What is spyware?

    Spyware is a technical name for any software that tracks the user’s activities without user’s permission; when he is online and passes the information to a third party. Spywares are programs, which use your computer without your permission or knowledge, and try to accumulate our private information and use our own computer resources to relay it to someone else. Another potential problem is that many Spywares are poorly written, "contains bugs or errors", and can cause problems with the normal operation of your computer, because of which the web-browser experiences "General Protection Faults", hangs, or freezes it may be due to one or more of these types of programs interfering with its proper function. Spywares come in the Trojan horse category of viruses. Spywares are distributed mainly through the Internet, via freeware downloads or through underground hacker sites. Spywares are also sometimes bundled along with some commercial software, as a means to track the usage of the software and collect data regarding the user.

What is adware?
    Adware is the most common kind of spyware, adware generates several types of ads, possibly keyed to the sites you visit on the Internet. May download programs onto your PC without your knowledge.

What are the types of spyware that we can remove?
• Adware: The most common kind of spyware, adware generates several types of ads, possibly keyed to the sites you visit on the Internet. May download programs onto your PC without your knowledge.
• Adware cookies: Installed without your knowledge, these tiny pieces of code store information about your surfing habits. Can let marketing companies create and sell a profile of you.
• Browser hijacker: Changes the settings in Microsoft's Internet Explorer browser, changes your chosen home page, and redirects your searches. May render browser useless.
• Dialer: Disconnects you from your Internet service provider and reconnects you to the Internet using an expensive line.
• Keylogger: Records all the keystrokes you type. May let outsiders access your logins, passwords and credit card numbers.
• System monitor: Records keystrokes plus e-mail, chat room conversations and instant messages. May be accessible to outsiders.
• Trojans: Programs that let outsiders make changes to your computer. Might create or delete files, or install other programs without your knowledge

What is an Export Worms report?
    Clicking on the Export Worms button on the main GUI (Graphical User Interface) of AntiSpyware Plus lets you send mail to our Research team for review. It contains the scanned spyware entries on your PC and few other file/registry entries which help our Research Team review issues on your PC. We then add new definition and you eliminate spyware found on YOUR PC in the next Live Update.

What is Live Update?
     We are continuously updating our database of spywares, bad cookies, host files, bad BHOs and bad Active X for your protection. You can get benefit of those updates and the range of operation of Antispyware Plus increases manifold. We provide you the latest list by Live Update option. Click on Live Update button on the main GUI of AntiSpyware Plus. A window opens, which downloads the new versions of database file, version file and other files necessary to upgrade your PC.



Can I install AntiSpyware Plus on multiple computers with one Registration Number?
    No. The Registration Number is valid only for a single computer. The same Registration Number can be used on multiple Operating Systems on same computer. But can not be used on different computers.

Do you have a foreign language version of AntiSpyware Plus?
    No! Currently we are supporting the application options, the spyware description and application help only in English.

Does AntiSpyware Plus work with Mozilla, Firefox or other alternate browsers?
    AntiSpyware Plus has an equipped Max Shield. The options available in these shields protect Internet Explorer (IE) from being attacked by adware or spyware threats. The IE shields will not function for any other browser. Even if you primarily use an alternate browser, we recommend you to keep the IE shields enabled, as Internet Explorer is required for obtaining Windows Updates and other functionality from Microsoft Web sites.

Where can I receive a copy of your software on CD?
    Unfortunately, at this time AntiSpyware Plus is only available as a digital download but we hope to offer copies on CD's soon.

How can I stop AntiSpyware Plus from quarantining a particular product?
    As special option of excluding legitimate files is provided in the application. This will not detect spyware files that are excluded in the list during the other scans. You can go through this option in detail in the previous question "How do I use Exclude option?".

How do I automatically download definition updates for AntiSpyware Plus?
    The default setting available in the setup has the option of automatic update enabled. This will start checking for latest definition set available on the server and start downloading new records and spyware signatures. You can change the default setting to Manual LiveUpdate if you don't want it to automatically check for the updates. Automatic Liveupdate will only work after first restart of the PC.

What is the number of spywares in the database?
    We have a record set of 1,03,000 spywares along with spyware signatures. That makes the scanning more comprehensive. There is a research team working on the database definitions and constantly updating it.

How do I configure Other Internet Security Suite or Personal Firewall Plus for AntiSpyware Plus?
    The following exe files will have to be allowed if you are using any firewall or internet security suit.
1) LiveUpdateAS.exe
2) antispyware.exe
The software has an integrity check so will rarely get blocked or killed by any other equivalent program.

How does AntiSpyware Plus work with Multiple Users on one computer?
     AntiSpyware Plus can be used by multiple users on one computer, the only pre-requisite is that the user should not be a restricted user.

I am a registered AntiSpyware Plus user and am unable to get the upgrade?
    In such a situation you will have to check primarily for your Internet connection, or check with your anti-virus or personal firewall settings if they are blocking the “LiveUpdateAS.exe”. If you still have problems please email us at: info@spywaredetector.org.

Which port do I open in my firewall or proxy server so that AntiSpyware Plus can receive updates?
    Open http:80 port that is used for the Internet browsing. We do not use any other ports.

I am receiving a "subscription expired" error when I download and install the full version of AntiSpyware Plus. How do I correct this?
    The licensed copy of AntiSpyware Plus is valid for one year from the date of registration. If you get the above message within this one year period please re-register the copy using the same registration number.
If your subscription period expires, you will have to repurchase a new registration number to continue with the software.

It takes a long time to run a scan. If this normal?
    No, this is not normal. A "Quick scan" typically takes 2-3 minutes to complete while a "Full Scan" will take 5-10 minutes.
Chances are that this problem is caused by antivirus softwares running in the background while attempting to run a Spyware scan.  Try to disable your virus scan software while performing your Spyware scan and it should then run properly.
IMPORTANT NOTE : Make sure to re-enable your Virus Protection after the spyware scan is complete.

When I attempt to schedule a spyware scan I am told the “Password may be wrong”
    This error comes when you wrongly type the user name i.e.; if there is some space provided by pressing tab with the keyboard before the username, then this error window will come. If the user name is correct and password is wrong, then it will not give any error.

If you are running Windows XP, it is possible to have multiple user accounts so each person using the computer can have his/her own settings.
If you are not sure what the user name and password is, you can go to the ‘User Accounts and Passwords' in Control Panel to see a list of all accounts setup on your computer. The account name will be what you use for “Username”. If you do not remember the password for your account you can change the password from this control panel as well. If you do not use any password to login to your PC when you start windows then you can leave the password field blank.

I have got a computer virus! I thought AntiSpyware Plus was supposed to stop and eliminate viruses?
     AntiSpyware Plus is a spyware removal program and does not protect your computer from computer viruses that come through e-mail and other methods of transmission.
For virus protection you will need a virus protection solution such as Norton Antivirus. As a quicker alternative you can use Panda Software's free virus scanner. It is constantly updated and will help remove numerous viruses.
NOTE: Panda Software's free scanner only removes viruses already on your system and does not prevent future infections.

I have CWS (Cool Web Search) or my home page is constantly being modified to about: blank. How do I fix this?
    The software provides you with a option to protect your browser getting hijacked. This option is available under Max Shield Tab. By default the application comes with “Home Page Protection” enabled. This will prompt whenever your home page is getting redirected. We recommend you to do a full scan so that registry entries of CWS can be removed from your machine.

I have AntiSpyware Plus 10.0 and need to upgrade to a newer version?
    By doing a Live Update we provide upgrade of the latest software release along with new spyware definitions. This is available for free in the one year subscription period.

I ordered AntiSpyware Plus but I never received an e-mail with download instructions.
    Just in case you have not received an email, please send us the Purchase ID number, so that we can give you the needful support.

Other products are free, so why should I pay for your product?
    Max Secure Software has a team dedicated to finding the latest spywares.AntiSpyware Plus will act as your privacy's first line of defense against developing threats. Also no free ware utilities provide you with technical support. Also all the free products do not have any value added feature that we provide. The value of scanning with AntiSpyware Plus can only be known to you if you purchase it and use it for some time.

AntiSpyware Plus is not catching and removing a particular spyware on my computer.
    Please inform us with the identification of such a spyware and we will provide a patch that should take care of its deletion.

What is ActiveX and what does it have to do with Spyware?
    The embedding of ActiveX into the Internet Explorer web browser enables a number of functions that provide growth opportunities for some types of computer viruses, Trojan horses and spyware infections. This style of malware installation depends on ActiveX for activation and propagation.

If you are getting annoying pop-ups, it could have after visiting Look2Me.

1. Download and install the free tool http://www.atribune.org/downloads/l2mfix.exe
   
2. Please move the L2MeFix Tool to your Desktop and DoubleClick l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix Folder on your Desktop. DoubleClick l2mfix.bat and Type 1 and ENTER to select Option #1 for Run Find Log . Allow it as much time as it needs to run until NotePad opens with a log. Save this log. You will need to post this log back here later when you come back.
   
NOTE: While running , if you receive an error mentioning either of the below:
- C:\windows\system32\cmd.exe
- or C:\windows\system32\autoexec.nt the system file is not suitable for running ms-dos and Microsoft windows applications.


3. Then choose close to terminate the application. Then run l2mfix.bat again and this time select option 5 or see the fixautont.html link in the l2mfix folder to solve this error condition. Do not run the fix portion without fixing this first.
   
   Next DoubleClick l2mfix.bat and type 2 and ENTER to select option #2 for Run Fix. Then, press any key to Reboot your machine.
   
   Your computer will go crazy for a bit, but just let it run. It should eventually spit out a log in Notepad. Please also attach this log to your next message.
   
   Now open your browser and come back here and post the above two logs as attachments to your message. Also indicate your current status.
   
   NOTE: Please do not run any other options or files in the l2mfix Folder!

If you are getting problems with spyware Vundo.
     Download and install the free tool http://www.atribune.org/downloads/VundoFix.exe for Vundo spyware removal and follow the instructions.

1. Please download VundoFix.exe to your desktop. Double-click VundoFix.exe to extract the files. This will create a VundoFix folder on your desktop. After the files are extracted, please reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat You will first be presented with a warning.
   
   It should look like this:
   VundoFix V2.15 by Atri
   By pressing enter you agree that you are using this at your own risk
   Press enter to continue....
   
2. At this point press enter one time.
   Next you will see:
   
   Type in the filepath as instructed by the forum staff
   and then press enter:
   
3. At this point please type the following file path (make sure to enter it exactly as below!):
   Here you will place the exact full filename and path of the infected file as shown on the O2 & O20 entries in HJT that have matching DLL filenames. Please be aware you may have more than one O20 line and some may be valid. Only put the infected full filename path here. This can be done by finding the full filename and path at the end of the "O2 - BHO: MSEvents Object" entry in your HJT log.
   
4. For example (yours will be different) if you have the below entries in your log:
   O2 - BHO: MSEvents Object - {52B1DFC7-AAFC-4362-B103-868B0683C697} - C:\WINDOWS\Fonts\badfile.dll
   O20 - Winlogon Notify: badfile - C:\WINDOWS\Fonts\badfile.dll
   O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
   
5. Only the first two are actually related to Virtumunde. The igfxsrvc.dll file is a valid dll. Notice that the badfile.dll appears on both the O2 and O20 lines. This is the problem file you need to enter. So for this example, what you would need to enter into the tool before pressing F6 is the below full filename and path:
   
   C:\WINDOWS\Fonts\badfile.dll
   Press Enter to continue with the fix.
   Next you will see:
   
   Please type in the second filepath as instructed by the forum staff
   then press enter:
   
6. At this point please type the following file path (make sure to enter it exactly as below!):
   Here you will need to place the exact file location with the infected filename spelled backwards and ending with .* For example, if the infected file is C:\WINDOWS\Fonts\badfile.dll you would enter C:\WINDOWS\Fonts\elifdab.* so it will remove ALL files of this infection.
   Press Enter to continue with the fix.
   The fix will run then HijackThis will open, if it does not open automatically please open it manually.
   In HiJackThis, please place a check next to the following items and click FIX CHECKED:
   Here you will remove the O2 & O20 entries in HJT.
   
7. An example of the O2 & O20 are below...
   O2 - BHO: MSEvents Object - {52B1DFC7-AAFC-4362-B103-868B0683C697} - C:\WINDOWS\Fonts\badfile.dll
   O20 - Winlogon Notify: badfile - C:\WINDOWS\Fonts\badfile.dll.
   
8. After you have fixed these items, close Hijackthis.
   Press enter to exit the program then manually reboot your computer.
   Once your machine reboots please attach a fresh HJT log from normal mode.

Every time I run a scan, the same spyware programs are detected even after I delete them.
    We are continuously adding new spyware definitions to destroy them. Some spyware are very persistent. 
Scan your PC, quarantine the spywares, click on the Recover button, select all and then click on Delete. Restart your PC, Click on Recover button again and delete all the quarantined spywares. Scan again and click on the Export Worm button and mail us the report with reference to this issue. This will help our Research Team to review issues on your PC and add new spyware definitions and you will be able to access new definitions through live update. You can also provide names of toolbars or popup ads that you see on your PC.

This is most likely caused by a spyware program that recreates it self when deleted such as About:Blank or a spyware program that uses processes that cannot be terminated and deleted during the spyware scan. 

Three of the most common solutions are listed below:

--------------------------Solution #1------------------------------
The first step is to reboot your computer into “Safe Mode”  This will prevent your computer from loading any non essential programs.

To get into safe mode, reboot your computer and continually hit the F8 key while booting up.  You will then be taken to a screen where you can choose to start your computer in safe mode.  Once booted up, go to the Add/Remove programs in Control Panel and make sure that there are no strange search toolbars or Programs listed. Remove such types of strange softwares from your PC.

Then run the Spyware scan again and delete all spywares found.  Then reboot your computer and see if the problem is resolved or not.


--------------------------Solution#2------------------------------
This could be related to a spyware program called CoolWebSearch, this is one of the most difficult spyware programs to catch because the creators update it so often. Fortunately there is a very simple to use removal tool that is specifically for CoolWebsearch.
You can download it here for free.
http://cwshredder.org/bin/CWShredder.exe 


--------------------------Solution #3------------------------------
This could be a variant of About:blank which is a very difficult program to defeat and unfortunately cannot be removed by any single spyware removal program.What makes this particular spyware so troublesome is that it uses what is called a respawning file.  When the spyware files are detected and deleted this respawning file automatically regenerates the spyware problem thus reinfecting your system. It is hard to get rid of because this file could be named something as innocent as abcgh.jpg  and would not be detected as spyware.  Each time it is recreated, it changes the name of the file.
The best step by step explanation I could find is here:
http://www.bleepingcomputer.com/forums/topict4210.html



I cannot get rid of CoolWebSearch, CWSIE, FastSearch, and FastSearchWeb!
    These spyware programs are some of the variants of CoolWebSearch, a notoriously difficult spyware program to remove because new variations are constantly being released.

Fortunately there is a removal utility designed to specifically detect and remove many of the CoolWebSearch variants.
You can download this utility for free at the link below:
http://cwshredder.org/bin/CWShredder.exe

After I run a spyware scan and delete the spyware infections I still get ATDMT.com when I run another scan.
    The entry for ATDMT.com is a simple advertising cookie like you might get visiting any web page.  It is not harmful nor does it collect personal or sensitive information.  The reason it keeps returning is because cookies are used on almost every web site these days to track advertising costs, save login information so you do not need to login every time you access a page, etc.
It’s good to delete them to keep your system from being clogged up but it will not harm your PC.

My desktop keeps changing to an ad/warning that my system I infected with Spyware the file referenced is c:/windows/web/desktop.html:

--------------------------Solution#1------------------------------
Go to Control Panel >> Display >> Desktop >>Customize Desktop >> WEB>
Under the web pages there will be an entry for the page displaying on your desktop.  Highlight and delete this and hopefully you will get your desktop back.

If you are able to delete the entry the real test will to reboot your computer and see if the problem returns.

--------------------------Solution#2------------------------------
Reboot your computer in “Safe Mode”. This will prevent your computer from loading any non essential programs.

To get into safe mode, reboot your computer and continually hit the F8 key while booting up.  You will then be taken to a screen where you can choose to start your computer in safe mode.  Once booted up go to the add/remove programs control panel and make certain there are no strange search tool bars or program listed and remove any that are found.

Also follow the steps in Solution 1 to ensure no strange pages are set to your desktop.

Then run the Spyware scan again and delete all spywares found.  Then reboot your computer and see if the problem was resolved or not.

I cannot get rid of searchmaid.com

1. Download and install the free tool, Registrar Lite
   http://www.resplendence.com/reglite
   
2. Click on Start > Run> type regedit and press Enter. Go to this location
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
   
   Look for an entry in the right hand panel that says "notepad.exe"="msmsgs.exe".Right click the entry and select delete.
   Then paste the value 6F327C95-87FF-467c-8F7C-F2CC7652305E into search box.
   
   If it finds anything, right click on the key and delete.
   Then search for abdd9bed-808a-4887-a668-16935c25ce1e and do the same please.
   Close Registrar Lite.
   
3. Do a search on your system for these files and delete them, if found:
   popuper.exe
   notepad2.exe
   
4. Do a search for a file: sites.ini
   If found, Open it and if you see sites such as the following listed, delete them all:
   
   [http://www.instantsearch.cc/text/online_gambling.html]
   [http://www.instantsearch.cc/text/computer_dating.html]
   [http://www.instantsearch.cc/text/online_pharmacy.html]
   [http://www.instantsearch.cc/text/pop_up_blocker.html]
   
   Now, reboot your PC.
   

The Mirar Toolbar Will Not Go Away:
    You can download an uninstaller for this toolbar directly from their web site:
http://remove.getmirar.com/