thorough CLSID scanning?

[Guest]

Hi all,
Is there a utlity for XPpro that specifically scans the registry for
unwanted clsid's? I recently was infected by the Vundo variant and noticed
that the usual scanning by adaware, spybot and ccleaner doesn't always
detects certain clsid's and bho's. I was just wondering if there is a
specific scanner thats thorough in finding [clsid's in particular] that other
scanners don't. Thanks for any suggestions.

 

[Rock]

Hi all,
Is there a utlity for XPpro that specifically scans the registry for
unwanted clsid's? I recently was infected by the Vundo variant and
noticed
that the usual scanning by adaware, spybot and ccleaner doesn't always
detects certain clsid's and bho's. I was just wondering if there is a
specific scanner thats thorough in finding [clsid's in particular] that
other
scanners don't. Thanks for any suggestions.

See this link and scroll down to Winfixer (Vundo)
http://www.elephantboycomputers.com/page2.html#Removing_Malware

 

[cquirke (MVP Windows shell/user)]

On Thu, 28 Sep 2006 13:50:01 -0700, Speedy G.

Is there a utlity for XPpro that specifically scans the registry for
unwanted clsid's?

I use Nirsoft's RegScanner to search for a sting and list all found
entries, from which they can be Regedited. I'm less keep in blind
S&R, as it's easy to go wrong - e.g. the classic...
- make all of A to be B
- make all of B to be A
- hey, why are there no B anywhere anymore?

I recently was infected by the Vundo variant and noticed that
the usual scanning by adaware, spybot and ccleaner doesn't always
detects certain clsid's and bho's. I was just wondering if there is a
specific scanner thats thorough in finding [clsid's in particular] that other
scanners don't. Thanks for any suggestions.

I use the above, from Bart CDR boot, as redirected by the RunScanner
plugin. Important tip: You must launch both Regedit and RegScanner
each via RunScanner, before using RegScanner - else RegScanner will
spawn an un-reidirected Regedit, and that won't work well at all.

Google( Bart PE )
Google( RunScanner )
Google( Nirsoft RegScanner ) or go www.nirsoft.net (avoid .com site!)

------------ ----- --- -- - - - -

Drugs are usually safe. Inject? (Y/n)