Immediately: Disconnect From the Internet
The first thing you should do is close all open browser windows and applications (including email) and disconnect your computer from the internet. If you’re connected to the internet using an Ethernet cable, just remove the cable from your computer. If you’re connected via Wi-Fi, here’s how to disconnect it:
Try a Standard Uninstall
A surprising number of applications labeled as adware and spyware have fully functioning uninstallers that will cleanly remove the program. Before moving on to more complex steps, check the Add/Remove Programs list in the Windows Control Panel. If the unwanted program is listed, highlight it and select Remove. Once the adware or spyware is uninstalled, reboot the computer.
Scan Your Computer
After you’ve disconnected from the internet, removed any adware or spyware listed in Add/Remove Programs, and rebooted the computer, the next step is to run a full system scan using an up-to-date antivirus scanner. Run the scan in Safe Mode if your antivirus program allows it. If you don’t have an antivirus program installed, consider picking one of these top-rated antivirus scanners. Allow it to clean, quarantine, or delete as appropriate.
Use a Spyware Removal Program
Many good spyware removal tools are available for free. MalwareBytes, for example, is a popular option that does a good job of removing scareware—rogue software that hijacks your computer and tries to scare you into purchasing “protection.”
Get Clear Access to the Problem
While scanning your system in Safe Mode is good practice, it may not be enough to thwart some malware. If the adware or spyware persists despite the above efforts, you’ll need to get access to the drive without allowing the adware or spyware to load. The most effective means to get clean access to the drive is to use a BartPE Bootable CD. Once you’ve booted to the BartPE CD, you can access the file manager, locate the installed antivirus, and rescan the system. Or, locate the offending files and folders and manually delete them.
Undo the Residual Damage
After removing the active infestation, make sure the adware or spyware won’t simply reintegrate itself when the computer reconnects to the internet. Before reconnecting, reset your browser start and home pages. Make sure your HOSTS file hasn’t been hijacked, and make sure undesirable websites weren’t added to your Trusted Sites Zone.
