How to Kill Spyware Processes
What are processes?
Every program has its own executable code (for example, the .exe file). A process (or task) is a program that is being executed. When you start a program, the executable code will load into the computer’s memory. This code is the process. If a process is closed or terminated, the resources used by that program will not run. To see all the processes running on your computer, you can use the Windows Task Manager, a built-in Windows utility.
The Windows Task Manager allows you to terminate almost all processes, however, there are some programs that have invisible processes running in the background and can remain on your computer without you knowing its exact location.
Why is it important to remove malicious processes?
Even though some processes are legitimate, there are other processes that come from malicious applications such as spyware, adware, trojans, malware, worms, and rootkits. It’s reported that malicious applications may run on your computer without your knowledge or consent. These malicious applications can infect your computer and compromise your privacy, security and computer performance. That’s why it is important to learn how to kill malicious processes.
The first step is to evaluate every process running on your computer to determine whether any of them is a piece of spyware. The obvious choice is to look for a process that is either out of place, does not belong to a program you remember installing or is behaving odly. In the case of an extreme malware infection, you may not be able to kill the offending program with the Task Manager and instead might get an “Access denied” error. In a case like this, an anti-spyware program might be the best approach to solve your computer’s security problem.
The instructions on how to get started depends on what Windows version you have. Learn how to remove kill spyware process from your computer.
Kill Spyware Processes Manually
Warning: Stopping system processes is a difficult and risky. If you delete the wrong file, your computer may crash and important data may be lost. As a precautionary measure, please back up important files and set a System Restore point (click Start > All Programs > Accessories > System Tools > System Restore, and follow the on-screen instructions) or run a spyware check with a trusted anti-spyware program to automatically detect spyware.
You can kill spyware proccesses in two ways:
Method A: Using the Windows Task Manager. (Recommended)
Method B: Using PsKill through the Command Prompt window.
Method A: Using Windows Task Manager to Kill a Process
Follow the steps below to manually kill a process with the Windows Task Manager:
- Start Windows Task Manager
To open the Windows Task Manager, use the combination of CTRL+ALT+DEL or CTRL+SHIFT+ESC. You can also press the “Start” button, select the “Run” option, type “taskmgr” in the blank field and then press the “OK” button.
- Find and Kill Spyware Processes
In the Windows Task Manager, select the “Processes” section to see all active tasks. Find the proccess by name. To make it easier, select the “Image Name” button to list tasks by name.Use the list of process files associated with the spyware you know or suspect your computer has been infected with. You can find a list of processes by going to our spyware database and selecting the parasite you’re interested in. If there’s a process that you don’t recognize, copy the process and search on google.
Select the process you want to kill and click on the “End Process” button to kill it.
Method B: Using PsKill through the Command Prompt Window to Kill a Process
In some cases, a parasite may disable your Windows Task Manager so instead you can use “pslist” and “pskill” (a third party application by Mark Russinovich) to list and kill the unwanted proccesses.
Follow the steps below to manually search and kill the spyware processes with PsKill:
- Open the Command Prompt window
Press the “Start” button on your Taskbar and select the “Run” option. Type “cmd” in the field and then press the “OK” button.
- Search the unwanted process
When the Command Prompt window is opened, type the command “pslist” and press “Enter” to search processes from the list of running programs.
- Kill the unwanted process
Once you know the name of the process you want to kill, type the command “pskill [PROCESS_NAME]” and press “Enter” to terminate the unwanted process. For example, if you wanted to kill SpyLocked (a rogue anti-spyware program), you would type pskill spy-locked.exe.
- If the process was terminated successfully, a confirmation message will be displayed.
August 19th, 2007 at 5:10 pm
i will try these things as win antispyward 206+207 have loaded in my computer a lot of times and locked it up yesterdday and it took me 2 hours to get it out thanks m
September 1st, 2007 at 8:50 pm
I am curious, in order for ultimate cleaner to find its way to your PC, do you have to manually download it or does it find its way through an open port or something ?
September 3rd, 2007 at 7:53 am
natural,easy to use,& effective
September 3rd, 2007 at 7:56 am
so long & more power……….. no fees just follow the manual.
September 9th, 2007 at 12:32 pm
Some clever spyware programer has found a way to circumvent this method of removal. The directory that comes up when I open my DOS is “C:\documents and settings\ user” and I am unable to change the directory. I’ve tried every command, but it seems to be ignored. I guess its reformatting the hard drive for me!
October 2nd, 2007 at 10:36 am
The same thing with me. DOS opens with C:/documents and settings\user. Can’t change the directory. Anyone have any other ideas?
October 5th, 2007 at 8:54 pm
Rachel.
Have you found a way to get around that? Mine is doing the same thing. Can anyone help?
October 8th, 2007 at 9:48 am
Rachel, Lauri and Amy,
Maybe you can be more specific? Give the detailed description what is happening on your system.
October 9th, 2007 at 9:22 pm
Have an error: SETUPAPI.DLL file is linked to missing export NTDLL.DLL:NTCLOSE. It seems the only thing affected is any IE6 toolbar, they won’t appear or reload. Had a file STARWARE TOOLBAR that my Spy Sweeper found and removed, but still no toolbar’s. I would like software that would make this right, put the missing file back. Will yours accomplish this or can you recommend one that would?
running win98/acer aspire 333mhz,ie6
missing ntdll.dll:ntclose
October 10th, 2007 at 5:48 pm
have you tried this command
C:\documents and settings\user\ cd\
and if not. try to
run msconfig from cmd and choose selective start up
disable your system restore from system icon located at control panel
restart PCin safe mode with networking
and from there do an online scan on you system
firefox user
October 10th, 2007 at 8:50 pm
I’m experiencing the exact same problem. The background shows a false error message. I can’t access task manager because it says it’s been disabled by the administrator. If I didn’t have Firefox for a browser, the computer would be totally useless. I’ve gone through all the advice, but it seems they are one step ahead. It’s like the computer “lets” me use it, other than that, its in total control.
October 11th, 2007 at 11:40 am
Josh,
It seems that you have got malware on your system. You have to fix your computer by using anti-spyware programs. You said taht you can’t access Task Manager. Press Start, click Run and then paste “REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f” (without quotation marks). This should enable Task Manager.
October 27th, 2007 at 3:55 pm
i can’t open taskmanager and RUN in start menu
November 11th, 2007 at 8:15 am
rachel and amy:
just add dir
C:/documents and settings\user>dir
that brings up the directories
im all for killing all these unwanted spyware junk using any weapon available
November 14th, 2007 at 4:37 pm
I can’t even get into google because my computer tells me that I am not connected to the internet. Does Ultimate defender cause this as well?
November 15th, 2007 at 2:28 am
wads da process name fer zlob?
November 20th, 2007 at 5:05 pm
lol,
There can be a few different Zlob processes. Their names are changing very often. The best solution is to scan your computer with our free scanner and remove the infected files. Our free scanner will separate the processes so you can easy find their names.
November 20th, 2007 at 5:37 pm
pat,
Very likely, that no. But it’s possible that there are many other parasites on your computer. Perhaps some of them don’t let you to connect to some pages on the internet.
December 5th, 2007 at 2:27 am
so, i don’t think AWOLA actually got installed cos it won’t appear in the task manager - but it won’t go away either. it keeps displaying messages in the task bar and keeps opening its program. how can i get rid of it?
December 5th, 2007 at 2:29 am
now my computer is telling me it can’t do the pslist thing either. “pslist is not recognized as an external or internal command”
December 5th, 2007 at 10:31 am
wes,
You have to install the additional software PsTools. You can find it here http://technet.microsoft.com/lt-lt/sysinternals/bb896649(en-us).aspx After installation PsList and PsKill should work.
December 16th, 2007 at 3:46 am
Hello! Can someone, anyone help my hubby & me!? I’ll beg if necessary..lol I just got Norton back on our computer, but somehow, most likely before I did that I got dioCleaner infected & I can’t get rid of it through the ways I’ve tried on here, this thing is WAY smater then me!! I thought by reinstalling Norton it would get rid of the DioCleaner…nope! So do I have to buy like an additional $30 spyware program or something to get rid of it? It won’t even let us look at our email’s either! I keep going to ask.com & reading as much as I can…gona be a long night! Maybe I can look at my hotmail at least. That’s meme71973@hotmail.com if anyone has any advice for us! Thanks for everything!!
Amy S.
December 22nd, 2007 at 10:49 am
Amy,
Not all antivirus programs remove spyware. And the infections are mutating very often, so it’s nearly impossible to catch and clean them very easy. You should contact the support team of your antivirus and they will help you with DioCleaner removal. Also, you can follow the DioCleaner manual removal instructions which are on http://spywareremove.com/removeDioCleaner.html . You can use our free scanner which is not removing, but detecting the infected files, so it will help you to find the locations of the infected files and then you can try to remove them manually. Otherwise, you can get a reliable anti-spyware program.
January 11th, 2008 at 12:54 pm
To Laurie & Amy.
I believe CMD opens in the current or last used directory.
To navigate, use the CD (change directory) command
To go to C: root, firefox pointed out use CD \ or Cd C:\
To go up one level, do CD.. Do that several times you’ll get to C: root
To go down a level, do CD\lowerleveldirectoryname
To see what folders / directories are in the current directory, do DIR (optionally with /P to stop it scrolling off the window)
DOS still lives
j
January 12th, 2008 at 4:20 pm
Pslist and Pskill wont do anything and i know where the viruses origin file is but its protected from deletion… Why cant i use PSlist and PSkill?
January 14th, 2008 at 1:26 pm
Seth,
As I mentioned above to Wes, you have to install the additional software PsTools. You can find it here http://technet.microsoft.com/lt-lt/sysinternals/bb896649(en-us).aspx After installation PsList and PsKill should work.
February 12th, 2008 at 6:27 pm
I seriously need your help.
I followed your instruction to remove UltimateDefender from my system but it’s icon stilll manages to be in my toolbar! I’ve downloaded all sorts of anti spyware but it doesn’t seem to be able to get rid of it. Why?
February 13th, 2008 at 10:30 am
MJ,
It may be, that the antispyware program you have, doesn’t have the latest updates for this parasite. Did you update your antispyware program? Try to boot your computer in Safe Mode and scan with your antispyware program again. Sometimes antispyware programs remove parasites from Safe Mode, which they can’t remove in Normal Mode. If this won’t help, try to scan your computer with our free SpyHunter scanner, which will detect the infected files and show their locations. Afterwards boot your computer in Safe Mode and manually delete the infected files (Shift+Del).
February 26th, 2008 at 12:18 am
how can i completely kill all of my anti spyware on my laptop? I would like to know step by step construction so please kindly reply for my request.
March 5th, 2008 at 4:42 am
I’m having problems like this to and I can’t get my taskmgr to work and somehow its disable?? why is that?
March 5th, 2008 at 4:44 am
I’m having computer problems like these people and it changed my desktop and disable my taskmgr how does that happen and I can’t use system restore too help me someone
March 9th, 2008 at 3:02 pm
I downloaded pstools but I am still unable to use pslist or pskill. What do I do?
March 15th, 2008 at 6:41 pm
I’ve downloaded the additional PsTools, but still getting the “does not recognize” message.
March 31st, 2008 at 6:59 pm
Hello all. Ok here is my dilemna. I have this ZLOB on my pc as well. I tried to use Norton 08. BOOOOO. its a waste of money. I used that SpyHunter and it found a lot more stuff than I was aware of. I was having trouble getting to my directory C:\ also. It worked when i did (case sensitive) CD:\. So i get to the C prompt and i type in PSLIST and to no avail. I also downloaded the PsTools and I still can not get it to run. I get the error message that says ‘pslist’ is not recognized as an internal or external blah blah blah. I really need this thing to GO AWAY!!! I am furious at how long this process has taken. I would really appreciate any guidance through my long haul of these stupid trojans and spyware and malware and viruses and and and and and. Aren’t u guys fed up? I really hope that we can get an answer soon because if not….well soon i hope.