[askarz]

Hey guys, girls.
I am very interested in a List, of all SpyWare names, So I could search my registrety, and search for certain files on my computer, and search at what name they run at in the Windows Task Manager, I wish to delete all spyware manually, so specific things to search for, in Start> Search> All files and folders. So I can then end the tast, and delete it for good. if anyone has access to a list like that, a reeeeally good one. I would be MOST greatful!!
Thanks!

[etaf]

Hi, and welcome to the TSG forum

why manually ??

there are thousands and thousands of spyware -
if you look at spybot, ad-aware, or spywareblaster (3244 items) - it has thousands in the database

why not load a program and run

just in case you interested

----------------------------
How did I get infected in the first place
http://forums.techguy.org/t208517.html

Security Help Tools- this has a full list of software available
http://forums.techguy.org/t110854.html

1) Install anti virus software
there are free programs available for example AVG from
www.grisoft.com or AVAST from www.avast.com

2)XP has a firewall already
available - to activate it
ON your PC
start>
connect to>
right click on your connection to broadband (this may be lan or usb)
properties>
advanced>
tick the box - internet connection

see tutorial here
http://www.practicallynetworked.com/...c_firewall.htm

But i suggest also a separate piece of software for a firewall
one of the following two free programs are good

Sygate:
http://www.homenethelp.com/web/howto/free-firewall.asp

Zone labs:
http://download.zonelabs.com/bin/fre...ex2_11072.html

Tutorial on Firewalls
http://www.bleepingcomputer.com/forums/tutorial60.html

3) spyware
All these programs must be updated before you run them.

I suggest four programs to control spyware (all free)
two programs you run to remove the spyware and the other two stop
spyware getting onto the PC in the first place

a) Spybot search and destroy - because these sites are attacked to
stop them providing this solution, I have a few sites to get the
software

http://spybot.safer-networking.de/
http://tomcoyote.org/SPYBOThttp://ww...-10122137.html
http://www.spybot.us/spybotsd13.exe
http://www.safer-networking.org/
http://www.thewhities.com/

b) Ad-aware - because these sites are attacked to stop them providing
this solution, I have a few sites to get the software

http://www.lavasoftusa.com/
http://www.networkingfiles.com/Cookie/adaware.htm
http://www.lavasoftusa.com/support/download/
http://www.thewhities.com/

The next two try to protect the PC from getting infected in the first place
c) Spywareguard
http://www.javacoolsoftware.com/sgdownload.html

d) Spywareblaster
http://www.javacoolsoftware.com/spywareblaster.html

Tutorials for the above

AD-Aware:
http://www.bleepingcomputer.com/foru...howtutorial=48
http://www.dotcomsecurity.org/forum/viewtopic.php?t=4

SPYBOT:
http://www.bleepingcomputer.com/foru...howtutorial=43
http://www.dotcomsecurity.org/forum/viewtopic.php?t=25

SPYWAREBLASTER:
http://www.bleepingcomputer.com/foru...howtutorial=49
http://www.dotcomsecurity.org/forum/viewtopic.php?t=43

SPYWAREGUARD:
http://www.bleepingcomputer.com/foru...howtutorial=50
http://www.dotcomsecurity.org/forum/viewtopic.php?t=44

[dugq]

I agree with etaf, searching for every possible item manually is going to take you a lifetime. Also, just deleting spyware files can harm the PC. If you want a close to manual solution, use Hijack This

http://www.majorgeeks.com/download3155.html

You can see tutorials here

http://aumha.org/a/hjttutor.php

http://www.bleepingcomputer.com/foru...howtutorial=42

[askarz]

Oh yeah, lol, I wasent thinking stright I guess, I know there are a lot of different spyware.
The reason I was looking is. I am starting a new job real soon and one of the things I will be doing is removing spyware from Offices computers, and well, I use AdAware & Spybot here on my computer, they find a lot of stuff once in a while, but it does not get everything. after running AdAware and & SpyBot, there are still things in my Windows Task Manager like, somthingRebates, and junk like that, no I used hijackthis, and deleted things that were obviously spyware, such as the rebates things, somthing called fastcash.... things of that sort.. and that workes better too, but i still get botherd somtimes and i dont seem do be able to get rid of it... and once i start my new job, i wont be able to post things here and wait for a reply because it will take to long since ill be on the job. ... Thanks

[etaf]

have a read in the secruity forum - see if you can follow some of the advice - pick one or two of the secruity experts and follow some of there posts - hjt is the tool and there are some tutorials around.

http://forums.techguy.org/t251007.html
http://hjt.**********************/
http://aumha.org/a/hjttutor.php
http://www.spywareinfo.com/~merijn/htlogtutorial.html

this site has loads of tutorials on secruity - ad-aware - spybot - firewalls - etc
http://www.bleepingcomputer.com/foru...howtutorial=48

[askarz]

When I delete thigns using HiJackThis, when i scan again RIGHT after, it still looks good. Then a day later.. i scan again and its all back!! HELP :-D

[etaf]

the you may not have fixed the software thats allowing the spyware in. windows fully upto date with all secruity updates.
OR
the program is stilll on PC and just reloads on startup
Post a hijackthis log here for a guru to review

[roban]

Run Spyware Guard and Spyware Blaster on your machines. Also IE-Spyad will add an updated database of known URL's to your restricted sutes folder for you. There are hundreds of new spywares added to databases every day so even if you had a list today it would be obsolete tomorrow. The key here is to update.

[askarz]

Logfile of HijackThis v1.97.7
Scan saved at 10:01:01 PM, on 12/13/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Messenger\msmsgs.exe
C:\program files\valve\steam\steam.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\Program Files\Access Remote PC 4\rpcsetup.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\mIRCScripts\PolarisX\mirc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Chris\My Documents\AIM Logs\askarznet\CyberJeff15346\2004-12-11 [Saturday]\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
O2 - BHO: (no name) - {002EB272-2590-4693-B166-FBD5D9B6FEA6} - C:\WINDOWS\multimpp.dll
O2 - BHO: (no name) - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\PROGRA~1\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [lentupvzqfgwp] C:\WINDOWS\system32\hkuohr.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Run DAP (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: ICQ 4 (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O9 - Extra button: Ebates (HKCU)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub...sh/swflash.cab