Windows 98 and ME Malware Removal/Cleaning Procedure

[chaslang]

Windows 98 and ME Malware Removal/Cleaning Procedure

Note:

Windows 98 and ME are extremely outdated and as such are difficult to work with since there is basically no support for them anymore. Very few programs and scanners support these versions of Windows. Even malware creators have long ago stopped developing malware to affect these versions of Windows. It is really time to purchase a new PC and version of Windows if you are still using Win 98 or Win ME.

Step 1: Downloading Tools

In this section we are going to download tools we will use. We will install and configure the programs and then run scans at a later point so please only download right now.

Except when noted otherwise, the tools should be downloaded and saved in your favorite download folder or create one, for example C:\SpywareTools or C:\Downloads. ( It is not a good idea to download them to any folder within C:\Documents and Settings.) It is also a bad idea to download and save anything you need into any kind of Temp folder. Malware hides in Temp folders and standard cleaning practices will delete everything from Temp folders.



Now download the below tools:

• SpyBot - Search & Destroy

Step 2: Installing Tools and Running Scans

• Now install, configure and run Spybot – Search & Destroy per the below link
  • Spybot S&D Installing & Running

• Now follow the directions in the below link for downloading, installing and running MGtools.
  • Using MGtool9x
  • It is critical that you save this file to the root folder of the drive where you have installed Windows (Typically this would be C:\ and thus you would have a C:\MGtools9x.exe file after downloading). If you use FireFox and still have it set to defaults, it will not let you choose where to download files to. To change FireFox, run FireFox and Click Tools, Options, and on the Main tab select Always ask me where to save files. If for some reason you still have a problem trying to save MGtools.exe properly. You can download it to your Desktop and move it after downloading, or if necessary (but we prefer not) run it from your Desktop.

Step 3: Do You Still Have Problems

• Yes, I’m still having problems
  • DO NOT run the READ ME again!!!! Please attach your logs as given below.
  • If you do not already have a thread started, start a new thread otherwise post the following in your original thread. Clearly describe in detail the problems you are having and how long ago they started. Think about what you were doing at the time.
  • Now you need to attach (See: HOW TO: Attach Items To Your Post )( or View: How To Attach Items to Your Posts the below logs created while running the above scans
    • SUPERAntispyware.txt log
    • MGlogs.zip
  • Be patient after posting your logs and wait for one of the helpers to get to you. It can take a while to read thru all of the logs and to create individual fixes for you.
  • Also DO NOT BUMP your thread to try and get a faster answer. This will actually significantly delay getting an answer. See this: Don't Bump! It Only Hurts You!!!

• No, I’m not having any problems
  • Then jump to step 4 if running Windows ME
  • If running Windows 98, jump to step 5.

Step 4: Toggle System Restore (this step only applies to Win ME users)

• You only need to Toggle system restore if malware had been found during the cleaning procedures. If no malware was found, there are no infected restore points to worry about, thus you can skip to the next step.
• Once you are sure all malware problems have been removed follow the below steps:
  • Disable System Restore ( see Disable And Enable System Restore)
  • Now reboot your PC
  • Now Enable System Restore using the same link as above.

Why we toggle System Restore!

If you have been infected with any trojans, spyware, etc, they could have been saved in System Restore and are waiting to re-infect you. Since System Restore is a protected directory, your tools can not access it to delete files that may contain viruses. Even though your tools may say they are deleting them, they are not! The reason for doing this after your system has been completely cleaned of problems, is so we can remove possible infected restore points. When you disable system restore, it removes restore points!

We only toggle System Restore after you are clean because keeping even infected restore points around while we are fixing things may prove useful if something goes wrong during the process. An infected restore point could be better than none at all!

• Now continue on to step 5!

Step 5: Keeping your computer safe and secure

• See the following thread and complete the steps: How to Protect yourself from malware!

Step 6: Alternative Scans - If still having problems, see: Alternative Scans Remember our up front note though that very few porgrams including these scanners will support your outdated version of Windows.


Now surf safely!