Spyware detected and removed, but comes back

[Don Crooks]

Hi,
I am running Beta 1 of the product and it did a great job
of detecting spyware on my system. I cleaned up my
system, but then the next day I noticed the same spyware
back that was detected the day before.

In the past, I have been working with spybot search and
destry which has an immunize feature. With that feature,
as long as it has removed the spyware before, it keeps it
from getting you again.

Is there a setting in the Microsoft product that has the
same effect? I am running all of the real-time
protection agents.

Thanks,
-Don

 

[Andre Da Costa]

Did you do a full system scan, restart the computer in safe mode. Open
Microsoft AntiSpyware, on the scan page, choose scan options > Full System
Scan > (check all boxes below) > click "Run Scan Now".

Restart in safe mode instructions:
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/boot_failsafe.mspx

 

[Alan]

One thing you might want to do is run another scan and
see what it detects and then go to the prefetch folder,
c:\windows\prefetch, and see if any of those programs are
located in the folder. Make certain to read the full
file name. Even with immunize turned on in spybot, you
can still get infected. When I launched IE, I still got
infected because the problem was located on my system,
not coming from the outside (i.e. the internet). You
could also take everything in the prefetch folder and
delete or shred (more secure) them. However, the
prefetch folder is used by the .NET Framework as
precompiled code that if a certain action is requested,
that code runs, allowing the overall compiled program to
be smaller in size.

Another thing to consider is running a firewall if you
currently aren't doing so. Once you connect to the web,
you can get re-infected if you aren't running one, or if
it isn't properly configured.

Alan