From here, it's not really that hard. The biggest and most effective tip that's included here is merely to boot to safe mode before you do anything. The reason for this is that if the spyware is running when you attempt to remove it, it will be undeletable. You can't erase a file that is in use. Safe mode boots up with minimal drivers and doesn't start any programs and so the spyware, most of the time, doesn't load. To boot to safe mode, simply restart the machine, and keep pressing the F8 key (the computer may beep at you, this is fine) until you see the menu pop up. If you see the Windows logo and haven't run into a menu yet, then it's gone too far and you'll have to reboot again. Anyway, once the menu has come up, select Safe Mode, and press enter.
Windows will then load with as little as possible, including video drivers. The resolution will be set to 640x480 so everything will look huge. Just get to your desktop, and follow these steps:
- Run AdAware-SE, and do a full system scan with it.
- Run Spybot: Search and Destroy and scan with it.
- Run HijackThis, and clean out anything that was left behind
- If you see the 'Hijacked Internet Access' entry in HijackThis, then follow these instructions.
- Wrapping it up, how to prevent future infections.
That's seriously all that there is to it most of the time. As long as you update the programs definitions before you run them then they will usually pick up on most things and remove them automatically. The biggest and most important step is to make sure that everything is clean within HijackThis. If you miss something in there, then whatever is left over will likely load on your next normal startup and go to town reinstalling itself. This can be a major pain in the butt if it's a more stubborn and well-written variant of spyware.
If after this you are still getting pop-ups or whatever then more drastic measures can be taken.
