Need Help!

[FP-WWIII]

Hello,

I was doing a scan to my port at http://scan.sygate.com/
and i found out that.. behold... i am infected with a window monitor called WIN-SPY.

Now, i have no clue how in the world this window monitor got into my computer. I found some information about it, and they say, that only the person who put it there, can install it or uninstall it, and only him/her has adminstrator access to it. Basically, i won't have an evidence of its existence.

Well i only found out about it, through the sygate scan.
I need help, how can i delete this window monitor or stop it from monitoring me?

And by the way, why people make these crazy programs?? This is an invasion of privacy!!!!!!!!!!!!

[VictorKaum]

FP-WWIII,

This WIN-SPY prog is a commercial thing, used by parents, partners, bosses to monitor kids, employes...etc.
So someone you know has installed this thing on your desktop.
The person can even monitor that you posted this thread...

Here is the link to the software company:

http://www.win-spy.com/


and yes, it's a privacy invasion.


First way to stop it monitoring you is:

You can not delete the win-spy thing without providing a password when it runs so we need to go around that. Restart your pc and boot up with a bootable disk (whitout win-spy), search for the files (on your HDD) made by win-spy and the registery edits made by win-spy, delete the files and restore / hack the registery to its status before winspy. Delete the screenshots win-spy made.
Attention these files and folders are HIDDEN so you need the DOS command attrib to reset the HIDDEN status so you can see them.
Now you can restart without bootdisk -> Win-Spy is disabled.

How to find out which files win-spy uses? Take a spare computer (like an old 80486) and clean it with format c: /s now you have an empty system, install Windows, and Norton 2001 with cleansweep, now install win-spy on it (with you as admin). Cleansweep will monitor the installation process of WIN-SPY, so you know which files are used by win-spy. Go delete these on your original box as I described above.

Succes

[FP-WWIII]

Originally posted by VictorKaum

You can not delete the win-spy thing without providing a password when it runs so we need to go around that. Restart your pc and boot up with a bootable disk (whitout win-spy), search for the files (on your HDD) made by win-spy and the registery edits made by win-spy, delete the files and restore / hack the registery to its status before winspy. Delete the screenshots win-spy made.

Attention these files and folders are HIDDEN so you need the DOS command attrib to reset the HIDDEN status so you can see them.

Hello VictorKaum,

Thanks for your help

Ok i am not an expert in computers. However i appreciate your input. Ok, i have few questions about the process of disabling WIN-SPY and deleting its files
==============================================
1- If i go to the System Configuration Utility, and check out the Startup Programs under there, would i be able to find it? If i do, would it be enough to uncheck WIN-SPY from there, in order to disable it from running on Startup?

2- How can i restore the registry to its status before WIN-SPY was installed? Is that done only by applying the Registry Checker?
Or is this done through using something like Norton Registry Tracker?

3- How can i reset a hidden file so it would be seen? You said, i should be able to do this through the DOS Command attribute. If it is not a problem, could you explain this a bit more?

4- The Registery key[My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] Would this registry key show any trace of WIN-SPY?
==============================================

Ok i really appreciate your help on this matter, and I appreciate any other inputs or discussion from everyone about this WIN-SPY program. Thanks a lot.