AdAware and then??? 2

[jlockley]

combing for information on a probably keystroke logger I brought in by doing something really dumb, I notice the following programs mentioned:

IeSpyad
Spybot
HiJack This
and others.

I have Zone Alarm, Norton and AdAware (and of course cookie monster). What else would be the wises choices of spy ware finders to upload. I don't mind paying, if it's not too much. W2k, use Eudora rather than Outlook.

 

[jimbopalmer]

I find that I run Adaware then Spybot then use Hijackthis or MSCONFIG in the run window to look for stuf both have missed.

I tried to remain child-like, all I acheived was childish.

 

[jlockley]

OK, how would you use msconfig? Spybot I have just used, and am impressed. Hijack is OK, but most of the listings are righteous programs.

Here's a poser: Why not just delete wintools and timesink, etc (can't get to them by remove programs) and let registry mechanic clean up the mess post mortem? Or is that just too lazy.

 

[jimbopalmer]

Correct, that is why I never leave hijackthis on my clients box, for hijackthis to show me EVERY step in startup, it shows valid steps as well. I use google to ID any program listed I do not recognize as a windows standard. (MSCONFIG does this as well)

I tried to remain child-like, all I acheived was childish.

 

[jlockley]

If you don't mind my asking, how would you do this?

 

[jimbopalmer]

I use MSCONFIG (Start > Run > MSCONFIG > Startup) by reading the lines til I see one I do not recognize, say HIDSERV.EXE that sounds suspicious, then I google HIDSERV.EXE and see what it is:
Process File: hidserv or hidserv.exe
Process Name: Microsoft Human Interface Device Audio Service

So that is fine, then I google WININIT.EXE which sounds safer but isn't:

Process File: wininit or wininit.exe
Process Name: WOLLF.16 virus

that line should go!

I am sure other folks have other techniques but that is how I use MSCONFIG or highjackthis

I tried to remain child-like, all I acheived was childish.

 

[jlockley]

wow. simple and elegant.
When you say that line should go, do you mean from registry, or??

 

[jimbopalmer]

In MSCONFIG you Unselect it and it does not run at startup anymore

In highjackthis when you select it it removes it from the registry, or other files that run at startup, so highjack this is way more permenent than MSCONFIG

I tried to remain child-like, all I acheived was childish.

 

[jrbarnett]

An introduction to the Analysis of a HijackThis log file:

http://www.tek-tips.com/faqs.cfm?fid=4897

However, the same techniques will work for uncovering items using MSConfig.

John

 

[jlockley]

Thanks for all. I am very glad I asked.