How to Temporarily Disable your Anti-malware Scanners

AD-AWARE AD-WATCH in Ad-Aware Anniversary Edition (and Pro
version)

Start Ad-Aware

Click the Ad-Watch tab

Click the Settings button

Ensure all highlighted options bellow are unchecked:(some
settings may be used or changed only in the Pro version)



Under the General tab

·
Processes Protection

·
Registry Protection

·
Network Protection

Under the Detection
Layers tab:

·
Spyware heuristics

·
AntiVirus engine

OK your way out, and close the main Ad-Aware window.

Shut down Ad-Aware and Ad-Watch Live! by
right clicking on the system tray icon, and selecting Exit Ad-Aware.

OK the change.

AVG ANTI-SPYWARE

·
Launch AVG Anti-Spyware.

·
From the "Status" menu, select "Change state"
to inactivate 'Resident Shield' and 'Automatic Updates'.

·
Then right click on AVG Anti-Spyware in the system tray and
uncheck "Start with Windows".

COMODO BO CLEAN

·
Right-click the system tray icon.

·
Select Shut down BO Clean button.

·
Restarts on reboot or open from Program Menu.

COUNTERSPY

·
Right-click on the running CounterSpy
icon in the sytem tray.

·
Hover your mouse over "Active protection".

·
A menu will slide out and then you need to left click on
"Disable Active Protection".

·
Disabling CS Active Protection should cause the systray icon to turn orange/red and hovering your mousing over the icon will then state "Active
protection is disabled".

(When we are done,
re-enable Counterspy by launching the program from Start > Programs, click
on the Active Protection. It will either say Active Protection enabled or
disabled. On the right side, you can select each of the tasks (scroll down to
see all of them) individually, then either enable or disable them on the bottom
right, individually. If you have a problem doing that then click on help,
choose run setup wizard, click next 2 times, make sure automatic updates is set
to yes, click next, make sure enable active protection is set to yes, click next,
then click finish, then exit. Then open CounterSpy to
make sure that the active protection has been enabled.)



PREVX

·
Right click on the Prevx icon in your
system tray and choose Show Management Console.

·
On the Management Console click the Protection Level drop-down
menu.

·
You will see three levels:

·
Maximum

·
Off

·
User Defined

·
To disable all protection set the level to Off.

·
You will receive a prompt asking "You are about to change
your security settings. Do you wish to continue?" Click Yes.

·
Click the X on the upper right hand corner to exit the Management
console.

PROCESS GUARD

·
Right-click the blue lock ProcessGuard
icon located in the system tray.

·
Uncheck 'protection enabled'.

·
Click yes.

REG DEFEND

Right click the icon for RegDefend in the systray and select Exit.



SPYBOT TEATIMER

·
Launch Spybot S&D, go to the Mode
menu and make sure "Advanced Mode" is selected.

·
On the left hand side, click on Tools, then
click on the Resident Icon in the list.

·
Uncheck the "Resident "TeaTimer"
(Protection of overall system settings) active." box.

·
Click on the "System Startup" icon in the List

·
Uncheck the "TeaTimer" box and
"OK" any prompts.

·
If Teatimer gives you a warning that
changes were made, click the "Allow Change" box when prompted.

·
Exit Spybot S&D when done and reboot
your computer.

(When we are done, you can re-enable Teatimer using
the same steps but this time place a check next to "Resident TeaTimer" and check the "TeaTimer"
box in System Startup.]

Please download ResetTeaTimer.zip
(http://s3.invisionfree.com/HijackThis_Heaven/index.php?act=Attach&type=post&id=8231698) and save to your Desktop. Extract (unzip) the file and
double-click ResetTeaTimer.bat to run the script.
This will remove all entries set by TeaTimer and it
from restoring them upon reactivation).



SPY SWEEPER

·
Open Spy Sweeper and click on Options > Program Options and
uncheck "load at windows startup".

·
On the left click "shields" and then uncheck everything
there.

·
Uncheck "home page shield".

·
Uncheck "automatically restore default without
notification".

·
Exit the program.

·
(When we are done, you can re-enable it using the same steps but this time reverse them.)

SPYWARE DOCTOR

·
Click the Spyware Doctor icon in the System Tray.

·
Click Settings.

·
Click Startup Settings under Pick a Category.

·
Uncheck "Run at Windows startup".

·
Click Apply and Exit Spyware Doctor.

·
From within Spyware Doctor, click the "OnGuard"
button on the left side.

·
Uncheck "Activate OnGuard".

·
(When we are done, you can reenable
Spyware Doctor)

SPYWARE GUARD

·
Right click the running icon of Spywareguard
in the system tray to open the program.

·
Then go to Menu, File, and choose Exit.

TROJAN HUNTER

·
Go to TrojanHunter Guard in the the system tray. It is a light blue icon with a magnifying
glass and red handle.

·
Right click on it and select settings.

·
Uncheck "Load at startup" and "Enabled". Make
sure that the program, TrojanHunter itself, is also
closed/not running.

WINDOWS DEFENDER

·
Click Start > Programs > Windows Defender or launch from the
system tray icon.

·
Click on Tools & Settings > Options.

·
Under Real-time protection options, uncheck the "Real-time
protection" check box.

·
Click Save.

·
Go to Start > Control Panel > Security > Windows
Defender, at the bottom of the Window Defenders page uncheck under
Administrator Options "use Windows Defender" and then Save.

·
(When we are done, you can re-enable Defender using the same steps
but this time place a check next to "Turn on real-time protection"
check box.)

WINDOWS ONECARE

·
To Disable Antivirus: Open the Windows OneCare user interface.

·
Click View or Change Settings > Antivirus Tab.

·
Click the radio button to turn the anti-virus off.

·
To Disable Firewall: Open the Windows OneCare user interface.

·
Click View or Change Settings > Firewall Tab.

·
Drag down the slider to turn the firewall off.

WINDOWS LIVE ONECARE

To Disable AntiVirus and AntiSpyware
protection

·
Right click the system tray icon and select Open Windows Live
OneCare.

·
On the main page click Change Settings > click Viruses and
Spyware Tab.

·
Tick "Off" radio button > Apply and OK.

To Disable Firewall
protection

·
Right click the system tray icon and select Open Windows Live
OneCare.

·
On the main page click Change Settings > click Firewall Tab

·
Tick "Off" radio button > Apply and OK.

WINPATROL

Right-click the running icon of Winpatrol in the sytem tray and choose exit.

How to use Autoruns for malware hunting.

One of my favorite tools for hunting malware is Autoruns from Sysinternls. When malware infects a computer it will register itself as an autorun in the registry. Autoruns are programs that start when the system boots up ensuring that the malware starts when Windows starts. Autoruns shows you these entries and allows you to remove them.

From the image you can see that there are lots of entries to look through. Here is how to find suspicious entries. First narrow down the list by clicking options and check Verify Code Signatures and Hide Signed Microsoft Entries.
Now scan the list looking for entries that are missing a description or publisher. If you are not 100% sure what it is, Google the entry and the search results should tell you if it is a malicious program. Once identified you can disable or delete the entry.