A really stupid question about removing spyware

I was checking my system for spyware with Spybot(that's the best program for spyware ever done :)) And it found something. I said to delete it. After thinking a while it said that it can't and asked me if I want that it starts next time with windows. I said okey i restarted the machine and then spybot started checked the system, found the same **** on my PC and told me again the same thing: cannot remove the **** is in use :). So I said if you can't do it my friend I will do it by myself. I went in the regestry and deleted the spyware. My question is: "I'm I free of this ****?" I was wondering, how it is possible that spybot can't delete this tracking things and I can do with out anyproblem? Spybot didn't find them anymore(the spyware). So I'm I free?

I would like to know the same thing. I get the same problem when Norton2002 detects a virus but can not remove it. How lame is that. Either way I can either just delete it myself or I have to attrib -s -h <file> before it lets me delete it, but why can't the all powerful norton antivirus remove the system/hidden attributes.

No tool can remove a file if it is in use (in general). Did you ever consider running the tool in safe mode? Most of the time that will work.

Quote:

---

I went in the regestry and deleted the spyware.

---

No, you didn't delete the spyware.. you deleted the registry entry that started the file.

You could also try Ctrl-Alt-Delete, to Windows task manager, identify the process of the Proggie. manually close it, and run your Spybot.

Me thinks that would work.


BTW- Whether or not Spybot is the best ever made is debatable.


:D

it could also be a false positive. which means that it thinks its there but really isnt. so it cant delete it.

oh, and its generally not a good idea to make the subject of your post any in the realm of "a stupid question about..."

why would anyone want to read stupid question? I only read it becasue i am out of other things to read.

Quote:

---

You could also try Ctrl-Alt-Delete, to Windows task manager, identify the process of the Proggie. manually close it, and run your Spybot.

---

This usually works, although, often enough there are combinations of processes that work together to respawn when you close them. Also... some things don't show up in the process listing directly. (ie... svchost.exe)

A Groovicus mentions, safe mode is usually the best way to work with malware. It starts the system up with a bare minimum of proccesses and devices. This prevents most malware from even starting, regardless of whether the malware has a registry entry. It also cuts back on system overhead, making tools run signifigantly faster in some cases.

As far as Spybot being the best... the best is whatever works best for you. I myself, like regedit. :p

Note: I use the term "malware" instead of spyware due to the fact that these methods work well for just about any ill-intentioned peice of software. Viruses, spyware, AOL, whatever you happen to be infected with.

EDIT: The reason Spybot no longer finds the malware is because the registry entry is gone, detection occurs in the registry, not with the actual binary IIRC.

EDIT 2: Attempted to correct horrible spelling/grammar. Probably failed.

Quote:

---

EDIT: The reason Spybot no longer finds the malware is because the registry entry is gone, detection occurs in the registry, not with the actual binary IIRC.

---

in spybot yes. in adaware it does the registry as well as matching gilenames and process names.(more likie virus scanners) that is why spybot has that number on the bottom and is generally faster, it is just matching reg keys. and I agree...regedit seems to work well for me. although adaware and spybot are also good programs.

Quote:

---

although adaware and spybot are also good programs

---

Definitely... My point was that the best tool is the one that works best for you. Anybody can use Spybot or Adaware... but do you really want grandma playing with regedit? Even if regedit is more powerful, direct, whatever, it is more dangerous. It all depends on the skill of the user.


Oh yeah... I don't know if there is a thread about this yet... if not I will be posting one...

Trendmicro Housecall, one of the best online virus scanners has a new version out for beta testing. The new housecall also does spyware/adware and security checks including missing patches. It's definitely worth a try. And last time I checked, it was completely free. Housecall You do need IE and ActiveX for this to run properly IIRC.

Quote:

---

It all depends on the skill of the user.

---

I couldnt agree more. I would have a heart attack if I walked in on one of my users with regedit open, but if they were running adaware...well Id have a heart attack anyway, but that would be out of shock and not pure horror. lol

The real problem with computer software in general is user skill. You have to find the perfect balance between useability and functionality. A perfect example of this is something like Spybot vs. something like HijackThis. Spybot is simple, easy to use and comprehensive, but lacks, well maybe not heuristic, but the ability to clean "undocumented" items. HijackThis on the other hand, lacks definition files, and any useful guidelines, instead, giving the user the ability to almost completely clean the system of malware by presenting every registry key that can be used in browser hijacks, auto startups, etc., and allowing a skilled tech to comprehensively clean the system, without worrying about whether a specific item is "defined."

If you'd care to look at the posts I've made over the years, from d0pp139an93r to d0pp, you'll see that I post alot of useful ****. I also have fun. This is actually perfect timing because there was a wonderful discussion in IRC a few minutes ago that related to this. Unlike many of the "respected" members here, I very rarely post personal attacks, even if my post is obscene, it is generally directed at the subject and not the poster. I'm not naming names, I'm not singling people out, but if you look around AO, you'll notice what I'm talking about. The point is, even when I troll, I don't try to hurt people, I don't fall into the petty bullshit flame wars that constantly errupt here, although I will get into them as discussions. And most of all, I don't reward the flamers with the AP *******s that many others do. (Although, ever since I asked for the d0pp139an93r account banned, I can't exactly throw my weight around). I'm not saying I never make personal attacks, but I do it when I feel it is appropriate, and in a context sensitive manner if possible.

I don't have a problem with the negs I recieved, quite frankly I could care less, I do have a problem with the message that came with them, which, for the reasons above I am not posting here, and my reply remains:

Go **** yourself.

That is all.

yes, usually a spyware remover program cant delete something because it is in use, so just make sure u go into safe mode before you try and delete something... or you could try using another anti-spyware program such as adaware but be warned sometimes if you run both programs it creates false positives so be careful and goodluck.

I fear I messed everything up! I deleted the regestry info and that is why spybot can't find(you are all right :() But before I do that I made a deep scan with adware and it found nothing. The only spyware that was detecting this piece of malware was Spybot.
And should I do now? How can I find it again? And deleted once forever? And if there no keys in the regeistry, how it is possible that this malware starts??? Or it is not anymore starting but it is in my PC.

P.S. Someone said that the thread is stupi: I'm sorry! Next time I will not make the same mistake, but I was really that my question is stupid :(

P.S. And I was looking in task manager what process are running. There was nothing suspicious. Perhaps it is something that is hidding in svchost.exe

Quote:

---

Someone said that the thread is stupid

---

they said that it was not a good idea to add the word silly into the title.

The bad guy is still in there, but is now dead, no reg entry, no start up capability.
and in task manager there are quite a few [good AND bad] apps that, while not hidden, are 'masked' as svchost .................

Pax


[edit]

Quote:

---

Give your threads a topic that actually describes the topic of the text. It improves readability, searchability and draws an interested crowd to your thread. Be short and to the point.

-submitted by Guus

---

from the front page when I got back ....................... :cool: :coincidence:

Alright... first off... AdAware and Spybot detect different things...


Second.. go through your harddrive and clean out the temp folders, and all the junk.

You're clean. Whatever malware remains is dormant, to the best of your/our knowledge. Now, make sure too keep it clean.


As far as svchost goes... what it does it provides a platform for .dll based services to run.
for more info check out: svchost.exe thread.

No Question is Dumb....
I have been using Lavasoft Ad-Aware for the last several years
http://files.lavasoft.us as well as Spybot Remover....
Use both to cross check your self.....

And I have used "Hi-Jack This" when the spyware/malware
problem is a stinker...... but I do not reconmend it for "Kindergarden" users
It can cause more damage than help....

More and more Malware programs out there are becoming a big headache
especially if it is from a 'Wares" site or a P2P program used to get
wares.... Now the Red Light District of the net is causing more problems
with Sites that install software that you do not need or use....
Ad this includes Trojan's with little mail programs in them to
be used to send out spam from un-supecting infected users....
And the problems are getting worse.....

Well... most of these problems are due to ActiveX and other "features" of IE, supposively, the next version of IE is going to curtail alot of the possibilities for "drive-by" installs, along with tabbed browsing.

As is stated before in this post, the reason that items cant be removed at that point in time is that they are probably in use and as a standard rule of thumb, you cant remove a file or program if it is in use. As d0pp stated, yes it all depends on the skill level of the user and the comprehensive functionality of the software.