I apologize for the length.
Some general information to start:
I’m running Windows XP SP2, and browsing with IE 6.0 (no drive-bys please; I use Firefox sometimes, and may consider it more heavily in the future). I update and run regularly Spybot S&D, SpywareBlaster, Ad-Aware 6, Norton Anti-Virus, and the ZoneAlarm firewall. I also make an occasional visit to Trend Micro, Trojanscan.com. and Pestscan.com. The latter of which is where I begin my tale.
I was running Pestscan last night after finding some junk on my system a few months ago. Since then, I have coupled occasional visits to Pestscan.com along with my usual anti-scumware battery as mentioned. I have been clean for a while (as well as running my anti-scumware programs to the hilt, scanning for virii nightly, etc.), which is why I was slightly surprised to find “System Spy - Key Logger” and “Fake CD .99 - Cracking Tool” as found within the status window.
Instead of buying the program they sell to detect and remove all of this stuff, they give you instructions on how to manually remove it by identifying the offending registry key or listing the location of the offending file, features which I have used in the past with good success.
However, my other programs do not find any trace of this whatsoever. Upon manually looking for the registry key, it lists:
hkey_local_machine\software\microsoft\internet explorer\main
I have managed to delete this key, and a subsequent scan reveals nothing. However, a scan after that reveals that the stinkin’ thing came back and I’m back to square one.
I have looked at all of the possible registry keys, locations, running processes, etc. to check (as listed at the diagnostic links [eTrust Pest Patrol Encyclopedia] provided at Pestscan), and I found nothing that matched. I attempted to unregister a DLL, but the file wasn’t found—which I presume to mean “I don’t have it”?
I have tried deleted the offending registry entry in Safe Mode. That didn’t work.
Also, I ran a trojan portscan (and a couple others) at Sygate for good measure; every one was “blocked”, which apparently is ideal.
I have downloaded Task Manager 16, a program that promises to look deep into running processes. Every running process came listed as “harmless” or “seems to be harmless”, with nothing apparently suspicious.
I’d love to try MooSoft’s Cleaner, but I have already used the trial version in the past.
I do remember seeing that System Spy doesn’t run on XP—could this be taken to mean that it wouldn’t work as a key logger on my machine as well?
Basically, my question asks of how to remove these obviously regenerating files. I’m considering the purchase of Pest Patrol as offered at Pestscan.com, but since money is something of an object these days, I would like to exhaust all avenues in the case that this isn’t a large problem (due to possible incompatibility) as may be suspected.
Again, all other programs (my anti-virus, anti-scumware programs) do not detect these issues.
Many thanks for any help or advice that is provided.
