Virus & Spyware Removal for Windows

If you have questions, please email consult@uic.edu or call the Client Services Office at (312) 413-0003.

If you currently have an Internet connection then follow all the steps below to secure your Windows machine and remove all spyware and viruses. This document contains detailed step-by-step procedures you must follow in order to secure your machine. A careful, methodic approach to these procedures will pay off in the long run! Please be sure to follow the instructions carefully.

Patch your machine!

Windows Update will install patches to secure your machine. Patches are updates that help resolve known issues and protect your computer from known security vulnerabilities.

1. Use Microsoft Internet Explorer to go to: http://windowsupdate.microsoft.com
2. Click on Express: Get high-priority updates (recommended)
3. Wait while it checks for the updates that your computer needs.
4. Install ALL high priority updates to help keep your computer up-to-date and secure. To install these updates, click Install Updates.
5. Reboot your machine if prompted.

Setup Windows Update Notifications

Windows Update helps you to keep your computer up-to-date. These updates help resolve known issues and protects your computer from known security vulnerabilities. To turn on automatic updates do the following:

Windows XP users:

1. Click on Start.
2. Go to Control Panel.
3. Click on Performance and Maintenance.
4. Click on System.
5. Click on the Automatic Updates tab.
6. Click on the radio button next to Download the updates automatically and notify me when they are ready to be installed. When you receive these notifications make sure you install the updates!

Windows 2000 users:

1. Click on Start.
2. Go to Control Panel.
3. Click on Automatic Updates.
4. Click the radio button next to Automatic (recommended) and pick a day and time to check for updates.
5. -- Or -- click on the radio button next to Download the updates automatically but notify me when they are ready to be installed. When you receive these notifications make sure you install the updates!
6. Click on OK.

Protect your machine with Antivirus Software!

1. If you do not have Symantec AntiVirus software currently installed on your machine then you should install it as soon as possible. To minimize problems, uninstall all previously installed antivirus programs before you install the current version.
   
   You can find out if you have Symantec installed by looking in the lower right hand corner of your screen, a yellow/gold shield icon will be there if then you have Symantec installed. You can also check by clicking on Start and going to Programs. If you see Symantec AntiVirus in the list of programs installed, then you have it installed.
   
   
2. Symantec Antivirus can be downloaded from the following web site: http://e-sales.accc.uic.edu .
   
   
   
3. To view system requirements and installation instructions, see Intro to Symantec/Norton AntiVirus Software at UIC.
   
   
4. Once you install Symantec AntiVirus, or if you already have Symantec AntiVirus software installed on your machine, update your virus definitions.
   1. Open Symantec AntiVirus by double-clicking on the yellow/gold shield icon in the corner of your computer.
   2. Click on the LiveUpdate button. An options box will pop up.
   3. Click on Next in the options box.
   4. Click Finish once everything is updated.
   5. Click Exit.
      
      
5. Schedule LiveUpdate to run on a regular basis.
   1. Open Symantec AntiVirus by double-clicking on the yellow/gold shield icon in the corner of your computer.
   2. Select File.
   3. Select Schedule Updates.
   4. Click Enable scheduled automatic updates.
   5. Then click the Schedule button.
   6. Run LiveUpdate at least weekly, but I recommend daily, and be sure to pick a time when your computer will be connected to the Internet.
   7. When you're finished, click OK, OK, and close Exit to close SAV.

Stinger is a program that detects and removes specific viruses.

If you use Windows ME or Windows XP, Disable System Restore:

If you use Windows ME or Windows XP, you MUST disable System Restore before you run Stinger. System Restore is a restore utility that Windows ME and Windows XP use that backs up selected files automatically to the C:\_Restore folder. This means that an infected file could be stored there as a backup file, and VirusScan will be unable to delete these files. You must disable the System Restore Utility to remove the infected files from the C:\_Restore folder.

Windows XP Users:

1. Right click the My Computer icon on the Desktop and click on Properties.
2. Click on the System Restore tab.
3. Put a check mark next to Turn off System Restore.
   
4. Click the OK button.
5. You will be prompted to restart the computer. Click Yes.

Windows ME Users:

1. Right click the My Computer icon on the Desktop and click on Properties.
2. Click on the Performance tab.
3. Click on the File System button.
4. Click on the Troubleshooting tab.
5. Put a check mark next to Disable System Restore.
   
6. Click the OK button.
7. You will be prompted to restart the computer. Click Yes.

Now you can run Stinger!

1. Download the Stinger.exe file from the following site: http://vil.nai.com/vil/stinger/
   This site also contains installation instructions as well as information on how to use Stinger to remove viruses.

1. Run Spybot to remove spyware. Spyware is software that transmits personally identifiable information from your computer to some place in the Internet without your knowledge. We suggest you run a spyware removal software such as Spybot or Ad-Aware to remove spyware from your machine in order to improve performance. However, be advised that these programs can effect the registry. You should read all of the documentation before running these programs and understand the risks involved in removing them. These programs are NOT supported by the ACCC.
   1. Spybot can be downloaded from the following Web site:
      http://www.safer-networking.org/en/download/index.html
   2. Refer to the following Web site for installation instructions as well as information on how to use Spybot: http://www.safer-networking.org/en/tutorial/index.html
   3. After the installation has finished, you will see a Spybot - Search & Destroy button on your desktop and in your Start menu. Click on it to start Spybot-S&D the first time.
   4. The first button on the toolbar at the bottom is named Check for problems. Click on this button to start the scan.
   5. Once the scan is finished you will see a list of everything that was found. The red entries represent spyware and similar threats. The green entries represent usage tracks. If you click on each product a pop-up window will be displayed with information on that particular spyware. YOU are responsible for reading through the list of spyware found and removing the appropriate files.
   6. Click on the Fix selected problems buttons to remove the spyware that was found on your machine.
      
      
2. If you are using Windows Me or Windows XP, turn System Restore back on! System Restore will create regular backups of selected system files and program files.
   
   • Windows XP USERS:
     1. Right-click the My Computer icon on the Desktop and click on Properties.
     2. Click on the System Restore tab.
     3. Uncheck the box next to Turn off System Restore.
        
     4. Click the OK button.
     5. You will be prompted to restart the computer. Click Yes.
        
        
   • To enable Windows ME System Restore:
     1. Right click the My Computer icon on the desktop and click on Properties.
     2. Click on the Performance tab.
     3. Click on the File System button.
     4. Click on the Troubleshooting tab.
     5. Uncheck the box next to Disable System Restore.
        
     6. Click the OK button.
     7. You will be prompted to restart the computer. Click Yes.
        
        
3. Turn on Windows XP firewall.
   If you are running Windows XP, the ACCC recommends you turn on the XP Firewall.
   
   1. Click on Start.
   2. Go to Control Panel.
   3. Click on Network and Internet Connections.
   4. Click on Network Connections.
   5. Right click on Local Area Connection.
   6. Go to Properties.
   7. Click on Advanced.
   8. Put a check in the box next to Protect my computer and network by limiting or preventing access to this computer from the Internet.

• Spybot Search & Destroy - spyware removal tool: http://www.safer-networking.org/en/home/index.html
• Stinger - A stand-alone utility used to detect and remove specific viruses: http://vil.nai.com/vil/stinger/
• Ad-Aware - Spyware removal tool: http://www.lavasoftusa.com/products/ad_aware_free.php
• Symantec Security Response: http://www.sarc.com/
• Microsoft Windows Update (Microsoft IE only): http://windowsupdate.microsoft.com
• Information on Viruses and Security Alerts: http://www.accc.uic.edu/software/antivirus/