Helpful Spyware Resources

shwaip

When you run HijackThis, you will receive some output that is sometimes difficult to understand, or even plain confusing. Check out this site to help decipher those logs.
Spywareinfo.com HJT Tutorial

What is a BHO?
Often times, you will see the abbreviation BHO. Ever wonder what it means? Mr. Kwitko explains it here:

A browser helper object (BHO) is a small app that loads every time you start your browser. Many BHOs are legitimate and useful (Google toolbar, for example), but many are used by [spy|ad|mal]ware, like Omegasearch.

Now that you've got some background as to what you're looking at in a log, check out some of the entries at the following websites:
Browser Helper Object listings
Browser Helper Object (BHO) Listing at generation.net

Another BHO listing, provided by Computer Cops
http://computercops.biz/CLSID.html

Windows Process Listings
Often times, malware is disguised as a Windows process by mimicking a legitimate process' name. If you ever have any processes that you do not recognize, you can always check them at one of the following links:

A listing and definition of common Windows processes, including those which are unnecessary as well as spyware.
WindowsStartup.com

Another listing, similar to WindowsStartupOnline, provided by kephyr.com
http://www.kephyr.com/filedb/index.php

Yet another listing, provided by pestpatrol.com.
http://www.pestpatrol.com/Search/default.asp

A very large list of Windows processes, provided by sysinfo.org
http://www.sysinfo.org/startuplist.php
This site is often over its limits, and will therefore be unavailable

Hopefully these links will be helpful, but don't worry about simply posting a HijackThis log and asking politely for help if you can't find something, or aren't sure about an entry.




Fake / Bogus / Not Recommended Anti-Spyware Programs

There are numerous fake free and paid anti-spyware application out there. Some are outright scams - they do not protect you well, and give "false positive" detections but tell you that you need to upgrade to the full paid version to remove the threat. Don't be fooled by bogus apps. There is a very comprehensive list here:

http://www.spywarewarrior.com/rogue_anti-spyware.htm

If you have any questions about a program's legitimacy, feel free to ask in our General Security Discussion Forum.


If you have any suggestions for addition to this resources page, send a PM to any of the SVT Moderators, and we'll get it added.

MERRICK

Very Good, recent (October 4th-9th) and far reaching Anti-spyware comparison chart, testing details explained:

http://spywarewarrior.com/asw-test-guide.htm

http://spywarewarrior.com/asw-test-results-1.htm

http://spywarewarrior.com/asw-test-results-2.htm

http://spywarewarrior.com/asw-test-results-3.htm

http://spywarewarrior.com/asw-test-results-4.htm

primesuspect

Eric is doing a great service to the internet community. One thing that his test reveals though, is two very important bits:

1) No single spyware app will get rid of all the spyware. You need a cocktail of several apps.

2) None of the tests involved the very worst spyware: CWS (which includes Home Search Assistant and OmegaSearch).

MERRICK

It seems that the spyware bugs are well documented on the internet. The disparity between what companies find what seems to be kinda wide. I'd normally presume that the anti-spyware programers would just write in the needed code for their particular program even if they "barrowed" off of each other. I wonder why.

Missileman

Found this earlier. IamnotaGeek has a searchable database with info on a LOT of startup processes and it's growing.

http://startup.iamnotageek.com/

I thought it might be useful to you "Spyhunters"

Just FYI