Archive for the 'Spyware' Category


Cleaning up after WMF exploit third party boot disc

Thursday, December 29th, 2005

At this point, I needed to rename or delete some files that windows would not let me touch. I had this winlogon.exe running from a suspect directory c:\windows\inet20001 and windows wouldn’t let me kill it, or remove it’s start entry in the registry. So, I booted my image from a dsl linux cd and opted […]

Removing items from MSCONFIG after WMF exploit

Thursday, December 29th, 2005

OK, so, I’m busy killing off running processes and fire up MSConfig to try to keep them from coming back on the next boot. To launch msconfig go to start, run… type in msconfig and click ok. The startup tab is where we’re looking for programs running at startup (makes sense…) This is a bit […]

Task Manager Suspicious Processes after WMF exploit

Thursday, December 29th, 2005

After getting into Task Manager I saw a number of suspicious processes. There were a lot of things running as my user that I didn’t recognize. kernels64.exe, vxgame6.exe, vxgame4.exe, mm4.exe, vxh8jkdq2.exe, netsh.exe, cmd.exe, winstall.exe, vxgamet4.exe, vxgame2.exe covers most of the list of suspect entries. netsh and cmd are both legit programs, but were likely being […]

Task manager has been disabled by your administrator

Thursday, December 29th, 2005

The first problem I ran into in cleaning up after my infested Windows XP image was this error message. One of the first things I do in cleaning an infested system is try to kill off running process that look suspect (or at least identify them.) On using ctrl-alt-delete I got the message “Task manager […]

Keeping the new PC spyware free

Wednesday, December 28th, 2005

Spyware Confidential has the top 10 tips to keep that new pc spyware free. Some good tips here and these should be on the checklist when setting up a new pc any time of the year… Paraphrased here….    Send article as PDF   

A Tip for cleaning up an infected PC

Sunday, December 25th, 2005

There’s a joke that many people bring out when new Windows viruses hit big…. it goes along the lines of, “download a fix here” and the link points to a knoppix linux livecd download, or a Mandriva download disk, fedora/etc… Some say linux isn’t affected by as many viruses because it lacks market share, I […]

Disinfecting a PC… part 11

Saturday, December 24th, 2005

All in all, what I’ve documented was a bit over three hours worth of attention to the machine (much more for the full scans, but I didn’t have to stand and watch them.) I didn’t document a sidetrip to a second antivirus scanner. It’s nice to see a system cleaned up that had been so […]

Disinfecting a PC… part 10

Friday, December 23rd, 2005

Before I get things wrapped up, I like to scan rinse and repeat until the scans come up clean. So, this scan of AVG gives a chance to delete the archive entry I mentioned the first pass it took. And spybot get’s updated from the internet and re-runs. All looks clean there… Ad-aware get’s an […]

Disinfecting a PC… part 9

Thursday, December 22nd, 2005

Ok – about 22 or 23 critical updates for Windows ME. I’m suspecting it’s never visited the Windows update site. While it’s going I make sure that the adware scanners and antivirus scanner get to pull updates from the web as well. It’s also time to scan for running network services that shouldn’t be running. […]

Spyaxe Spytrooper spysherriff et al removal

Wednesday, December 21st, 2005

There are so many “wolves in sheeps clothing” or maybe I should say wolves in sheepdogs clothing… Anyway, so many nasty malware’s that pose as protective utilities. Spyaxe, spytrooper, spy sherriff, etc. There is a tool that is specialized towards removing these. Smitrem which is short for smitfraud removal. (After the viral name of one […]

Google
 
Web www.averyjparker.com