How to Find Spyware with File Search Tool
Why is it important to delete Spyware Programs?
Spyware can infect your computer and compromise your privacy, security and computer performance. Spyware is constanly changing and can infect your computer without you even being aware of it. Spyware can install onto your computer and gain access to sentitive information like your passwords, credi card numbers and emails. Spyware is very difficult to detect and remove so trying to uninstall it can prove to be a huge undertaking.
If you suspect that your computer is infected with spyware, the best advice is to remove the spyware IMMEDIATELY before it exposes your computer to other unwanted programs such as adware, malware, trojans and hijackers.
Windows includes an effective search tool that may help you to find spyware files and folders on your computer. Windows File Search Tool is easy to use and navigate, giving you many options to choose according to what you want to find. You are able to choose particular areas to look on your computer that will make the searching for spyware faster.
Learn how to find unwanted spyware programs from your computer with Windows File Search Tool.
Find Spyware Programs Manually
Warning: Manually searching for files of a spyware program is a difficult and risky. If you delete the wrong file, your computer may crash and important data may be lost. As precautionary measure, please back up important files and set a System Restore point (click Start > All Programs > Accessories > System Tools > System Restore, and follow the on-screen instructions) or run a spyware check with a trusted anti-spyware program to automatically detect spyware.
Follow the steps below to search for spyware files or folders.
- Click the “Start” button and then select the “Search” option.
- The Search window will be launched. On the left side of the “Search” window, you will see a separate section which is called the “Search Companion”.
- If you want to perform the search for all available computer files and folders, click on “All Files or Folders”.
- You have several preferences under “All Files or Folders”. For example, you are able to search for files or folders according to their name, a separate word or phrase in the file, the drive where the file is placed, or any combination of the three.
- “Search Companion” is designed to look through your hard drive. If you want to search in a different location, click on the down arrow below the “Look in” section. This action will show you the variety of folders, and disks where you can perform your search. Click on the drive, folder, or disk you wish to perform a search. For better results, it is recommended that you select “Look in: Local Hard Drives” or “Look in: My Computer”.
- If you want to perform a more sophisticated search, go to the “More Advanced Options” section.
- If you know the exact type of file that you are looking for, click the down arrow under “Type of File”. This action will display a list of all available files. To choose the preffered type, use your scroll button and search for the type of file you are looking for and click the file type.
- Click on the “Search” button to start the search. You will be able to see a summary of your search criteria as Windows looks for your parasite file(s).
- When your search finishes, you will see all of the files that are related to the parasite. The results will be seen on the right side of the “Search” window.
- Right-click on the files that you want to delete and select “Delete”. Otherwise, you can select the files and press the “Delete” button on your keyboard.
Posted: June 6, 2006 | By SpywareRemove
MoreRate this article:
(No Ratings Yet)
Loading ...
Jack or anyone,have you found how to get rid of win32/adware.virtumonde virus yet? if so,tell me please
i’m so annoyed of it
HI, my friend has the spyware antivirus 2008 pro on her computer since june 18th 2008. Her brother had removed her virus scan, the dvd-r burner drive and her microsoft office as well as other things trying to be mean. I tried to help her by search for it by name but on got the shortcuts. At this point I can’t access her c drive or the removable drive, which only play and reads music CDs now because of the spyware. Also VIRUS ALERT! display where the date should be and the time stay in military time only. The spyware is hiding crucial hard drives needed to find and eliminate this problem. Even in safe mode the VIRUS ALERT! display where the date should be still keeps appearing. She can’t even access the internet anymore since her icons are hidden.
PLEASE HELP!!! Can her comp still be saved without a reboot. She can’t even system restore since they are all infected with the virus dating back to June.
i found antispywaremaster in my search but how do i get it deleted??????
I Connnot FinD Trojan-PSW.Win32.OnlineGames.aojv trojan in my Files And Folders
I cannot get win32/adware.virtumonde virus off my computer HELP
I don’t know what happened exactly because I’ve always been very careful about what I downloaded and I tried to scan my computer at least once a day if possible, but now I’m infected. I have Virtumonde! I’ve tried deleting it so many times I’ve lost count and I’ve tried going in and looking through my computer looking for where it could be, but I’ve never had any luck in finding it. Ever since I got infected, I’ve been bombarded by Trojan Horses and Pop-up ads. It’s even getting to the point where when I type, it’ll skip over words so I can’t type fast or else it won’t come up. This computer isn’t very old – maybe five months – and I’m so upset that I let my computer get infected. I’m desperate for help. How do I get rid of this and get my computer back to normal?! It’s SO ANNOYING!!
And if it matters, I have Webroot Spy Sweeper and Tendro Micro PC-Cillin Internet Security 14.
i tried the steps and the comp says that it will only delete the icon. wats the difference
and im going up against vista antivirus 2008
THe files in question PCprivacycleaner were found as described but filed refused to delete.I am asked to go to the control panel but there not there.Please help
This is defianately a pain in the nose kinda program. Even if you restore a backup this puppy will come back to haunt you in 1 out of the 4 cases I’ve worked with. I don’t like formatting a computer because a persons information and such is on it. so I copy to a safe disk , if I can and if all executables aren’t infected yet. Then I do full format and reinstall . AVG 8.0 has worked effectively against this as does spybot and ad-aware will search and keep it from doing too much more. but sadly the last one I worked on even infected the command.com file so I needed to reformat it from the windows disk and not from the restore programs on the computer. Sorry people this one seems to be a well written one. May the person who did this really get theirs in the end.
I did not accidentally download this program, but I do have a flashing icon on my taskbar that I cannot get rid of. I ran my Spy Sweeper, and removed everything, and even followed the instructions to search for this file and cannot find anywhere. Does anyone know how to remove this icon from my taskbar????
Tony, I’m battling the virtumonde virus ight now as well and I’m SUPER good at removing malware/trojans/virus’ etc. This is the WORST one I’ve ever had in 5 years! You have to get either couterspy, spyware doctor od something to FIND it ok. You can also look for 3 programs. vundoFix (which needs to run FROM the root directory!! so just place it there when you download it), get virtumondobegone and mbam setup (malwarebytes antispyware. Run the spyware doctor or your antivirus to LOCATE it., copy it in the notepad and save so you’ll know where the LAST infection was. Use ALL those in normal mode first. after you rid yourself of it., I believe the vundofix will tell you to reboot. Do that, run it again. your computer should start running better immediately. Then reboot in SAFE Mode, do it again to catch it. It might tell you its not recommended, but you need to do that Tony. Then, reboot. This time before you reboot, those files and pathnames you copied in the notepad write down ok and add any other files to the list. Reboot to the the safe mode command prompt and look for those file. all of them! If you dont nkow DOS commands let me know or try a search because you’ll need a few, search, delete the files. if they arent there when you search thats a good thing. otherwise, delete manually. after you’re done reboot and’l you’ll be good. poblem is finding the root file that tis self replicatnig itself. That i haven’t found but im working on it. But itll allow you to use your computer and internet. get all the updates, update java o the lastest version!!!!!!!!! if you dont is still vulnerable. java is at 6.0 oe so. get back to me with questions. ive been doing tis along time. over 12 years, and thi one is the only one that i haven licked but when i o, ill give you the exact iles where i fiund it it ok. let me know
hi..i’m from malaysia..i feel so many sad because my computer already hacked by somebody…when i online i see this pop up message always and it disturb me..also got malware
Your computer is being attacked from Internet.It could be a password-stealling attack, a trojan-dropper and so on.
Attack from:29.67.18.95, port 42360
Attack port :54283
Threat : hacker.ag
i got that xpantivirus pop up so my computer was acting up so i paid for the download and i didn’t get anything now they got my money and i go no service from them how can i get my money back? what do i do about the viruses now
I have a promblem with kmv secure I know it is a parasite. I tried calling thier custormer support system and the guy told me someone was using them as a virus but I directly got thier number from the pop up……anyway…..I’ve tried manually to get rid of it it only found one file and I deleted it, I also got a anitspyware protection called shield deluxe 2008 it found it and knows that it’s a virus but can’t get rid of it what can I do to get rid of this promblem thanks
I’ve got Vundo on my computer, Windows File Search Tool doesn’t find any files related to it at all. I am unable to delete the infected DLL since it starts working when winlogon.exe does.
I am more than able to delete any registry values the trojan plants. I run Exterminate It! scans, and it finds what I’m after, but, as a trial version, it can’t touch them. If I end the “winlogon” process, my computer restarts so that does no good. I can’t stop “explorer.exe” (which is also susceptible to the trojan) or I would be unable to access any files.
What the hell do I do?
/Tony
My computers been infected with a rogue anti spyware program call Antispywaremaster, I am horrible with compters and have been unabel to located it with spy ware programs or manually to remove it. Any ideas?
hello like my computer have virus and i dont know how to remove it i scan it and i just cant find any virus but my computer always say that i have virus and my speed is slow down aswell and some time some of my windows or files on botten of this are always flish it those thing only happen when there are lag but my computer always happen now i dont know why can you fix this thing
well this is the second or third time i ran into awola on my computer. I simply did a search and deleted everything but now its back. Now that i know it is a fake company I am really trying about it appears to keep coming back. Now my computer isn’t functioning correctly at all and I’m starting to think that awola might be behind it, I can’t even open my Add/Remove Programs window.
hi here again!
sorry, but to help the message i just left above, my computer has completely FROZEN i can’t download ANY virus protection programs whatsoever because of the infostealer virus. i can’t locate the virus at all. none of the shortcuts on the desktop show up- basically the background is the same but without the shortcuts. i haven’t been able to access anything except quarantine but that is now useless. i can’t find the file with the virus so i can’t quarantine it. however i still know that there is a virus because all the many problems
i hope that could clarify any problems!
okay
so i’ve gotten the infostealer virus (by the way, what does it do?), and i can’t find the file that has it. I know i have it because when i tried to quarantine (norton anti-virus) the file it said it did. the file however is now gone from the quarantine (i accidently restored it without reparing it), but i know that the virus is still there because none of the desktop images show up, and is incredibly slow. i can’t find the file, i can’t scan the computer, and i can’t do anything at all! tell me how can i get rid of this nuisance?!
please help me!
Im on metal of honor and someone put a hack and spam on me –that says—- im a wallhack kick me—-plus i cant shoot any more cause every time i shoot –that say come up –pl help me
Hi,
I have been reading these messages and I have so many trojans and malwares loaded my system I can’t do anything. I have spent at least 24 hours in total trying to get rid of them. I brought a software yesterday but I still have these problems. I figured out last night I have to manually delete them but what do I do with the ones that say I cannot delete them. I am going to try the regedit process because I get that error too.
I just wanted to say this is a helpful sight.
Thanks.
Help >,
This error may occur if there are incorrect references to shared folders in the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Lanmanserver\Shares
It may also occur if a stale security value is left for shares that no longer exist under the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Shares\Security
Back up the registry before you modify it. If any problem occurs you can restore the registry.
To solve your problem:
1 ) Restart the computer > Press F8 (when you receive the “Please select the operating system to start” message)
2 ) On Windows Advanced Options menu > select Safe Mode > press ENTER
3 ) Select Microsoft Windows 2000 > press ENTER.
*If you are running other operating systems on the computer.
4 ) Click Start > Run > type regedit in the Open box > press ENTER
5 ) Locate > click HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Shares
6 ) On the Registry menu > click Export Registry File > In the File name box > type Shares_RegKey > click Save
7 ) *The Data column must contain the paths to shared folders. For each value, use Windows Explorer to make sure that the path displayed represents an existing shared folder.
8 ) Delete all values that do not belong to shared folders
9 ) Quit Registry Editor > restart the computer
jezz12,
Files related to spyware are regenerating themselves very often and it may be very hard to remove them from your computer. If you’re having full SpyHunter version, you should contact our support team and they will solve your problems.
hey i have problem wif service.exe
C:\WINNT\system32\services.exe
error #
-1073740972
it says.. 60 seconds to shutdown, when that pop up comes out, i cant open or close anything… plz advise me >.
Hi. Im so frustrated. My windows security center kept showing bubbles in the bottom toolbar that said: my computer is threaten with “Win32.banker.fstrojan.spyagent.da”. And when I clicked on that bubble it directed me to google search result of spyware cleaner tools.
I tried scanning with a number of anti spyware, ie. spyware doctor, ad aware and spyhunter too, I also did it on safe mode, but the results did not show the said spyware my windows security claims.
I also tried searching for the file using windows file search tool as advised here: http://www.spywareremove.com/removetrojanspywin32bankerp_20dll.html, but still could not find it.
I cannot open my task manager either. I tried typing REGIDIT like you advised Jason above, still didnot work.
I am at my wits end. I donot want to reformat my computer if I can help it. But is there any other way???
cheers for your help.
John Okerson,
Zlob files are regenerating themselves very often and it may be very hard to remove this parasite from your computer. However, your solution may be here http://www.spywareremove.com/removeZlob.html
My computer is telling me that i am infected with the spyware Zlob and my search of my computer cannot find it. how can i find zlob and kill it.
lisa,
If sysmon.dll is present on your computer, you may have the discontinued commercial keylogging application known as System Spy installed. System Spy is designed to monitor your computer activity and probably send the recorded information to a remote hacker.
The most common spyware removal tactic is to uninstall System Spy by using the “Add/Remove Programs” utility. However, as there may still be hidden System Spy files, it’s possible that System Spy will reappear after reboot. Follow the System Spy detection and removal methods here http://spywareremove.com/removeSystemSpy.html
i downloaded a stealth keylogger and decided to get rid of it. well norton deleted the exe file to uninstall it and so im stuck with trying to get it off here. the site person is no help at all of course. but i know its still there because it is still logging where were going. i dont know if the file sysmon.dll should be deleted and i dont know where it has attached itself. help……..
eric,
To get rid of pmnli.dll try:
1) Windows Search > Search > pmnli.dll
*Locate Directory Path for pmnli.dll (usually found C:\WINDOWS\system32\) and save path or write it down.
2) Unregister pmnli.dll
*You may open the MS-Dos Prompt and locate pmnli.dll’s folder, then type regsvr32 /u [pmnli.dll] to unregister pmnli.dll.
3) Check that pmnli.dll process is not running under the task manager process tab.
4) Locate and delete pmnli.dll.
i have a trojan on my computer called “Troj/vitrum-gen” located in pmnli.dll ive tried the steps on this website to get rid of pmnli.dll and im stuck on the step where it says hover over the “in foler” and copy and paste it in the url adress. or something like that. ive searched for it and i only get one file that comes up is one file that says pmnli.dll and i cannot delete it because it’s being used by other applications or person. this virus is also infected in ilnmp.ini
i am in need of help!
keith,
Your solution may be here http://www.spywareremove.com/removeMirar.html
I just really need some help
I think I got this “mirar” virus from youtube, Ive also tried to destroy it on pskill but the software always fails to install, when ever i simply try to remove it in program files a pop up comes up for mirar unistall software and it tells me that mirar is not responsible for the pop ups that come up and they are grateful for my busness. I would try to destroy it in safemode but i cant seem to find instructions on how to do that
Saitosan87,
There are no guarantees that you will find any anti-spyware program that can detect and remove all the parasites on the Web because parasites are changing and creating new files.
Okay now I have deleted SpyShredder over five times now and it keeps coming back. When I do delete it the way you show it comes back when I start up my computer again. What do I do to completely delete it so when my computer starts up again it won’t be on my system.
You can scan your computer with our free scanner, which will find the infected files and show their locations. Afterward, boot your computer in Safe Mode and delete the infected files.
I was doing the spyshredder removal guide but I can’t find the spyshredder folder when I search. I know I have it (it constantly reminds me). Any solutions on how to find it?
Alan,
What a complicated situation. The only advice I can give you is to get a reliable anti-spyware/anti-virus software. Afterwards, she should use another computer to get the latest updates for this program (usually they are on the software page), because she can’t access the Internet from her computer, as I understood. And then she should install the updates on her computer, boot her system in Safe Mode and try to scan and remove the infected files.
Cher,
More information about WebCry you can find on http://www.spywareremove.com/removeWebcry.html . But it is most likely that you have got some trojan on your computer, which displays pop-ups that your computer is infected and suggests you to download WebCry. I advice you to scan your computer with our free scanner. It will find the infected files and show their locations. Then boot your computer in Safe Mode and delete the infected files. This should help you. Otherwise, the solution is to get a reliable anti-spyware program.
My Computer is driving me on edge.
1. This website Webcry or something keeps annoying me while trying to click on something in google. i can acces websites but only if i right click then open.
2. My computer keeps saying theres a trojan/ spyware , everyone is trying to advertise something to get rid of it which probably not work.
3. i’m only a kid so i can’t do by downloading something.
Please Please Please Please Please Please Please Please Please Please Please Help me! I’m so desperate i actually typed out the pleases.
My girlfriend appears to be infected with this trojan ” Backdoor.Win32.IRCBot.biq”.
Her copy of AVG antivrus popped up a msg saying she was infected with SHeur.aqih.
I have tried to find more info about this trojan on the net but have found very little on this beastie.
Apparently she can no longer connect to the internet with the infected machine.
Main problem is that I am in Australia and she is in Hong Kong, so I am unable to give her any real help.
Any info on this malignant trojan and removal or removal tool would be greatly appreciated.
She was infected through an email with picture attachment sent to her from a friend.
This friend was chatting with her on msn, but it wasn’t really her friend.
So it seems her msn was hacked as she contacted her friend who said that she didn’t send the email to her.
Sorry I can’t give you anymore info.
Anthony LoPresto,
You have to remove all the files which are starting when you boot your system and if you leave one of them, they are regenerating and comes back again. You can scan your computer with our free scanner or other anti-spyware programs to find all the infected files you have to remove. Afterwards boot your computer in Safe Mode and remove the infected files. Otherwise you have to get a reliable anti-spyware program.
I’m having trouble removing 2 viruses.. When I delete either one of them, they come right back. My HijackThis log shows them as activexds.exe, and asctrls.exe.. From what I understand it’s win32.agent. I would really appreciate any advice..
I’m having a problem removing “win32.agent”. My HijackThis log shows them as “Remote access manager”. Of course when I go into safe mode and try removing them, they just keep coming back.. Any assistance would be excellent, I’ve also tried going into add/remove programs and removing any suspicious looking programs.. So far, nothing..
Dale Radford,
More information about hook.dll you can find on http://www.spywareremove.com/removehookdll.html . Try to boot your computer in Safe Mode and scan with your anti-virus/ anti-spyware program once again – it is more possible that it will remove the infected file. Otherwise, I advice you to scan your computer with our Free Spyhunter scanner, which will not remove, but will find the infected files and show their locations. Afterwards boot your computer in Safe Mode and detele the infected files.
Anti-virus/spyware detected “….\sytem32\hook.dll” but is unable to delete it. I can find it and rename it and/or delete it. I have read that deleting it might crash and/or “destroy” the ‘puter . Your thoughts, please. Thanks.
Bonnie,
I advise you to use our free scanner. It will find all the infected files and show their locations. Then you can use our instructions how to delete the infected files manually. And it is better to boot your computer in Safe Mode before deleting the infected files.
I have a trojan virus: Ilomo on my computer and can’t find where to delete it – any suggestions. I think it just makes my computer run slow . . . UGH!
Thanks for the help – - -