No one is safe from spyware -- particularly not naïve users who are quick to click pop-up boxes and installation prompts, entertain spam offers or surf malicious Web sites.
The best preventative measure is probably end-user education, but for many, it's already too late and spyware issues are running rampant on Windows workstations. To help you identify, troubleshoot different types and clean up spyware infections, check out the following scenarios. We'll present several end-user complaints followed by diagnoses and possible courses of action to take from three Windows security experts. You'll find that each expert has a unique solution to each problem -- so be sure to consider them all when troubleshooting your own spyware issues. Good luck!
The users' problems
I support over 300 users who have both home and work computers running either Windows XP or Windows 2000. Several users have reported the following problems:
- When the browser is closed (not even connected to the Internet sometimes) pop-up ads appear.
- When opening Internet Explorer, a site like HotOffers.com appears instead of our intranet home page.
- A search toolbar called Viewpoint appeared on the browser, and it keeps running searches on whatever we type into our address fields.
I have up-to-date antivirus software and found no viruses. My Spybot - Search & Destroy scans find unfamiliar files that I'll remove, but it does nothing to solve these problems. What are they? How can I get rid of them? HELP!
The experts' remedies
Stage one: Diagnosis
Given the information in the scenario, are these users' computers infected with spyware? Click here to find out.
Stage two: Immediate actions
What steps should you take immediately after a workstation has been infected with spyware? Click here to find out.
Stage three: Recovery
What should you do to start getting Windows on the road to recovery and normal operation? Click here to find out.
Stage four: Preventative measures
How can you avoid being infected in the future? Click here to find out.
About the experts
Lawrence Abrams: CTO of a New York City-based ISP, and owner/creator of BleepingComputer.com, a Web site devoted to teaching basic computer concepts focusing on the removal of malware.
Kevin Beaver: CISSP, Principle Logic, LLC, author of Hacking For Dummies, co-author of Hacking Wireless Networks For Dummies and SearchWindowsSecurity.com's Windows Security Threats expert.
Tony Bradley: CISSP-ISSAP, MCSE2k, MCSA, A+, editor of the About.com Guide for Internet/Network Security and creator of the Essential Computer Security Web site.
Do you have an idea for a Windows Security Clinic? E-mail us and we'll address it in our upcoming editions.
