Removing Unwanted Code

If despite all your best efforts, a system in your organization has managed to pick up some unwanted executable code, you'll no doubt want to remove it. Assuming that the standard Add/Remove Programs approach can't remove the code, let me offer you some alternative approaches for each kind of unwanted code.

Removing Viruses
First, if it's a virus, you'll want to get rid of it with a virus-cleaning utility. If the system has virus prevention in place, but it didn't manage to catch the unwanted code, check the signature file's date. If the file is out of date, update it and run a scan. If the system doesn't have virus prevention in place, try the free online virus scanning that Trend Micro offers at http://housecall.trendmicro.com. Trend Micro's HouseCall is an ActiveX control that's downloaded to and executes in the user's browser (make sure the system's Microsoft Internet Explorer—IE— security settings allow this behavior) and scans the local system with the latest signature file from Trend Micro. If you want it to do so, the utility can remove any virus infections it finds.

If the virus-scanning utility doesn't work, you can also try Microsoft's Malicious Software Removal Tool (MSRT), available at http://www.microsoft.com/security/malwareremove/default.mspx to rid your system of the unwanted executable code. Microsoft updates the tool at least once a month with new viruses and worms to be removed.

Removing Adware and Spyware
If the unwanted executable code isn't a virus and MSRT doesn't remove it, you're probably dealing with adware or spyware. Adware and spyware exist in a gray area; antivirus utilities don't always automatically detect them. Because most adware and spyware are intended to run on client systems at all times, the applications typically configure themselves to launch when the OS launches. You can examine the various locations and methods such applications can use to launch themselves, including the following:

Note: As always, take great care when you edit the registry. An incorrectly applied change could have a severe impact on your system, including making it unbootable.

Checking Components Before Removal
The tricky part about going after programs isn't so much in finding the applications that start automatically with the OS but knowing which autostart executables are valid—part of the OS or valid third-party software—and which are unwanted. Before you start removing references to applications configured to start up automatically, you should consult two references for each application you find. The first is the Microsoft DLL Help component-lookup utility, which you can find at http://support.micro soft.com/dllhelp. Enter an executable name (e.g., mstask.exe), and the tool tells you whether it's a valid Microsoft executable.

As a second check, go to the Win-Tasks Process Library that UniBlue (formerly LiUtilities) maintains at http://www.liutilities.com/products/wintaskspro/processlibrary/ to see whether a component is part of a valid third-party application.

To make the process of removing unwanted executable code easier, you can use the System Configuration Utility (Msconfig) available on Windows XP and Windows 98 (click Start, Run and enter msconfig) to check automatic startup components. Figure 1 shows the Msconfig utility. Go to the Startup tab to see all applications configured to start up with the system or to the *.INI tabs to inspect the local .ini files.

If you run a system other than XP or Win98 or you want a more in-depth look at what components start up with your system, you can download the free Autoruns utility from Sysinternals at http://www.sysinternals.com/utilities/autoruns.html. Autoruns gives you an incredible amount of detail about the components configured to start up as your system boots or as you log on to your desktop. Figure 2 shows a sample Autoruns screen.

Finding Spyware in Browser Helper Objects
One of the most difficult locations in which spyware can hide is the IE Browser Helper Object. Browser Helper Objects are designed to provide add-on features and functionality to IE to improve a user's browsing experience. For example, many popular IE toolbars are Browser Helper Objects. However, Browser Helper Objects' level of access to users' browsing data (e.g., URLs entered, form data provided) is significant. When you combine that with the fact that Browser Helper Objects are harder to find and remove than simple startup applications, you can understand why Browser Helper Objects are a popular mechanism for spyware and malware authors for installing their software.

You can use two techniques to find Browser Helper Objects configured on your system. If you use XP with Service Pack 2 (SP2), you can use the Add-On Manager (in IE, select Tools, Manage Add-ons) to view all Browser Helper Objects currently loaded in IE and disable any of them. Figure 3 shows the IE Manage Addons dialog box. By selecting an add-on from the list and disabling it, you can effectively remove the capabilities of any application that has integrated itself into the browser.

If you don't run XP SP2, the process is a bit more manual. You need to inspect the registry subkey HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects to see what has been configured for your system. The subkeys are class IDs, which will correlate to another area in the registry. In each subkey, you might or might not have a descriptive tag for the Browser Helper Object that the class ID represents. Figure 4, shows a view of this section of the registry.

You can skip the class IDs for the Browser Helper Objects that have a descriptive tag and whose applications you recognize as valid. All other class IDs are worth investigating. Make a list of them, then look in the HKEY_CLASSES_ROOTCLSID subtree for the unique class IDs you've identified. Figure 5, shows a suspicious class ID that I found and isolated.

Two things stand out about this Browser Helper Object. First, in the Browser Helper Object registry subkey, HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects, this item didn't have a description associated with it. Second, when I look at the class ID details, I see that it calls a DLL directly from the Windows %SystemRoot% directory for my system. My cross-referencing of the DLL against the Microsoft site shows that it's not a valid part of the OS. Therefore, the Browser Helper Object is highly suspect and a likely candidate for removal. To remove the Browser Helper Object completely, remove the references from both registry subkeys (the Browser Helper Object subkey and the CLSID subkey), then delete any .dll or .exe files named in the CLSID subkey.

Instead of going through that manual effort, you might want to use the Microsoft Windows Defender antispyware application. Installing Defender on a system infected with spyware is probably the quickest and easiest method of getting rid of unwanted executable code on a user's workstation.

Removing unwanted executable code from a system in your organization isn't a pleasant task, but it isn't an impossible one either. Through careful planning, policy development, and architecture design and implementation, you can significantly decrease the chances that users will bring unwanted code into your organization. But if or when some piece of malware does make it onto one of your systems, you now have some tools for getting rid of it.