# Evil spyware death! **URL:** \ **Category:** Factual Questions\ **Created:** [February 1, 2005, 2:44am UTC](https://boards.straightdope.com/t/evil-spyware-death/287719 "2005-02-01T02:44:48Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![smiling\_bandit](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@smiling\_bandit](https://boards.straightdope.com/u/smiling_bandit)\ **Post date:** [February 1, 2005, 2:44am UTC](https://boards.straightdope.com/t/evil-spyware-death/287719/1 "2005-02-01T02:44:48Z")
I’ve sadly gotten spyware installed on my PC; Ad-Aware hasn’t taken care of everything. I’ve deleted a lot of stuff, but little bits keep appearing. Moreover, I keep getting pop-up ads that connect to the internet. How can I remove them? Here’s a list of a lot of the programs I think are suspicious. prutmct.exe alg.exe agrsmmsg.exe vmss.exe ccevtmgr.exe ccapp.exe ccsetmgr wsxscv.exe xhrmy.exe vttimer.exe wscntfy.exe lsass.exe csrss.exe alcxmntr.exe alcwzrd.exe kbd.exe hpsysdrv.exe jusched.exe mmups.exe Anyone have some hints? Another program? ---
**Author:** ![Duckster](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/duckster/32/1244_2.png) [@Duckster](https://boards.straightdope.com/u/Duckster)\ **Post date:** [February 1, 2005, 3:04am UTC](https://boards.straightdope.com/t/evil-spyware-death/287719/2 "2005-02-01T03:04:41Z")
No single anti-spy program has been proven to work all the time with all known spyware. Instead, the general recommendation is to install several different anti-spy tools and runn all of them consecutively. Read [Fred Langa’s latest newsletter](http://langa.com/newsletters/2005/2005-01-31.htm#4) where he talks about this very problem and the freeware tools he recommends to keep your spyware in check. One more thing. Dump IE for Mozilla or Firefox, and dump Outlook for Thunderbird. ---
**Author:** ![Mr.Blue\_Sky](https://avatars.discourse-cdn.com/v4/letter/m/d26b3c/32.png) [@Mr.Blue\_Sky](https://boards.straightdope.com/u/Mr.Blue_Sky)\ **Post date:** [February 1, 2005, 3:12am UTC](https://boards.straightdope.com/t/evil-spyware-death/287719/3 "2005-02-01T03:12:40Z")
Go [here](http://www.answersthatwork.com/) and click on “Task List”. It has a detailed list of programs that run in the background. It will tell you they are legit or not. Compare the list you gave to the entries. ---
**Author:** ![smiling\_bandit](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@smiling\_bandit](https://boards.straightdope.com/u/smiling_bandit)\ **Post date:** [February 1, 2005, 7:21pm UTC](https://boards.straightdope.com/t/evil-spyware-death/287719/4 "2005-02-01T19:21:37Z")
> [@](#): > > One more thing. Dump IE for Mozilla or Firefox, and dump Outlook for Thunderbird. Don’t use outlook or any email program. I use webmail. I’ve considered moving browsers before, but i dislike the idea. In any event, I’ve never had any spyware problems from the browser itself, only because I foolishly trusted the wrong program. ---
**Author:** ![yoyodyne](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yoyodyne](https://boards.straightdope.com/u/yoyodyne)\ **Post date:** [February 1, 2005, 9:37pm UTC](https://boards.straightdope.com/t/evil-spyware-death/287719/5 "2005-02-01T21:37:37Z")
Give the Microsoft [program](http://www.microsoft.com/downloads/details.aspx?FamilyID=321cd7a2-6a57-4c57-a8bd-dbf62eda9671&displaylang=en&Hash=43G9DYB) a try. ---
**Author:** ![smiling\_bandit](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@smiling\_bandit](https://boards.straightdope.com/u/smiling_bandit)\ **Post date:** [February 1, 2005, 11:29pm UTC](https://boards.straightdope.com/t/evil-spyware-death/287719/6 "2005-02-01T23:29:50Z")
Got four program now. Hopefully one of them will get it! 🙂 ---
**Author:** ![Duck\_Duck\_Goose](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@Duck\_Duck\_Goose](https://boards.straightdope.com/u/Duck_Duck_Goose)\ **Post date:** [February 1, 2005, 11:36pm UTC](https://boards.straightdope.com/t/evil-spyware-death/287719/7 "2005-02-01T23:36:32Z")
I’ve got 5 things that help keep spyware off my computer: 1. Firefox _rules_. I’ve gotten maybe 4 tracking cookies installed on my 'puter since I started using Firefox, as opposed to dozens with IE. 2. Spybot and Adaware, working together. And be sure you check regularly for updates. 3. The Google Toolbar has a nifty popup blocker, which you won’t need if you have Firefox installed, as it blocks popups itself. 4. Javacool’s Spywareblaster, which is also free, and which blocks spyware from installing itself on your computer in the first place. Ditto on checking for updates regularly. 5. You can Edit Cookies to block malware if you run into something that Firefox can’t handle. I would also recommend that you go over to [http://www.spywareinfo.com/](http://www.spywareinfo.com/), where they have a nifty, very helpful forum where you can post results for your hijackthis log (they’ll explain it over there), and they will help you get the worst stuff off your computer. ---
**Author:** ![smiling\_bandit](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@smiling\_bandit](https://boards.straightdope.com/u/smiling_bandit)\ **Post date:** [February 2, 2005, 2:05pm UTC](https://boards.straightdope.com/t/evil-spyware-death/287719/8 "2005-02-02T14:05:34Z")
Thank.s I’m really worried about prutmct.exe ; this one can mess with my anti-spyware tools, and I think it may be preventing me from getting rid of them all. It won’t go away, thogh the microsoft version did pick it up and try to erase it. WHat’s the command to edit the programs that start up with your PC and run only in the background manually? Don’t tell me “the startup folder” or I’ll slap you! ---
**Author:** ![JohnClay](https://avatars.discourse-cdn.com/v4/letter/j/c37758/32.png) [@JohnClay](https://boards.straightdope.com/u/JohnClay)\ **Post date:** [February 2, 2005, 2:39pm UTC](https://boards.straightdope.com/t/evil-spyware-death/287719/9 "2005-02-02T14:39:08Z")
> [@smiling bandit](#): > > Thank.s I’m really worried about prutmct.exe ; this one can mess with my anti-spyware tools, and I think it may be preventing me from getting rid of them all. It won’t go away, thogh the microsoft version did pick it up and try to erase it. WHat’s the command to edit the programs that start up with your PC and run only in the background manually? > > Don’t tell me “the startup folder” or I’ll slap you! msconfig Spybot also lets you edit what programs are automatically run (when you use the advanced mode) BTW, in the recent version of spybot the DSO exploit doesn’t get fixed due to a bug but they’re going to fix it. You can make spybot ignore the problem, and recent Windows updates aren’t vulnerable to that exploit anyway. Spybot also lets you “immunize” against lots of spyware/malware/etc. BTW, you can do google searches for individual files e.g. “prutmct.exe” Also you can search and find the files on your computer and right-click and go to properties and the “Version” and “Digital Signatures” tags. In “Version” there are lots of sections such as “Company”. You can also disable programs and entire directories in a crude way - just rename them. e.g. c:\Program Files\TheFolder becomes c:\Program Files------TheFolder (that’s a simple way of stopping msmessenger starting up when outlook or your computer starts up). Of course, you should try and uninstall programs if you don’t want them though sometimes that is difficult to do. ---
**Author:** ![Duck\_Duck\_Goose](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@Duck\_Duck\_Goose](https://boards.straightdope.com/u/Duck_Duck_Goose)\ **Post date:** [February 2, 2005, 3:01pm UTC](https://boards.straightdope.com/t/evil-spyware-death/287719/10 "2005-02-02T15:01:45Z")
Before you start puttering around with msconfig, I’d _really_ strongly urge you to go over to [spywareinfo.com](http://spywareinfo.com), register at their forums, and drop your problem in their lap. They really have some phenomenally dedicated people there who really can help. If you delete the wrong thing using msconfig, you screw your entire computer, lose all your daughter’s Dollz and your son’s Harry Potter fanfiction, and have to leave home forever. ---
**Author:** ![NutMagnet](https://avatars.discourse-cdn.com/v4/letter/n/ea5d25/32.png) [@NutMagnet](https://boards.straightdope.com/u/NutMagnet)\ **Post date:** [February 2, 2005, 3:31pm UTC](https://boards.straightdope.com/t/evil-spyware-death/287719/11 "2005-02-02T15:31:13Z")
**John Clay** (or anyone). What is the Win2000 equivalent of msconfig? I’m switching all my '98 machines to W2K and the install removes it. I can get msconfig to run on W2K (with some errors), but I’m sure there must be an equivalent. ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [February 2, 2005, 5:22pm UTC](https://boards.straightdope.com/t/evil-spyware-death/287719/12 "2005-02-02T17:22:11Z")
> [@Duck Duck Goose](#): > > If you delete the wrong thing using msconfig, you screw your entire computer, lose all your daughter’s Dollz and your son’s Harry Potter fanfiction, and have to leave home forever. This is not as dangerous as you make it sound. Modifying the startup folder from msconfig merely tells Windows to not start the programs you deselect. Nothing is deleted, and if you accidentally turn off something you later find is necessary, you can go back into msconfig and turn it back on just by selecting it again. You can turn off everything in the msconfig startup folder, and Windows will run. That is essentially what happens when you boot into Safe Mode (among other things like device drivers that are not loaded). ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [February 2, 2005, 5:32pm UTC](https://boards.straightdope.com/t/evil-spyware-death/287719/13 "2005-02-02T17:32:41Z")
> [@NutMagnet](#): > > **John Clay** (or anyone). What is the Win2000 equivalent of msconfig? I’m switching all my '98 machines to W2K and the install removes it. I can get msconfig to run on W2K (with some errors), but I’m sure there must be an equivalent. Surprisingly, there isn’t. However the msconfig program from WinXP runs well under Win2000. You can download it [here](http://www.perfectdrivers.com/howto/msconfig.html). ---
**Author:** ![smiling\_bandit](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@smiling\_bandit](https://boards.straightdope.com/u/smiling_bandit)\ **Post date:** [February 2, 2005, 9:32pm UTC](https://boards.straightdope.com/t/evil-spyware-death/287719/14 "2005-02-02T21:32:39Z")
> [@](#): > > If you delete the wrong thing using msconfig, you screw your entire computer, lose all your daughter’s Dollz and your son’s Harry Potter fanfiction, and have to leave home forever. I know how to use it; I just couldn’t remember th darn command name. It’s been a while since I was in tech supp. > [@](#): > > BTW, you can do google searches for individual files e.g. > “prutmct.exe” I’ve tried. This damned program just won’t quite. I’ve deleted its registry key, shut it out of startup, and tried to close it. Nada. I can’t force it to end running because it keep auto-respawning as a process. Anyone know a sure-fire way to force a program to stop runnng? I bet if I delete it, the reg key, and cancel the startup file it will be gone. And three separate anti-spy programs have mised it. I’m running few things as I type this, to try and eliminate any underlying flaws, too. “escan” is picking out any viruses that Norton missed. ---
**Author:** ![Myglaren](https://avatars.discourse-cdn.com/v4/letter/m/f1d935/32.png) [@Myglaren](https://boards.straightdope.com/u/Myglaren)\ **Post date:** [February 2, 2005, 10:03pm UTC](https://boards.straightdope.com/t/evil-spyware-death/287719/15 "2005-02-02T22:03:12Z")
Spybot’s advanced mode tools will allow you to do anything that msconfig will do and will also indicate the functions of various progs to help you in your selection of which ones to prevent from starting, when you are satisfied that they are of no use to you or are actually harmful, you can delete them there too. ---
**Author:** ![NutMagnet](https://avatars.discourse-cdn.com/v4/letter/n/ea5d25/32.png) [@NutMagnet](https://boards.straightdope.com/u/NutMagnet)\ **Post date:** [February 3, 2005, 11:51am UTC](https://boards.straightdope.com/t/evil-spyware-death/287719/16 "2005-02-03T11:51:13Z")
**Fear Itself** Thanks for the link! **myglaren** Thanks! Who knew?