1. Disconnect from the Internet
2. Try a Traditional UninstallA suprising number of applications labeled as adware and spyware have fully functioning uninstallers that will cleanly remove the program. Before moving on to more complex steps, start with the easiest route and check the Add/Remove Programs list in the Windows Control Panel. If the unwanted program is listed, simply highlight it and click the Remove button. In Windows Vista, the Add/Remove Programs feature is listed in Control Panel as Programs and Features. After removing the adware or spyware via Control Panel's Add/Remove Programs, reboot the computer. Make sure you reboot after the uninstall, even if you aren't prompted to do so.
3. Scan Your Computer
After you've disconnected from the Internet, removed any adware or spyware listed in Add/Remove Programs, and rebooted the computer, the next step is to run a full system scan using an up-to-date antivirus scanner. If your antivirus will allow it, run the scan in Safe Mode. If you don't have antivirus installed, select from one of these top-rated antivirus scanners or from one of these free antivirus scanners. If prompted, allow the scanner to clean, quarantine, or delete as appropriate.
Much of today's spyware is delivered via the Zlob family of Trojan downloaders. The free SmitFraudFix tool does a good job of removing many variants of Zlob-related adware and spyware. For the free download and usage instructions, see: SmitFraudFix Removes Zlob and Other Pests. MalwareBytes does a good job of removing scareware, rogue software that hijacks your computer and tries to scare you into purchasing "protection". For the free download and usage instructions, visit: MalwareBytes' Anti-Malware.
5. Get Clear Access to the ProblemWhile scanning the system in Safe Mode is good practice, it may not be enough to thwart some malware. If the adware or spyware persists despite the above efforts, you'll need to get access to the drive without allowing the adware or spyware to load. The most effective means to get clean access to the drive is to use a BartPE Bootable CD. Once you've booted to the BartPE CD, you can access the file manager, locate the installed antivirus and rescan the system. Or, locate the offending files and folders and manually delete them.
6. Undo the Residual DamageAfter removing the active infestation, you'll need to make sure the adware or spyware won't simply reintegrate itself when the computer is reconnecting to the Internet.
- Before reconnecting, reset your browser start and home pages. (See Resetting Internet Explorer Settings).
- Ensure your HOSTS file hasn't been hijacked. (See Protecting the HOSTS file)
- Make sure undesirable websites haven't been added to your Trusted Sites Zone. (See How to Check Your Trusted Sites List)