Request info on all locations spy/mal/adware start from?

[theniteowl]

Hi All,
I am trying to locate all possible(or at least likely) locations in Windows in which spy/mal/adware can be launched.
Spyware removal tools are a hit-or-miss deal even when you keep definitions up to date and most times a machine of mine gets infected (kids just LOVE to play games on the internet but that's a different project) it is a new or new variation that the spyware removal tools either do not recognize or fail to completely remove.

I have had to resort to manually cleaning PCs on a number of occasions going through everything I can think of to find possible sources of programs and cleaning them out.

Is there a comprehensive list on locations these files can be launched from? MSConfig just does not cut it for startup items as there are other locations things launch from and MSConfig is often enough corrupted by some of this spyware to begin with.

I would like to document all locations in windows that can launch an app on boot as a starting place to track down and eliminitate these programs.
I know there are a number of places in the registry that launch apps at startup, Services should be checked, test for browser helper objects, etc.

Also, is there a solid method for killing processes?
I have tried a few process viewers but so far have not found one that is always effective at killing a process or process tree so it stays down. Is there perhaps one that can flag multiple processes and then execute the kill all at once to combat one process monitoring another and re-spawning it if it gets shut down?

I have been very successful so far in manually removing this stuff but it is a matter of flying by the seat of my pants thinking of things as I go and never having a good solid planned approach so I may not remember what I did the last time and spend a lot of extra time figuring it out all over again the next time.

Thanks.

It's hard to think outside the box when I'm trapped in a cubicle.

 

[erikhertzel]

Check this website out:

http://www.ezpcfix.net/

It's good at doing all you want for finding spyware in the startup, BHO's, etc....

Also, this is a good overall article:

http://castlecops.com/t116539-Guide_Make_your_own_System_Security_Suite_for_Free.html

Take care,

Erik

 

[theniteowl]

Thanks, I will take a look at them.
I also found this link which seems to be pretty good.

http://www.michaelhorowitz.com/removespyware.html

I will have to read through all the sites and see what I can come up with for a mix of info and utilities.

Thanks again.


It's hard to think outside the box when I'm trapped in a cubicle.

 

[Glenn9999]

HiJackThis! finds most all of the autorun spots (at least the ones I'm aware of).

Then

http://www.blumentals.net/products/procview.php

should help you in looking at processes and killing them.

 

[theniteowl]

I have HiJack This though still have to learn to read the results a bit better but what I am looking for is to put together a list of locations myself so that when I have to do things manually I will know all the right spots to check.

There are some wonderful utilities out there but even the best of them are not always perfectly up to date or the copy you need to run or install from portable media might not be able to get an update depending on circumstances and some manual manipulation will be needed.

Procview looks like it has some potential. I just started playing with PrcView as well and will have to compare the two. I also found a bit of .vbs code to do a process impersonation so you can prevent a process from firing by making it look as if it is already running and thereby allow you to go in and kill the files. Particularly handy if it is something that runs even within safe mode I would think.

There is of course a ton of useful info out there, the problem is sifting through it to get all the details into one place and outline the best steps of approach to minimize the number of reboots needed, etc.
In the past I have missed items not realizing the process a specific application was using so that on reboot of course I end up re-infected with new dynamically named/placed files to have to locate. If I know more I can be more thorough on the first pass and not have to deal with that again.


It's hard to think outside the box when I'm trapped in a cubicle.