How to remove Viruses and Spyware manually - Part 2 of 2

[TheQueenIsWithin]

will this also work for 'partner32.mydomainadvisor' malware?

[MrNitemare0]

easy to follow, but its just a lot of work!!! there's have to be an easier way..

[RACING51211]

This is easy. Thankyou!

[RACING51211]

On the CMD, you know when you have an option for yes or no to replace the file, I siad yes and it said access denied, why is this.

[439okey]

omg that hole process looks really hard

[LAT1828NLON667W]

like the video how can we get the file you used to test your process. Be good to have to test your process in a test environment.

[TheNothing1990]

Man.... you people are ANNOYING... yeesh- I know this sounds piggish, but if you don't get this video, remove your virus/malware through OTHER means!! You really think this guy is going to answer every random question happen you churn out?

[gormanmi]

This is really good. I'm a IT student at the minute with a bunch of certs and none have really explained how to get rid of malware. I would be really interested if you did a more in depth video with maybe seeing malware in different scenarios.

Thanks.

[drawingdude4711]

HELP ME!! I have this problem: Windows security alert!

Windows reports that computer is infected. Antivirus Software helps you protect your computer from viruses and other security threats. Click here for the scan your computer. Your system might be at risk right now. ) i get that message every 20 sec or so and i can't open like.. exe stuff and such because it says forexample: Virus alert!

Application can't be started! The file mspaint.exe is damaged. PLEASE HELP D: i think i have a trojantoo

[connormallory]

does this process actually REMOVE the viruses, or does it just isolate them? if it isolates them, then can we remove them after isolation?

[leedalemon]

i really need help to get rid of gostats . com redirect spyware. for most websites i try to load them and in the bottom left in my browser it just says gostats . com?? does anyone kno how to remove and dont just say "get superantispyware" or "get spybot" coz ive got about 4 or 5 different antispyware/malware PLEASE HELP!!!

[Akkadiandude]

Got a couple questions

1. Are the purple ones the only one infected?

2. if i kill a program will it start up again on next boot?

3. is this legit?

[LemonPieLoL]

@Akkadiandude

1. no, they are compressed libraries/executables. malware libraries or executables will often compress themselves to evade virus signature detection.

2. if you kill it through task manager or procexp, yes.

3. i don't see why not. be careful with hijack this though.

[MwFreezd]

i got viruses infected me in c:\windows\system32\searchprot­ocalhost.exe and and windows\explorer.exe. does anyone know if it will harm my computer ? its a trojan dropper.small but idk if it just wants credit card info.

[LemonPieLoL]

@MwFreezd that is the most ignorant question i have ever heard. good luck.

[mrsgoodrich3]

I was able to download both HiJack and Processor, but the virus will not allow it to open....I have also tried it in safe mode w/o success....any suggestion

[callmecrayza]

@mrsgoodrich3 hey...the same thing is happening to me...did you fix yours yet?

[Metzky94]

Best ending to a video ever

[AirsoftLouisiana]

hey i have a problem. my girlfriend has a virus and im trying to fix it. the virus wont let us boot into the desktop. should we just go into safe mode and disable the file or what? because i already know the viruses name.

[pokemonhardcorefan]

answer and ill subscribe!!!!!

[pokemonhardcorefan]

ummm so if i dont see any colored lines in process explorer, then i'm fine? i am talking about the section on the bottom with all the dlls

[pokemonhardcorefan]

ummm so if i dont see any colored lines in process explorer, then i'm fine?

[Boieng747obsession]

does command prompt work on win XP?

[2dayCA]

@Boieng747obsession Command prompt is on every OS my friend.

[chickenpwn000]

when i do cacls esent.dll /p everyone:n

it says are u sure, yes no

then i do yes and it says access denied what do i do

[itzDankk]

Thanks for the help, i totally understand everything you said.

I have a problem though, every time i try to load the cmd, the stupid error message from the spyware or whatever prevents me from opening anything apart from my browser and the procexplorer.

How do i get by this??

[eneerge]

Excellent video. I've always used autoruns to identify drivers and other strange files and disabled them there. This is actually some more good knowledge to know for confirming that everything is removed. BTW, have you deleted any of these files, rather than changing their permissions, and run into any problems?

[DBOE2011]

i have a 'system' but no 'system32'.

[pokemonhardcorefan]

@DBOE2011 if thats true, then ur computer is messed up! check again!

my computer--->local disk(C:)--->WINDOWS---->system­32!!

[yourchannelnumberone]

well guys i dont presume ...but this i could call the most near to all that you need to learn to fix your computer in the old way (using a lot of programs (thats the old way yet)) because my method dont use all that (and really that way show here dont ever work beliebe me (it have some bugs)...well if want to learn the most update method...jus see my channel

[ERICINMYPOCKET]

i really dont know what to do this is a very go way to take things off but i mean there has got to be a better way in finding these things much much easyer

[Helicon2112]

@ exids Another thing, how can you be sure the .dll file your disabling for all users is malicious?

[Helicon2112]

@ exids Wouldn't it just be easier to find the .dll file in the system32 file and delete it?

[WorldOfIvillis]

@Helicon2112 watch his first part

[mistoroboto]

Why exactly is this called the "Botts Technique"? Seems like all it is requires, locating packed file, change their ACL's then tell your audience to stupidly shut their system off in the event a virus might launch at shutdown. If the virus is that bad, then the job is not done. There are much better ways to kill a virus without risking damage to their hard drive.

[fero42]

can waht is this virus ?? mfevtps.exe help plz

[serhad95]

@fero42 thats McAfee antivirus exe

[fero42]

@serhad95  evet biliyom vrus sildim saden mcafe dun saden bi hata yapmis butun mcafe kulanlar pcye vurus girdi format atim yeniden yukledim

[serhad95]

@fero42 ii sevindim hewal sildigine

[serhad95]

@fero42 sorry it is not mcAfee i missread it ve bu virus tur silmeni tavsiyeederim

[ROGYORK]

Ha Ha Ha ... I miss all that fun I used to have before I switched to Mac!

[mufferrs]

Great vid, reports from spybot says trend & Mcaffee maybe considerd to be spyware

[irocksuck]

wat does that mean??

[irocksuck]

bro i dont have a purple line.

[PCAddictsLive]

Nice video, thanks.

[trinidad318]

you are my hero! lol

[PriDeNevErDie789]

you dont explain shit, fuck you video maker

[shinigamiguy1]

anyone know how i can get a virus off of my mp3 player?.....i know its on there but the file doesnt show or any thing.....

[oliverking90001]

You can just delete/quarantine suspicious files always do all this in safe mode, always do your research. Save deleted files in a different location with a changed name. DLL's can become corrupted even if they are name legitimately didn't think of that did you.....????

Always do your research online on any discovered threats remove registry-keys and all associated files changing permissions is pretty weak when its less work to remove

[virtualwebman]

I will give it a try. I have problems on my desktop where I can't even download any thing. I can't even start my antivirus program.

[mexijew]

When I put cacls ntosknrl.exe /p everyone:N and yes, it says that access is denied already.

[dgill1200]

open the command prompt using administrator. If you right click on the cmd prompt icon select open as administrator

if that doesn't work post the results of the error.

[lamakinadecotorra01]

how can i get this software without payin for it ...........cuz when i try to download the process explorer is zip and i can downloade it !!!!!!!! please help ...

[youwait]

what happens if you get a message like "The system cannot find the file specified" how can i fix that or what can i do to make it find the file?

[cybersoil]

Wow! Great Stuff! Thanks for taking the time to make and post all of these wonderful and helpful videos.

[WunderMaus]

Excellent video. Thank you for sharing your knowledge and experience. Very comfortable pace and clear visuals make your tutorial easy to follow.

[TurntablismZanadu]

it looks hard

[atlaspredrag]

Try it, it's not hard.

It's much easy then backup, format, clean install... antivirus scan of backup ...

You need to kill process and all DLL files that are not normal in windows sys. then delete those files, then remove it from startup ->REGISTRY!!

Everything is so hard untill you try it, if not succesful from 1st time, keep trying and result will come. C-ya

[JB9982]

fuck windows.. fuck DOS.. fuck Apple...

[medwardw2]

I dont get it

[andremartins18]

very good indeed.

i want to know if this kind of process is efficient with trojans in the vista OS.

[yum499]

how the frick do i get that little window that u had with those bad purple files?~

[timepass21]

There is a menu called View at the top...

[FUZZJP]

Hey, I have a problem. I have some purple files, but when I try to do the cacls thingy, it tells me that "The system cannot find the file specified"

what tabs should I be looking under for "bad" files?

and how do I get that "split-screen" look that you have?

Mine is only one "fused" screen.

P.S. all the purple/magenta highlighted files are .exe files...how do I see the .dll ones?

Is there anything harmful about the .exe ones? (I have 91 that are highlighted -_-)

HELP PLEASE!

[whit3n1ght]

Dude thankyou soooo much i cant thank you enough!!!! you saved my ass from alot!!!! thanksssss!!!!!

[mullet123100]

hhhh im just gonna go smash my computer and see if insurence will kick in

[elementbamiscool]

dude when i try to open up cmd, it says it cant

it says if i want to find how to on the internet, or choose a program

HELP!

[bailey2007player]

type cmd.exe

[englishman1234567]

this is kinda weird but when i exit utube this message comes up

something unexpected happened please smash your head on the keyboard and run around the room!

HELP????

[christkdcdd]

Dude,

stfu

[holyguitar90]

were can i get these progames... there awesome :D

[gucci2490]

in my processes i have over 100 "taskeng.exes" running and its this way every time i restart the computer. it doesn't really slow it down at all, im just wondering why they are there. any ideas?

[IzzyXgallY]

i got WinXP64 OS and i got the gadcom.exe virus. will this help me???

[hacmama]

very good!, thanks, but how can i create "process exploxer" icon (what's the filename?)

[uueuu]

nice......I'll try

[crazeeladie]

sorry to be asking this here i think that this spyware is messing up my connection!! can you tell me what r00000000000a.clb is? i have 12 svchost.exe running and only two do not have the r00... thing i'm seeing this thing all over the place including process explorer and my antivirus!! help!! (good thing i watched this vid!!!)

[EdenGradery]

crazee. its a virus...

[crazeeladie]

thanx though XD but i reset my system already! it's all better lol!

[Rramet]

Now, do I have to shutdown cold everytime i turn off the computer.

[givemeaname55555]

no only that once

[Ghost0nline]

Awesome job helped me alot thanks =D.

[hcruiz342]

u said somethin bout how some ppl may not know if they actually do have a virus installed in their system, because i have had threats, but i can still go on the net and do mostly nething. how to kno if the virus is permanantly stuck.

[smallmagicshop]

Thanks that was a realy good video

[Pashtonmordagaw]

thank you ! you did a great job !

[ANDYiiSHCOOL]

i Love You :D Again.

[joethestrummer]

Nice video - I have billed literally hundreds of hours cleaning spyware and although the money is good I hate spending my time doing this. Computer consulting is all about efficiency with your time. Spyware scanning tools can take upwards of 15-20 mins to complete and often can't clean the real nasty buggies. I go directly to Prc Explr and hijacthis. Another tip for locating bad files is sorting system32 dir by date. Files added on your spyware infection date are easiy identified.

[MasterPCTech]

Brilliant work, Exids!

I clean this stuff professionally, and this technique is exactly how I dig out spyware/trojans/viruses, when my cleaners/scanners can't do the job.

Excellent work!

-Lee

[earthstarm]

do i have to be in safe mode while performing this bots technique? If not can i go online at the same time to search for culprit file definitions on google. i just thought you should never be connected to the internet while removing a virus. is this different?

[Jacksparrow123456wwe]

:O TOTALLY WORKS! THANKS A LOT!!!

[ultimanerd]

the only way to get rid of a virus is to reinstall your os

[hcruiz342]

wat to do if i have virus/spyware but i dont kno much bout computers. is there any other way to remove them so that i dont have to format my system.

[nberios]

very informative video, thank you for the time

[youngmeach]

thank you for this video before I found this video I had 4 viruses on my computer but now thanks to you my computer is virus free.

[alfredrut]

I cant use ctrl+alt+del, and I cant use the search function, and not the controlpanel either...dont think I can use command promt 'cause I cant search for it...What should I do?!

[killmebillyyy]

i had that problem, and the only thing i found was re-install windows.

[warrat300]

wow ty.

I'll try to make a batch file to auto all that.

[jstsweetguy]

thnx dude,, really wrkd

i hd a single spyware process tht ws irritatng the hell out of me,

ths tchnque solved it in 2 mins

[devilantony100]

wow super geeek XD but thx i manage to get the spyware prob i had i wish i c give u 80$

[zujaja22]

Is there any procedure through which we could differeciate between viruses and system files?

[exids]

Quite honestly the best way is to just research each process and dll with Google. You will be amazed at all the crap that is still left in your computer, even if you uninstalled it a long time ago!

[nberios]

yes google the file

[jackcouldeatnolean]

Major problem - I accidentally killed the main internet explorer thing.

is there anyway I can get it back??

Now, I don't see the tool bar on the bottom of my screen, or anything on the desktop.

ADVICE NEEDED PLEASE :///////

[exids]

If you kill the process explorer.exe, it's easy to start it back up.

Simply go to file... run in process explorer. When the run box opens, type in explorer.exe and click ok. This will bring back your task bar and desktop.

[nfsu2gamer]

ctrl+alt+del file...new task type "explorer"

[icykid]

yeah yeah I've heard rumors you're good

[someonelostin100]

i have a question. what's the difference with svchost with sscviihost?

[exids]

One is spyware and one is critical to the operation of windows. sscviihost is spyware. Don;t ever do anything to the svchost file, it is a critical file to keeping things runing smoothly.

[exids]

There are risks associated with this, that is why I recommend that you have an experienced technician follow this procedure if you are unsure.

The main thing is to stay away from editing files from companies YOU KNOW are safe.

[SOF006]

Im wondering is this risky because i dont wont to kill my computer

[Leeqkey]

Yeahhhhhhhhhhhh..i did it. OMG..This the best tutorial i did have..really interesting..took like four hours since i had a bunch of viruses and my file system was in a FAT32 mode so had to change it to NTFS..But i did do it..i didnt give up..Chris you the best.Thankyou very much..Me and Bottts technique we are one tool now..THANKS

[loveshiskitties]

thanks.

[crispocream123]

I am sorry but i dont understand anything of what I have just saw. I do not have any viruses nor do I attend to but I hear these comments that you have helped people so I guess it doesn work and make sence, I think I have to have a virus before I get it because I do not know what it is like. but thank you for uploading the video anyways.

[tholithemba]

watch part 1 and repeat it again you'll get it

my problem is i don't know if you are also suppose to type that cacls word

[IchigoKurosaki321]

THANK YOU SO MUCH!!!

i don't know what would happen if you didnt upload this.

THANK YOU!!