number of information files (“cookies”) as critical objects, causing some otherwise benign “goodies” to appear to pose a serious security risk.

HijackThis's simple text-based interface presents the available options well, but perhaps only an "advanced" user will be able to decipher the results reported by the program.

Spyware Eliminator offers a well-designed interface, but the tool is slow to load. The Internet Cleanup utility's interface is overly cluttered and inconvenient to use. The context menus found in it change depending on what section you are in; If you dive too deep into the settings, you often have no choice but to click on the “Home” button and start all over again, which, of course, is inconvenient.

The interface of ETrust PestPatrol AntiSpyware is easy to navigate, but it looks boring and unattractive. Additionally, the most noticeable thing on the utility's welcome screen is the "Enter License Key" button, which is a little confusing at first. Only by reading the fine print of the message can you be sure that your copy of the program is properly registered.

Spy Sweeper's interface is quite clear, but closing the program window will stop the real-time protection, or you will have to patiently answer numerous questions about whether you really want to disable the protection or are just going to minimize the program window. Another extreme was found in the McAfee AntiSpyware program: in the system tray (notification area) to the left of the clock there is a McAfee Security Center icon (“McAfee Security Center”), but its presence is absolutely meaningless, because it does not imply “click” access to any options anti-spyware component.

Making a choice

You can find free anti-spyware programs on the Internet, but security is one of those areas where saving money isn't worth it. The free Spybot Search&Destroy program offers an overall recognition rate of 54% and provides efficient scanning in real time. To save money, you can combine Spybot with Ad-Aware SE Personal, which has a higher recognition rate than Spybot in most categories. However, the alliance of Ad-Aware, Spybot and the free program HijackThis demonstrated its inconsistency - even with their joint efforts, these programs failed to destroy 100% of the infection with which the test system was filled.

Sunbelt Software's CounterSpy anti-spyware tool was the most powerful of the products tested. The program has the most accurate interface and showed excellent results at the highest scanning speed. And 20 dollars for a whole year of modernization and technical support is not so much. Webroot's Spy Sweeper doesn't disappoint, it's almost as effective as CounterSpy, scans fast, and is easy to use. By pairing either of these two products with the HijackThis program and taking reasonable precautions when installing any dubious "candy", you can keep your system completely free of spyware.

Beta update: Upcoming Windows AntiSpyware looks like a winner

At the moment when the tests underlying this article were coming to an end, Microsoft released a beta version of the new Windows AntiSpyware utility. The program, previously owned by Giant Software (which was acquired by Microsoft in December 2004), showed excellent results in tests. True, it uses more recent signature files than those that underlie the operation of other programs. Therefore, this new product cannot be directly compared with other anti-spyware utilities. However, it looks like Windows AntiSpyware will be a top-notch product when it's ready to go live. This program was able to detect 91% of adware and spyware in the test set, including 96% of processes that were active in memory, 67% of source and search page modifications, 100% of BHOs ​​and toolbars, 95% of Registry additions and 100% of all other elements such as menus and buttons added to programs. This utility took less than 3 minutes to scan 2.7 GB of data. The real-time monitoring provided by AntiSpyware made it possible to block infections by preventing changes to the home and search pages, identifying unknown processes in memory, eliminating unauthorized editing of the Hosts file, and preventing critical changes to Registry keys. AntiSpyware can automatically return pages to the default browser view. You can also customize the source and search pages to your taste by selecting the Advanced Tools options (Browser Hijack Restore. “Additional service. Restoring the browser after a redirect”). This is a more efficient way to deal with "sweepers" than Webroot's Spy Sweeper, which restores only the page settings that were in place when you first installed it.

In addition, Windows AntiSpyware has an intuitive interface. It is similar in functionality and button layout to CounterSpy, which also uses techniques developed by Giant Software for working with spyware signatures. However, unlike CounterSpy, the AntiSpyware utility automatically ignores information files when scanning, which will please users who prefer automatic registration on sites and their personalization provided by “pies”.

Glossary

Are you confused by all the expressions like “BHO” and “Hosts file”? If so, here's a primer on the jargon used when talking about anti-spyware topics.

Advertising programs, or adware, is defined by PC World as advertiser-supported programs that - no matter how nasty and annoying you may find them to be - still play by the rules. Such programs display a clearly marked End User Licensing Agreement (EULA) when they are installed, do not install other applications without explicitly asking permission, and provide an effective uninstall program in Windows' Installation and Installation utility. uninstalling programs."

BHO— (from the English Browser Helper Objects) “helper objects for the browser”; usually not translated. This is the name of small programs that are used to further customize the Internet Explorer browser, including changing its interface. Adware and spyware developers often use BHO to create various components that load with Internet Explorer every time it is launched.

Drivers(English Hijackers) - programs that make changes to the system in order to forcibly redirect the user to websites other than those whose addresses were specified by him. Frequently, drivers redirect the user to pornographic sites.

Hosts File(English Hosts file) - a text file that correlates website names with specific IP addresses. Entries in the Hosts file take precedence over requests from the remote domain name server (DNS) that the ISP typically deals with. Modifications to the Hosts file can cause the user to end up on a site that is not the one he expected, or prevent him from visiting a specific resource.

Processes- any executable programs that use time, memory or other CPU resources.

Registry(Windows) - a database of settings used by Windows to manage system hardware and software, as well as to accommodate various user preferences. Modifications to the Registry may cause unwanted programs to be downloaded, prevent programs from running properly, or change user-defined browser settings.

Open the Internet Options window and find the History section (a similar window or menu item is found in all browsers). Here you can remove links to pages you have previously visited. Then, under Temporary Internet Files, delete the copies of web pages stored on your hard drive.

Cookies

As in the previous case, it is enough to check your browser settings, usually located in the “Privacy” menu. Here you can delete cookies stored on your computer. Please note that as a result, the next time you visit some websites, you may have to enter your password again.

Viruses and worms

Anti-virus programs are very effective in the fight against this evil spirit - of course, if you constantly monitor the updating of the anti-virus databases. In addition, you must keep your web browser updated. It is also worth considering a personal firewall - the only effective means of protection against worms that penetrate the Internet.

Advertising and spyware (adware and spyware)

Adware programs that make their intentions explicit come with an uninstaller program and can often be easily removed from the system. Therefore, first, look in the list of the “Add or Remove Programs” utility (located in the Windows Control Panel) for an official uninstaller.

Spyware is installed secretly and is almost impossible to remove without special tools. To combat them, software is required, which is included, for example, in multifunctional packages for ensuring security when working on the Internet (an antivirus program alone is not enough).

Read more about programs that help you get rid of adware and spyware in the article.

Changing or upgrading your browser

You can protect yourself from much of the spyware by switching from Internet Explorer to an alternative browser, say Mozilla Firefox. However, almost all programs have vulnerabilities, and there is a risk of encountering problems on those few websites that do not work properly in browsers other than IE.

For those who don't want to switch to another browser, the latest versions of IE (starting with IE 6) can set some default security settings for better protection against spyware. Timely installation of new versions of IE and patches, as well as caution when installing any unknown programs will help you dodge spyware.

Once you decide to install any new program, carefully read the license agreements: they may warn you about installing additional utilities.