Introduction to Diagnose Windows

Adware Away
Introduction

What is Adware Away?

Adware Away is a malware ( malicious software ) detection and removal tool ( designed for Windows 98 / 98SE / Me / NT40 / 2000 / XP Home / XP Pro ) which will comprehensively scan you system for adware, spyware, browser hijacker, trojan, worm, keylogger and other malicious programs.

Adware Away will get your Windows back to the moment when you bought it.

What's new in Adware Away?

There are lots of excellent malware removal tools. Most of them use a similar technology to remove malware, i.e. , These tools use their reference file or virus database as their running engine. For Adware Away, In addition to providing two regularly updated reference files, It has FOUR new features:

1. Global Scanning & Fix
This section will make a global scanning to all potential security hole, and will give you the ability to fix any found problems. With Scan & Fix, It is easy to discover any well-hidden malware and remove it, even if your reference file is not up to date, or even if the malware is a new variant.

2. Specialized Remover
This seciton contains a series of malware remover. Each of them is used to COMPLETELY remove a specific malware. It will remove a specific malware from disk, registry, desktop, start menu, program files folder, application data folder, downloaded program files folder, etc. That is, it will remove any little fragment which is left by that specific malware.

3. Customized Cleaner
This feature is for those who have not much knowledge on how to remove malware. We can customize a special malware cleaner tool for you depending on your Scan & Fix log file. So you can remove malware which is annoying you by one click.

4. Update Online
Adware Away provides to update reference files online. One click finishes updating. This feature needs to use your internet connection to access updating site.


Working with Global Scanning & Fix

Where is 'Global Scanning & Fix'?

When you launch Adware Away, at the left panel, There is a bar with text : Global Scanning & Fix, and the right window displays information of Global Scanning & Fix.

What is 'Global Scanning & Fix' ?

Global Scanning & Fix is a diagnostic tool to scan Windows registry and disk for adware, spyware, hijacker, trojan, keylogger and other malicious programs. It uses many techniques to scan all potential security holes which can be used by malware, And with one click you can fix all found problems.

Options & Settings

The options & settings of Global Scanning & Fix gives you the option to scan, defaultly all options are checked, you can change you scanning options at any time. To do this, click 'Options & Settings' in Global Scanning & Fix panel, It will display all options you can choose. These options include :

01. Scan and fix running process
02. Scan TCP/UDP port and associated process
03. Scan and fix shared resource
04. Scan running service on 2000/XP
05. Scan and fix Socket LSPs
06. Scan and fix auto-load programs
07. Scan and fix IE restrictions
08. Scan and fix IE home pages
09. Scan and fix url prefixes
10. Scan and fix Urlsearchhooks
11. Scan and fix IE BHOs
12. Scan and fix IE Toolbars
13. Scan and fix IE Toolbar buttons
14. Scan and fix IE context menu
15. Scan installed ActiveX
16. Scan and fix hosts file
17. Scan IE DLLs and Shell Extensions
18. Scan Keyboard Logger
19. Scan and fix File Association

 Fast Fix

When Adware Away finishes its global scanning, you can fix all found problems. To do this, follow the instructions below:

1. Wait for global scanning finishes. Click 'Next'
2. Check items you want to fix or delete, click 'Fast Fix'

View Details

When the global scanning finishes, you can click 'View Detail' button to see the result. All results will be displayed in different dialogs. In each dialog, there is 'fix' or 'delete' button to help you fix errors or delete error entries. Please follow the instructions below to view details:

1. Wait for global scanning finishes. Click 'Next'
2. Click 'Fast Fix' . If you don't want fix anything, please uncheck all items in the list above.
3. Click 'View Details'

Submit global scanning log file

Adware Away provides a service which let us customize a removal tool for our users to help them remove all malware from their computers. This customized removal tool will be designed depending on global scanning log file. If you feel hard to remove malware, please submit your log file to us, we will help you. To submit global scanning log file, please follow the instructions below:

1. Run Adware Away, if your problem is related to IE browser, you should leave an IE window open
2. Click 'Start' to do a new global scanning, wait for its finishes
3. Click 'Submit' button
4. Type your name and email, click 'Send by my email client'
5. Copy and paste all contents into your email program, and send it to : submit@AdwareAway.com

Once we receive your log file, we will customize a special removal tool for as soon as possible.


Working with Scan & Fix -> process & Service

Running Process & Service

This section will let you manage all processes and services running in your system, and it will mark the suspicious process and give you the ability to terminate any process or service you want.

To terminate a process, just choose the item standing for this process, and click 'Fix' button on the top menu.

For most malware, terminating its process is the first and the most important step.


Working with Scan & Fix -> TCP/UDP Port

TCP/UDP Port & Associated Process

This section scans all opened TCP or UDP port in your system, and it will find out which process is opening these port, this feature is great helpful to find trojan programs which is opening a back door in your system. Also it has an internal port database which contains most of famous trojan's port list, Once the current port matches the list, a warning sign will prompt you to close it.

Most trojan or back door programs will open a port in your system, With this section, you can learn all the currently opened port, You should give more attention to those which is listening, even if there is no warning sign with it. If you find some port is suspicious, try to close it by clicking 'Close Port' button in 'Opening Port' tab.


Working with Scan & Fix -> Shared Resource

Shared Resource

This section scans all shared resource on current system, and marks those which are not secure, gives you the function to close any shared resource you want.

Shared Resource is a resource in your system such as a disk, a printer, a folder, which is shared by other users on internet or intranet. That means everybody can access these resource. Many malicious programs will make your hard disk completely sharable to others, That is very dangerous. Oftenly scanning your current shared resource is neccessary.


Working with Scan & Fix -> LSP

Layered Service Provider ( LSP )

Socket LSP is called Layered Service Provider, which is a part of Windows network, Many spyware would install their LSP into your system for the sake of stealing your private information such credit card number or password, and in most case after these spyware is uninstalled, your network becomes unavailable, This section will scan all LSPs currently installed in your system, and can help you fix damaged LSP.

How to fix damaged LSP ?

If your network doesn't work because of a damaged LSP chain, Adware Away provide a fix tool to fix your LSP. Steps to fix damaged LSP:

1. Check 'LSP' in Scan & Fix panel, Click 'Start' on right window.

2. After Scanning finishes, Click 'Detail'

3. Click 'LSP' tab in detail dialog

4. Click 'Fix LSP'

Note : Please make sure only when your network doesn't work because of a damaged LSP, can you use this tool to fix, and this fix-tool will restore your LSP chain to the original status when your windows is installed, All other LSP installed later by other programs will be unavaliable.

Remove Specified LSP

Adware Away will enumerate all LSP installed in your system, and mark those suspicious with red, You can delete any specified LSP or LSP chain except base LSP. Usually base LSP is installed by Windows. Steps to remove a specified LSP :

1. enter 'LSP' tab by clicking 'Detail'

2. Highlight a LSP item in list

3. Click 'Remove Specified LSP'

Note : Usually when a spyware LSP is installed in your system, it installs not only one LSP chain, So if you remove one LSP installed by one programs, you have to remove all LSPs installed by this program.


Working with Scan & Fix -> Auto Run Program

Auto Run Program

Now a lot of softwares make themselves auto-loaded with the windows startup, Most of them are unnecessary and only waste your system resource, slow your system performance, So this section scans all possible entries which can be configured for auto-load, including registry,win.ini,syste.ini and windows startup menu, all found result can be safely removed if you want.


Working with Scan & Fix -> IE Restriction

IE Restriction

Some malicious programs will make restriction to your Internet Explorer, with these restriction you cannot change any IE settings, This section will find out all IE restrictions and help you cancel them.


Working with Scan & Fix -> IE Pages

IE Pages

Some web site and browser hijacker will change your home page, default page or search page to their site, this section let you change them back.

Fix IE Page

Adware Away will list all IE Pages, and will mark those which is hijacked in red, To fix these pages, following the steps:

1. Enter 'IE Pages' tab in Detail dialog

2. Highlight the page which is hijacked

3. Change the page back in edit box

4. Click 'Fix it'

Note : Some hijacker would monitor your home page, if you change it, it will hijack it again. So if you experience this situation, You have to find the hijacker process, and terminate it, then fix your IE page.


Working with Scan & Fix -> Url Prefix

Url Prefix

Url Prefix is an address prefix which will be added automatically in front of url which is no prefix such as 'http://', Many browser hijacker will change this prefix to its own server, So you always get redirected to their site when you forget to type the prefix. This section will scan all default prefixes and mark all bad prefixes. Also you can restore it to the default.

Fix a bad Url Prefix

If you type a url in IE address bar without "www", for example, you type "google.com", but your IE take you to another site other than google. This is because your default Url Prefix is modified by some hijacker.

If every time when you type a url in IE address bar even with "www", your IE always take you to another site, This is because your Url Prefix is modified by some hijacker.

Steps to fix a bad Url Prefix:

1. Entry 'Url Prefix' tab in 'Detail' dialog

2. Fix all items in red


Working with Scan & Fix -> UrlSearchHook

UrlSearchHook

UrlSearchHook is a component used by browser to translate the address of an unknown URL protocol. When attempting to browse to a URL address that does not contain a protocol, the browser will first attempt to determine the correct protocol from the address. If this is not successful, the browser will use the result returned by UrlSearchHook. Many IE hijackers will add their UrlSearchHook to your system so every time when you type a url without protocol, you will be redirected to the hijacker's site. This section will help you change your UrlSearchHook back to the default one if your IE is hijacked by UrlSearchHook.

Fix UrlSearchHook

If some malicious program add a UrlSearchHook to your computer, or your UrlSearchHook is missing, you have to fix it, to delete malicious UrlSearchHook and add a default UrlSearchHook.


Working with Scan & Fix -> BHO & Toolbar

BHO & Toolbar

BHO (Browser Helper Object) is an component that is integrated into Internet Explore and Windows Explorer, it has an unlimited right to access your system. Many BHO is useful such as Google Toolbar, but many adware, spyware and other malicious programs will insert their BHO into your system to track you online behaviour or pop up ads. This section will scan all BHO currently installed in your system and mark the suspicious one, You can click 'Delete' to remove any BHO from your system.

Internet Explore Toolbar is a component which will be loaded by IE browser, Many adware and spyware have their toolbar integrated into IE to track your online behaviour or popup ads. This section will scan all toolbar currently installed in your system and mark the suspect one. At any time you can click 'Delete' to remove any toolbar you think to be suspect from your system.


Working with Scan & Fix -> IE Toolbar Button & Context Menu

IE Toolbar Button & Context Menu

Internet Explore Toolbar Button is a button or menu on the IE toolbar, there are many default button in IE system toolbar, and some other programs add its button on it, most of these extra button only slow down the startup of your IE browser, This section list all buttons in IE toolbar and you remove any one you want.

Items in IE context menu ( right click ) is sometimes useful, but if there are too many items in context menu, an obvious slow down will be seen, So it is neccessary to remove unsensed item from context menu. This section scans all extra items in context menu and you remove any one you want.


Working with Scan & Fix -> Installed ActiveX

Installed ActiveX

Downloaded Program Files are those which are downloaded from internet. These files are loaded whenever the Internet Explore is active, Due to the lack security of Internet Explore, many malicious site can make IE download its component ( called ActiveX ) such as dialer to do harm you system, make your system unstable. This section will scan all items in your Downloaded Program Files Folder, you can remove any one you want.

Delete an ActiveX

1. Enter 'Installed ActiveX' tab in Detail dialog

2. Highlight the activeX you want to delete

3. Click 'Delete'

Note : If you can't delete an activeX, you can close all IE windows and try to delete it again.


Working with Scan & Fix -> Hosts File

Hosts File

Hosts File is used by windows to lookup domain name before querying internet DNS server. Some browser hijacker add its entries into this file, So whenever you type a specific domain name in IE address bar, you will be redirected to the hijacker's site, not the real site you want to go. This section will scan the hosts file and mark the potential hijacking entries, you can edit hosts file to remove an entry.


Working with Scan & Fix -> IE DLLs and Shell Extensions

Internet Explorer DLLs & Shell Extensions

As we know, some browser hijacker is hard to kill, every time when you change you IE home page to a normal site, these hijackers change them back to porn site immediately, but most malware removal software can't find them, because these hijacker is well-hidden, They use a technology to insert them into Internet Explorer, So it is very hard to discover them for general malware removal tool. But with Adware Away, It is very easy to locate the malicious hijacker component. This section will list all dlls and ocxs which are loaded by Internet Explorer, help you find the well-hidden malware.

Shell Extensions are those dlls will be loaded by Windows shell when some condition happens. Some malware use this trick to hide its dll into Explorer.exe process.


Working with Scan & Fix -> KeyLogger & Suspicious DLL

KeyLogger & Suspicious DLL

Keyboard Logger is a kind of program which is secretly installed in your system without your knowledge. These programs will record all key stroke information and send out this information to its owner. It is very dangerous with a keyboard logger installed in your system, because all of your typing such as your credit card number, your password would be known by others. This section will detect if there is a keyboard logger installed in your system, During the detecting, it needs you to strike the 'Enter' on a message box instead of mouse.

Adware Away not only can detect keyboard logger, but can detect any suspicious dlls which is inserted into other process.

What suspicious DLL mean ?

We know, Windows has many DLLs ( Dynamic Link Library ), DLL is a necessary part for execution of application. Now Windows provides a technique which insert a third part DLL into another program, This technique makes the third part DLL be able to detect all activities and messages happening in another program, such as a key stroke, a button pressed, a window closed, etc. So suspicious DLL means some other program has insert their DLL into your system, but what they will do is unknown.

Add a DLL to normal list

Due to many normal programs especially some anti-virus programs also insert their dlls into other process, So if Adware Away detects a suspicious dll but you are sure it is from your normal program, you can add it to normal list so next time Adware Away will ignore it. Steps to do this :

1. Enter 'KeyLogger' tab in Detail dialog

2. Highlight the dll you want to add

3. Click 'Add to normal list'


Working with Scan & Fix -> File Association

File Association

File Association defines what program will be used to open a specific file, such as we use notepad to open .txt file. File Association can be used by malicious programs to load itself without your knowledge, This section will scan all often opened file type and its associated programs, marking the suspicious one, you can modify it by clicking Fix.


Working with Specialized Remover

Where is 'Specialized Remover'?

When you launch Adware Away, If you click 'Options & Settings' in Global Scanning & Fix panel, the options panel will occupy the whole left window, You can click the circle or 'More...' to show other section. See below:
<- Before hiding 'Scan & Fix' panel

After hiding 'Scan & Fix' panel ->

Run a specialized Remover

Specialized Remover is divided into four categories:

Hijacker - including most browser hijacker
Adware - including malware which brings ads or popup windows to your computer
Spyware - including malware which would monitor your privacy
Trojan & Worm - including malware which would open backdoor or exploit your system resource

There are four buttons in every category, their meaning are list below:

Steps to remove one malware: For example, we need to remove 'MyWay Speedbar Adware'

1. Click 'Adware Away' in left panel.
2. Look for 'MyWay Speedbar Adware' in right window and highlight it, the symptoms of 'MyWay Speedbar Adware' will appear in the bottom window.
3. Click [image] which appears 'Scan MyWay Speedbar Adware'.
4. Some information will be displayed in the bottom window, sample information looks like:

Search MyWay Speedbar Adware... Start
Found [5] MyWay Speedbar Adware Objects.
Search MyWay Speedbar Adware... Finished

5. You can click [image] to view the result.
6. Click [image] to remove MyWay Speedbar Adware


Working with Specialized Remover -> Search a malware remover

Where to Search?

When you launch Adware Away, 'Scan & Fix' panel will occupy the whole left window, You can double click on 'Scan & Fix' bar or click the circle to show other section. Double click on 'Specialized Remover' bar, you will see the search window.
Double Click on 'Specialized Remover' to use search window.

Why to Search ?

Due to Adware Away provides lots of specialized malware remover, It is a little bit hard to accurately locate to a malware whose symptoms applies to your current problems, So Adware Away provides you to search a malware by keyword, you can type the description of your symptoms as keyword such as : popups, ads, adware, hijacker, etc. Here is some recommended keyword to find out the right malware remover:

If you always get popup windows, you can use : popups, ad, ads
If your browser is hijacked, you can use : hijack, hijacker
If your network is unavailable after removing some spyware by other programs, you can use : lsp, spyware
If you know the name of a malware, use malware's name.

Seach Result

After type in keyword, and click 'Search' button, all matched malware remover will appear in the top list box. When you highlight one icon in the list box, a description of symptoms will be displayed in the bottom box.

After Search

 Click [image] will scan all matched malware.
Some information will be displayed in the bottom window, sample information looks like:

Search MyWay Speedbar Adware... Start
Found [5] MyWay Speedbar Adware Objects.
Search MyWay Speedbar Adware... Finished

Click [image] will display result of scanning.
Click [image] will remove all matched malware if found in your system.


Working with Specialized Remover -> Completely remove a malware

Completely remove a malware

Adware Away provides you a series of specialized malware remover, each of them will COMPLETELY remove all trace and component of one specific malware from your computer. Each of specialized remover is customized for one special malware, so it knows where the malware will be installed, what files it will copy to you hard disk, what folder it will create, what registry key it will create, what registry value it will configure, etc. It can find much more trace than any other malware removal program.

Steps to remove one malware: For example, we need to remove 'MyWay Speedbar Adware'

1. Click 'Adware Away' in left panel.
2. Look for 'MyWay Speedbar Adware' in right window and highlight it, the symptoms of 'MyWay Speedbar Adware' will appear in the bottom window.
3. Click [image] which appears 'Scan MyWay Speedbar Adware'.
4. Some information will be displayed in the bottom window, sample information looks like:

Search MyWay Speedbar Adware... Start
Found [5] MyWay Speedbar Adware Objects.
Search MyWay Speedbar Adware... Finished

5. You can click [image] to view the result.
6. Click [image] to remove MyWay Speedbar Adware


Working with Specialized Remover -> Routine Scanning

Routine Scanning

With Adware Away, you can make a routine scanning regularly to find any hidden malware.

Steps of Routine Scanning

1. Double click 'Specialized Remover' bar.
2. Click one category button such as ' Hijacker Away'
3. Click [image] which appears 'Scan MyWay Speedbar Adware'.
4. Some information will be displayed in the bottom window, sample information looks like:

Search MyWay Speedbar Adware... Start
Found [5] MyWay Speedbar Adware Objects.
Search MyWay Speedbar Adware... Finished
... ...

5. You can click [image] to view the result.
6. If find some malware component such as files, folders, registry keys, etc. You can remove these malware one by one.
7. Highlight a malware incon whose objects were found in step 4. Click [image] to remove it.
8. Repeat step 7 untill all found malware are removed.
9. Change to another category such as 'Adware Away', and repeat step 3 to step 8


Customizing Cleaner

Introduction

Customizing Cleaner is a service we provide to our users. As we know, Tons of adware, spyware and hijackers are produced every day, however, the techniques these malware use are similar, Adware Away also uses these techniques to detect those malware, Even if Adware Away finds many malware, the accidental deleting to any normal settings is very dangerous, So if you feel hard to remove those malware after scanning, We can customize a cleaner tool which is SPECIAL for you according to your scanning log.

How to get a customized cleaner ?

Please follow the steps below :

1. Do a new Global Scanning.

2. Wait for its finishes.

3. Click 'Submit' button

4. Fill necessary information. ( Type your name and email )

*5. Click 'Send by this program' or 'Send by my email client' ( Please make sure this step needs use your internet connection ).

6. Wait for our programmers customizing a cleaner for you.

7. A customized cleaner will be sent to you by email ( within 48 hours ), This cleaner will be shiped in a dll file.

8. Copy the cleaner you receive by email to the folder in which Adware Away is installed.

9. On Customizing Cleaner panel, click 'Load Cust Cleaner', an icon will appear in right list. Click 'Run' will run this cleaner

Note:
In step 5, you can choose the program to send the log file, Adware Away integrate an email sender and can send the log file by click 'Send by this program'. But if you prefer to use your own email program such as outlook, hotmail, yahoo, you can click 'Send by my email client', and copy the content into your email program.


Update & License

Update

Adware Away contains two reference files which can be used to identify malware, These reference files can be update online. All update is free for registered user. For unregistered user, it is free to update within evaluation time.

License

Adware Away is a shareware, during the evaluation period, any user can try its full functionality such as Scan & Fix, Specialized Remover, Customizing Cleaner and Update Online, After evaluation period, if you want to continue using Adware Away, you have to register it.

Registration

 Click here to pay registration fee for a single license, The price is : $29.95 USD, after payment, you will get a registration code to activate the trail version to a full version. The registration fee is one time, after registration, you can permanently use Adware Away and permanently get technical support from us.

Single license only allow you to install Adware Away on a single computer. If you want to install Adware Away in multiple computers, please choose other license type. See here : http://www.AdwareAway.com/buynow.htm

We provide multiple methods for payment, visit our website for more information. http://www.AdwareAway.com

After registration, your name and email will be integrated into Adware Away, the license file looks like :


Update & License -> Online Update

Online Update

Adware Away provides all users to update reference files online. Steps to update online :

1. Choose 'Registration & Update' panel ( If not visible, double click 'Scan & Fix' title )

2. Click 'Online Update'

3. Wait for it searching new version from our site

4. If a new version is found, it will prompt you with a message box, you can choose 'Yes' or 'No'

5. After update finishes, you have to close Adware Away and restart it, then the update will be valid


Update & License -> About License

About License

Adware Away is a shareware, during the evaluation period, any user can try its full functionality such as Global Scanning & Fix, Specialized Remover, Customizing Cleaner and Update Online, After evaluation period, if you want to continue using Adware Away, you have to register it.

After registration :

* You'll get the serial key immediately after registration via email

* Turn your trial version to full version by using the serial key

* In full version you get rid of all limitations on function and times

* Full access to technical support

* Priority in customizing service

How to register it ?

We provide four licesne types for different users:

Single License | Single License | $29.95 USD | Buy Now
Family License 5 Max | 1 - 5 Licenses | $130.00 USD | Buy Now
Small Business License 20 Max | 1 - 20 Licenses | $511.00 USD | Buy Now
Unlimited License | Unlimited | $1000.00 USD | Buy Now

Single License -- You only can install Adware Away on a single computer
Family License 5 Max -- You can install Adware Away on up to 5 computers
Small Business License 20 Max -- You can install Adware Away on up to 20 computers
Unlimited License -- You can install Adware Away on any of your company' or your customer's computers

You can choose your license type to pay the registration fee.

OR

Go to our website http://www.AdwareAway.com/buynow.htm