How to Kill Spyware Processes
What are processes?
Every program has its own executable code (for example, the .exe file). A process (or task) is a program that is being executed. When you start a program, the executable code will load into the computer’s memory. This code is the process. If a process is closed or terminated, the resources used by that program will not run. To see all the processes running on your computer, you can use the Windows Task Manager, a built-in Windows utility.
The Windows Task Manager allows you to terminate almost all processes, however, there are some programs that have invisible processes running in the background and can remain on your computer without you knowing its exact location.
Why is it important to remove malicious processes?
Even though some processes are legitimate, there are other processes that come from malicious applications such as spyware, adware, trojans, malware, worms, and rootkits. It’s reported that malicious applications may run on your computer without your knowledge or consent. These malicious applications can infect your computer and compromise your privacy, security and computer performance. That’s why it is important to learn how to kill malicious processes.
The first step is to evaluate every process running on your computer to determine whether any of them is a piece of spyware. The obvious choice is to look for a process that is either out of place, does not belong to a program you remember installing or is behaving odly. In the case of an extreme malware infection, you may not be able to kill the offending program with the Task Manager and instead might get an “Access denied” error. In a case like this, an anti-spyware program might be the best approach to solve your computer’s security problem.
The instructions on how to get started depends on what Windows version you have. Learn how to remove kill spyware process from your computer.
Kill Spyware Processes Manually
Warning: Stopping system processes is a difficult and risky. If you delete the wrong file, your computer may crash and important data may be lost. As a precautionary measure, please back up important files and set a System Restore point (click Start > All Programs > Accessories > System Tools > System Restore, and follow the on-screen instructions) or run a spyware check with a trusted anti-spyware program to automatically detect spyware.
You can kill spyware proccesses in two ways:
Method A: Using the Windows Task Manager. (Recommended)
Method B: Using PsKill through the Command Prompt window.
Method A: Using Windows Task Manager to Kill a Process
Follow the steps below to manually kill a process with the Windows Task Manager:
- Start Windows Task Manager
To open the Windows Task Manager, use the combination of CTRL+ALT+DEL or CTRL+SHIFT+ESC. You can also press the “Start” button, select the “Run” option, type “taskmgr” in the blank field and then press the “OK” button.
- Find and Kill Spyware Processes
In the Windows Task Manager, select the “Processes” section to see all active tasks. Find the proccess by name. To make it easier, select the “Image Name” button to list tasks by name.Use the list of process files associated with the spyware you know or suspect your computer has been infected with. You can find a list of processes by going to our spyware database and selecting the parasite you’re interested in. If there’s a process that you don’t recognize, copy the process and search on google.
Select the process you want to kill and click on the “End Process” button to kill it.
Method B: Using PsKill through the Command Prompt Window to Kill a Process
In some cases, a parasite may disable your Windows Task Manager so instead you can use “pslist” and “pskill” (a third party application by Mark Russinovich) to list and kill the unwanted proccesses.
Follow the steps below to manually search and kill the spyware processes with PsKill:
- Open the Command Prompt window
Press the “Start” button on your Taskbar and select the “Run” option. Type “cmd” in the field and then press the “OK” button.
- Search the unwanted process
When the Command Prompt window is opened, type the command “pslist” and press “Enter” to search processes from the list of running programs.
- Kill the unwanted process
Once you know the name of the process you want to kill, type the command “pskill [PROCESS_NAME]” and press “Enter” to terminate the unwanted process. For example, if you wanted to kill SpyLocked (a rogue anti-spyware program), you would type pskill spy-locked.exe.
- If the process was terminated successfully, a confirmation message will be displayed.
August 19th, 2007 at 5:10 pm
i will try these things as win antispyward 206+207 have loaded in my computer a lot of times and locked it up yesterdday and it took me 2 hours to get it out thanks m
September 1st, 2007 at 8:50 pm
I am curious, in order for ultimate cleaner to find its way to your PC, do you have to manually download it or does it find its way through an open port or something ?
September 3rd, 2007 at 7:53 am
natural,easy to use,& effective
September 3rd, 2007 at 7:56 am
so long & more power……….. no fees just follow the manual.
September 9th, 2007 at 12:32 pm
Some clever spyware programer has found a way to circumvent this method of removal. The directory that comes up when I open my DOS is “C:\documents and settings\ user” and I am unable to change the directory. I’ve tried every command, but it seems to be ignored. I guess its reformatting the hard drive for me!
October 2nd, 2007 at 10:36 am
The same thing with me. DOS opens with C:/documents and settings\user. Can’t change the directory. Anyone have any other ideas?
October 5th, 2007 at 8:54 pm
Rachel.
Have you found a way to get around that? Mine is doing the same thing. Can anyone help?
October 8th, 2007 at 9:48 am
Rachel, Lauri and Amy,
Maybe you can be more specific? Give the detailed description what is happening on your system.
October 9th, 2007 at 9:22 pm
Have an error: SETUPAPI.DLL file is linked to missing export NTDLL.DLL:NTCLOSE. It seems the only thing affected is any IE6 toolbar, they won’t appear or reload. Had a file STARWARE TOOLBAR that my Spy Sweeper found and removed, but still no toolbar’s. I would like software that would make this right, put the missing file back. Will yours accomplish this or can you recommend one that would?
running win98/acer aspire 333mhz,ie6
missing ntdll.dll:ntclose
October 10th, 2007 at 5:48 pm
have you tried this command
C:\documents and settings\user\ cd\
and if not. try to
run msconfig from cmd and choose selective start up
disable your system restore from system icon located at control panel
restart PCin safe mode with networking
and from there do an online scan on you system
firefox user
October 10th, 2007 at 8:50 pm
I’m experiencing the exact same problem. The background shows a false error message. I can’t access task manager because it says it’s been disabled by the administrator. If I didn’t have Firefox for a browser, the computer would be totally useless. I’ve gone through all the advice, but it seems they are one step ahead. It’s like the computer “lets” me use it, other than that, its in total control.
October 11th, 2007 at 11:40 am
Josh,
It seems that you have got malware on your system. You have to fix your computer by using anti-spyware programs. You said taht you can’t access Task Manager. Press Start, click Run and then paste “REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f” (without quotation marks). This should enable Task Manager.
October 27th, 2007 at 3:55 pm
i can’t open taskmanager and RUN in start menu
November 11th, 2007 at 8:15 am
rachel and amy:
just add dir
C:/documents and settings\user>dir
that brings up the directories
im all for killing all these unwanted spyware junk using any weapon available
November 14th, 2007 at 4:37 pm
I can’t even get into google because my computer tells me that I am not connected to the internet. Does Ultimate defender cause this as well?
November 15th, 2007 at 2:28 am
wads da process name fer zlob?
November 20th, 2007 at 5:05 pm
lol,
There can be a few different Zlob processes. Their names are changing very often. The best solution is to scan your computer with our free scanner and remove the infected files. Our free scanner will separate the processes so you can easy find their names.
November 20th, 2007 at 5:37 pm
pat,
Very likely, that no. But it’s possible that there are many other parasites on your computer. Perhaps some of them don’t let you to connect to some pages on the internet.
December 5th, 2007 at 2:27 am
so, i don’t think AWOLA actually got installed cos it won’t appear in the task manager - but it won’t go away either. it keeps displaying messages in the task bar and keeps opening its program. how can i get rid of it?
December 5th, 2007 at 2:29 am
now my computer is telling me it can’t do the pslist thing either. “pslist is not recognized as an external or internal command”
December 5th, 2007 at 10:31 am
wes,
You have to install the additional software PsTools. You can find it here http://technet.microsoft.com/lt-lt/sysinternals/bb896649(en-us).aspx After installation PsList and PsKill should work.
December 16th, 2007 at 3:46 am
Hello! Can someone, anyone help my hubby & me!? I’ll beg if necessary..lol I just got Norton back on our computer, but somehow, most likely before I did that I got dioCleaner infected & I can’t get rid of it through the ways I’ve tried on here, this thing is WAY smater then me!! I thought by reinstalling Norton it would get rid of the DioCleaner…nope! So do I have to buy like an additional $30 spyware program or something to get rid of it? It won’t even let us look at our email’s either! I keep going to ask.com & reading as much as I can…gona be a long night! Maybe I can look at my hotmail at least. That’s meme71973@hotmail.com if anyone has any advice for us! Thanks for everything!!
Amy S.
December 22nd, 2007 at 10:49 am
Amy,
Not all antivirus programs remove spyware. And the infections are mutating very often, so it’s nearly impossible to catch and clean them very easy. You should contact the support team of your antivirus and they will help you with DioCleaner removal. Also, you can follow the DioCleaner manual removal instructions which are on http://spywareremove.com/removeDioCleaner.html . You can use our free scanner which is not removing, but detecting the infected files, so it will help you to find the locations of the infected files and then you can try to remove them manually. Otherwise, you can get a reliable anti-spyware program.
January 11th, 2008 at 12:54 pm
To Laurie & Amy.
I believe CMD opens in the current or last used directory.
To navigate, use the CD (change directory) command
To go to C: root, firefox pointed out use CD \ or Cd C:\
To go up one level, do CD.. Do that several times you’ll get to C: root
To go down a level, do CD\lowerleveldirectoryname
To see what folders / directories are in the current directory, do DIR (optionally with /P to stop it scrolling off the window)
DOS still lives
j
January 12th, 2008 at 4:20 pm
Pslist and Pskill wont do anything and i know where the viruses origin file is but its protected from deletion… Why cant i use PSlist and PSkill?
January 14th, 2008 at 1:26 pm
Seth,
As I mentioned above to Wes, you have to install the additional software PsTools. You can find it here http://technet.microsoft.com/lt-lt/sysinternals/bb896649(en-us).aspx After installation PsList and PsKill should work.
February 12th, 2008 at 6:27 pm
I seriously need your help.
I followed your instruction to remove UltimateDefender from my system but it’s icon stilll manages to be in my toolbar! I’ve downloaded all sorts of anti spyware but it doesn’t seem to be able to get rid of it. Why?
February 13th, 2008 at 10:30 am
MJ,
It may be, that the antispyware program you have, doesn’t have the latest updates for this parasite. Did you update your antispyware program? Try to boot your computer in Safe Mode and scan with your antispyware program again. Sometimes antispyware programs remove parasites from Safe Mode, which they can’t remove in Normal Mode. If this won’t help, try to scan your computer with our free SpyHunter scanner, which will detect the infected files and show their locations. Afterwards boot your computer in Safe Mode and manually delete the infected files (Shift+Del).
February 26th, 2008 at 12:18 am
how can i completely kill all of my anti spyware on my laptop? I would like to know step by step construction so please kindly reply for my request.
February 26th, 2008 at 3:44 pm
Patrick,
The instructions are on this post. There are files that change or appear new on the web for a rogue anti-spyware… there’s no 100% solution, but at least you should let most of the searching be done with a real anti-spyware program rather than you manually deleting each file which can end up in you missing one file.
March 5th, 2008 at 4:42 am
I’m having problems like this to and I can’t get my taskmgr to work and somehow its disable?? why is that?
March 5th, 2008 at 4:44 am
I’m having computer problems like these people and it changed my desktop and disable my taskmgr how does that happen and I can’t use system restore too help me someone
March 5th, 2008 at 5:23 pm
:(computer):,
Malware often disables access to Task Manager to make manual inspection and removal more difficult.
To enable Task Manager:
1) Click Start > Run
2) Type REGEDIT > OK (Registry Editor will open)
3) Browse HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\system
4) Look for the value DisableTaskMgr (right pane) > Right click > select Delete
*When asked “Are you sure you want to delete this value”, select Yes.
5) Browse HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
6) Look for the value DisableTaskMgr (right pane) > Right click > select Delete
*When asked “Are you sure you want to delete this value”, select Yes.
7) Close the Registry (File > Exit)
Task Manager should be enabled. If not, reboot into Safe Mode and repeat these steps.
March 9th, 2008 at 3:02 pm
I downloaded pstools but I am still unable to use pslist or pskill. What do I do?
March 9th, 2008 at 7:36 pm
Connie,
Can you use pslist or pskill in Safe Mode on your PC?
March 15th, 2008 at 6:41 pm
I’ve downloaded the additional PsTools, but still getting the “does not recognize” message.
March 31st, 2008 at 6:59 pm
Hello all. Ok here is my dilemna. I have this ZLOB on my pc as well. I tried to use Norton 08. BOOOOO. its a waste of money. I used that SpyHunter and it found a lot more stuff than I was aware of. I was having trouble getting to my directory C:\ also. It worked when i did (case sensitive) CD:\. So i get to the C prompt and i type in PSLIST and to no avail. I also downloaded the PsTools and I still can not get it to run. I get the error message that says ‘pslist’ is not recognized as an internal or external blah blah blah. I really need this thing to GO AWAY!!! I am furious at how long this process has taken. I would really appreciate any guidance through my long haul of these stupid trojans and spyware and malware and viruses and and and and and. Aren’t u guys fed up? I really hope that we can get an answer soon because if not….well soon i hope.
April 26th, 2008 at 3:19 am
I am having d same probs..i downloaded the Pstools and it shows itz not recognized as a command or file..and …well am fed up too..
May 9th, 2008 at 9:06 am
Izit just kill the process and the malwarrior will be gone? Do i need to delete other files also?
thankz for helping..Really appreciate it..
May 26th, 2008 at 9:05 am
hey guys….
u tried taskkill???
i usaually use taskkill when taskmgr is disabled……(now i enable it though)
take “run”
then type taskkill /im “processname.exe” /f
processname is the name of the process
u can also enable taskmgr with registry key…..
May 30th, 2008 at 12:32 am
having troubles. I follwed each step even resarting and going on safe mode seems like spyburner has me locked and on my monitor it states: warning your computer is in danger quickly remove all spyware. Also every minute on my bottom tool bar a warning pops up stating: your computer is infected its detected a spyware infection. please help im so confused
June 4th, 2008 at 7:40 am
HI
I NEED HELP PLEASE HELP ME MY COMPUTER HAS BEEN INEFTED PLEASE HELPME
MY NAME DAVE
PLEASE CANYOU HELP ME
THANKS
June 19th, 2008 at 1:15 am
Dear,
Please help me, my task manager is lost
June 24th, 2008 at 10:50 am
I’ve read through all the remedies, but my biggest problem is that this wonderful Vista Antivirus 2008 has removed or hidden the things I need to do alot of these procedures. i.e I have a start button at the bottom, but no option to search or run, all of these have “disappeared”. How can I get to c: so that I can procede with all the processes? Please help before I start throwing things!!!!!
July 14th, 2008 at 12:12 pm
I have been infective by Antivirus 2009. I followed the steps to remove but I am still being plagued by popups. the main one says “about-blocked” in the blue line and the page says “Blocked Microsoft Internet” I don’t know how to get rid of this.
July 16th, 2008 at 12:12 am
when my comand prompt comes up, it doesn’t say just “C:\” but instead a “C:\Documents and Settings\HP_Administrator>” How can i fix that??? Help PLZ!
July 16th, 2008 at 2:21 am
hi sir,this is siva,some problem occurs in my laptop.problem is(warning! spyware detected install antivirus or spyware remover to protect ur system)when login laptop.only display this message,no other details like(start,desktopicons).did not enterning login also.pls give me some suggestion.in my harddisk important files are there pls sir…..
July 16th, 2008 at 7:19 am
ahh, i hate it, i have this thing called “Vista Antivirus 2008″ on my computer, and I just
can’t figure out how to get it out, its to hard! hehe. Should I just leave on there? I mean I use the task manager
every time to end it, but should I just find some one to delete it, or just keep it there?
What kind of hard does it really do to my computer? ahh, helppp :]
July 22nd, 2008 at 8:53 am
HELP PLEASE!
I got infected by the virus calling itself ANTIVIRUS XP 2000. The results are terrible. I can’t access the Internet, previous reestablishment points are deleted and replaced by one point, antivirus scans are not possible, just to mention a few of the problems. Attempts to uninstall the system fails, just to mention a few of the problems. I can, however still access some basic routines, including RUN…..
I am using Windows XP SP3, but in a OEMversion, preinstalled when the PC was delivered. Reinstalling Windows through a reinstall CD supplied, will mean total loss of all emails, which are important to me. (I have not made regular backups on an external harddisc frequently,following the principle: Real men do not backup… they cry!).
I am using an older PC, running Windows ME, and even though it’s terrible, it gives me a possibility to read and write emails, and use the internet. I amable to download possible needed routines to solve the problem, but since I can’t access such sites from my normal PC, and only the oldie, the only possibility to use programs or routines from the Internet is if they can be downloaded to for example a CD burned on the old, and used on the new PC.
I hope somebody on this site will be able to give me a simple and understandable solution. I am NOT an expert at all, but am as normal user able to follow instructions. IF some kind and wise soul needs additional questions answered or has the solution, then I will be eternally gratefull to receive your comments or instructions, preferably through emails to mundus@newmail.dk
Thank you in advance. I hope somebody can help me, to again get an operational PC. As far as PC knowledge is concerned: I am just a user, almost 70 years old, but still able to remember what the word “senile” means
July 24th, 2008 at 11:32 am
Could i just kill the process by using msconfig so that it doesnt even start up?
August 2nd, 2008 at 2:28 pm
my cousin downloaded a game from isohunt.com. when he finished installing the game, my laptop just performed slowly. and all those antivirus or antispyware keeps on popping on my monitor. and some porn sites also appeared on my desktop. can i erase the virus/spyware/adware manually or do i need to install an anti spyware program for it to be erased? HELP please.
August 27th, 2008 at 1:36 pm
hello, my computer just got infected by windows antivirus 2008, it has erased my run command, i cant access my task manager because it keeps saying that it has been locked by an adminstrator ( before this happened i could always access task manager by crtl-alt-del) how do i get this off my computer.
September 30th, 2008 at 7:44 am
My 1st experience, so my question is; why aren’t these bloody people found, fined and/or in prison?
The whole nasty experience is a game I just don’t wish waste time playing. Perhaps Apple’s the answer!?
October 7th, 2008 at 8:18 am
I am receiving pops saying windows has detected sypware infection when i clicked on this icon it wanted to instal xp antispyware 2009. I quickly ended it. but this pop up keeps coming up and my pc is slow. moreover the windows background that was originally blue is now black in color. I have checked for this virus on my task manager but i do not know which program is the virus. Any help plz
October 10th, 2008 at 8:30 am
Hi,my name is Marta,i´m from portugal.
I tryed to follow the list to remove the Ultimate antivirus 2008,but when i open my computer it happens all again from the beginning.The virus don´t dissapered.Please help me!!!
October 12th, 2008 at 3:30 pm
FYI, if you are getting the error “locked by an adminstrator” it means you have Vista and you do not have admin rights. Go into start, right click run command, use as admin and it will let you use any command.
Nick, no. A lot of viruses change their names even after you disable it in MSconfig.
This is the setup I have in preventing viruses is free avg, PC tools firewall and firefox
October 20th, 2008 at 9:36 pm
i have the problems where task manager and regedit are disable ,, surely cause by the virus.
msconfig’s file still exist but cannot be open.
this is running process i,ve found:
guwyw.exe (3696) 10/20/2008 6:17:04 PM C:\DOCUME~1\jeje\LOCALS~1\Temp\guwyw.exe
sjag.exe (624) 10/20/2008 6:17:11 PM C:\DOCUME~1\jeje\LOCALS~1\Temp\sjag.exe
and also this windows process backup for that virus:
wscript.exe (5896) 10/20/2008 7:25:19 PM C:\windows\System32\WScript.exe
i,ve tried to remove manually like i always done before, i off system restore, del all the keys from registry and delete that virus files.. but they win over me… I found the new name for the virus from running process:
rekthy.exe (3696) 10/20/2008 7:15:03 PM C:\DOCUME~1\jeje\LOCALS~1\Temp\rekhty.exe
dbroun.exe (624) 10/20/2008 7:15:10 PM C:\DOCUME~1\jeje\LOCALS~1\Temp\dbroun.exe
they change their name itself..
im use panda antivirus with latest update.. but it does’t detect it..
October 20th, 2008 at 9:58 pm
folder option still exist .. but when u show the hidden files .. it back to do not show hidden files …
for those who cannot access task manager, u can use this method, copy the codes below and save it in the notepad, rename it as proclist.vbs. double click proclist.vbs and it will create notepad file named processlist.txt.
double click proclist.vbs again and open processlist.txt file .. u can see process list of your system there. tq for those who create that codes :)).
here the codes
Set objFS = CreateObject(”Scripting.FileSystemObject”)
Set objNewFile = objFS.CreateTextFile(”ProcessList.txt”)
strComputer = “.”
Set objWMIService = GetObject(”winmgmts:” _
& “{impersonationLevel=impersonate}!\\” _
& strComputer & “\root\cimv2″)
Set dtmInstallDate = CreateObject( _
“WbemScripting.SWbemDateTime”)
Set colProcesses = objWMIService.ExecQuery( _
“select * from win32_process” )
For Each objProcess in colProcesses
strOutput = strOutput & _
objProcess.Name & ” (” & objProcess.ProcessID & “)”
If objProcess.CreationDate “null” Then
strOutput = strOutput & vbTab & _
getmytime(objProcess.CreationDate)
End If
If objProcess.ExecutablePath “null” Then
strOutput = strOutput & vbTab & _
objProcess.ExecutablePath
End If
strOutput = strOutput & vbCrLf
Next
objNewFile.WriteLine strOutput
Function getmytime(wmitime)
dtmInstallDate.Value = wmitime
getmytime = dtmInstallDate.GetVarDate
End Function
October 27th, 2008 at 11:45 am
good suggestions, but still stuck with some spyware that refuses to go!
October 28th, 2008 at 11:32 pm
Hello! There is a new process explorer that detects all sorts of evil processes.
I used it to kill that awful bagel worm, that created hidden protected processes using a rootkit..
It is called Nixie. And can be found at netnixie.com
After killing the bad things you can run regular anti-virus\spyware things to remove left overs…
November 16th, 2008 at 5:31 pm
I have been infected by antivirus 2009..ive tried to delete it and i ahve also went to task manager and deleted the processes but it still doesnt work. now i cant even access anything, when i try to go online…it says….blocked becasue of virus threat. Any help please?
November 20th, 2008 at 3:38 am
what if the response for pslist is like this “pslist is not recognized as internal orexternal command, operable program or batch file” please i need your help to remove the antivirus 2009
December 11th, 2008 at 3:45 am
every time i try to delete this spy using command propmt window, my computer automatically shuts off… what else can i do to remove this spy protector on my computer.. pls help.. i really don’t know much about pc’s..
December 13th, 2008 at 1:36 pm
hi.. erm u know ur meant to like delete is from the process box in task manager… i have the antivirus2009 thing that pops up with you have a security problem and plays music and stops me watching videos
help please
what would be called in task amanger… i cant work out which 1 it is to delete it
xx