How to Find Spyware with File Search Tool
Why is it important to delete Spyware Programs?
Spyware can infect your computer and compromise your privacy, security and computer performance. Spyware is constanly changing and can infect your computer without you even being aware of it. Spyware can install onto your computer and gain access to sentitive information like your passwords, credi card numbers and emails. Spyware is very difficult to detect and remove so trying to uninstall it can prove to be a huge undertaking.
If you suspect that your computer is infected with spyware, the best advice is to remove the spyware IMMEDIATELY before it exposes your computer to other unwanted programs such as adware, malware, trojans and hijackers.
Windows includes an effective search tool that may help you to find spyware files and folders on your computer. Windows File Search Tool is easy to use and navigate, giving you many options to choose according to what you want to find. You are able to choose particular areas to look on your computer that will make the searching for spyware faster.
Learn how to find unwanted spyware programs from your computer with Windows File Search Tool.
Find Spyware Programs Manually
Warning: Manually searching for files of a spyware program is a difficult and risky. If you delete the wrong file, your computer may crash and important data may be lost. As precautionary measure, please back up important files and set a System Restore point (click Start > All Programs > Accessories > System Tools > System Restore, and follow the on-screen instructions) or run a spyware check with a trusted anti-spyware program to automatically detect spyware.
Follow the steps below to search for spyware files or folders.
- Click the “Start” button and then select the “Search” option.
- The Search window will be launched. On the left side of the “Search” window, you will see a separate section which is called the “Search Companion”.
- If you want to perform the search for all available computer files and folders, click on “All Files or Folders”.
- You have several preferences under “All Files or Folders”. For example, you are able to search for files or folders according to their name, a separate word or phrase in the file, the drive where the file is placed, or any combination of the three.
- “Search Companion” is designed to look through your hard drive. If you want to search in a different location, click on the down arrow below the “Look in” section. This action will show you the variety of folders, and disks where you can perform your search. Click on the drive, folder, or disk you wish to perform a search. For better results, it is recommended that you select “Look in: Local Hard Drives” or “Look in: My Computer”.
- If you want to perform a more sophisticated search, go to the “More Advanced Options” section.
- If you know the exact type of file that you are looking for, click the down arrow under “Type of File”. This action will display a list of all available files. To choose the preffered type, use your scroll button and search for the type of file you are looking for and click the file type.
- Click on the “Search” button to start the search. You will be able to see a summary of your search criteria as Windows looks for your parasite file(s).
- When your search finishes, you will see all of the files that are related to the parasite. The results will be seen on the right side of the “Search” window.
- Right-click on the files that you want to delete and select “Delete”. Otherwise, you can select the files and press the “Delete” button on your keyboard.
July 31st, 2007 at 7:00 am
My spyhunter v 2.9 program cannot find Zquest. Trojan to remove it. My computer is infected with that trojan. How can I find it? I already tried the search engine in my computer but cannot find it either.
September 4th, 2007 at 10:48 pm
About spyshredder plz help.. I don’t know how to overcome from this..
With regards
Krishna
September 4th, 2007 at 10:50 pm
Help me to come out of this spyshredder
September 4th, 2007 at 10:51 pm
I am facing serious problem. Its because of spyshredder…
September 13th, 2007 at 12:03 pm
Yo, thanks for the help on helping me find this freaken malwareburn.
September 21st, 2007 at 9:31 pm
Hi
I cannot find the file ntss.exe in my computer…how should i remove it…
REGARDS
September 23rd, 2007 at 3:04 am
They got my money. How do I get it back and who should know about scam?
September 24th, 2007 at 11:13 am
navin,
Please explain your problem more accurately. Why are you trying to find ntss.exe on your computer? What makes you think that you have this file on your computer? If you really have ntss.exe and don’t know how to remove it, try to use our instructions on http://spywareremove.com/removentssexe.html.
September 24th, 2007 at 11:16 am
Anthony Peterson,
Please describe your problem. What kind of application did you buy?
October 11th, 2007 at 1:10 pm
i buy winantisywere2007 on 10.10.2007. with credit card. I restor my Pc with 3 days and I lost my winantispywere2007. how to recover it? I pay 40euro or $ . plase help me!
October 12th, 2007 at 11:42 am
saulean cristian,
WinAntiSpyware 2007 is a rogue anti-spyware program. It is good that you don’t have it on your machine anymore. So don’t try to recover it. The bad thing is that you lost your money and you won’t get them back. The makers of rogue anti-spyware programs like WinAntiSpyware 2007 creates such programs to swindle out the money from people.
October 26th, 2007 at 9:50 pm
Ok so i ran Norton and Spysweeper. I found numerous cookies and two trojans. It said it removed them. This dumb IEDefender window keeps popping up. I followed the instructions under IEDefender and in step one i cannot locate anything at all. Says no results. So now what do i do to get rid of this??? please help
October 30th, 2007 at 2:10 pm
Christina,
Try to use Safe Mode. If you want to remove IEDefender files, you can probably locate them on C:/Program Files/IEDefender. It may be that it won’t delete the whole infection, however this will remove the rogue anti-spyware program. Try to update your anti-virus/ anti-spyware program and scan your computer again, because the updates of this parasites should release soon (or they already released).
November 3rd, 2007 at 5:06 am
i like this site,mostely i read others comment i practical it. But few day before i am facing —Backdoor.trojan virus–
so Please tell me how i remove this Virus
November 4th, 2007 at 8:58 pm
i ran the seach through all my files and my com. but it cant find the trojan and my computer gives me all these popups that i have it
November 5th, 2007 at 2:16 pm
AJAY KUMAR,
There are lots of backdoor.trojans and it’s impossible to give you the exact removal instructions of this parasite. Try to check the execution points, find the suspicious files and delete them. Otherwise use anti-spyware or antivirus programs.
November 5th, 2007 at 2:20 pm
tj beebe,
You have to find the files that are on the execution points. Try to find out by their names if they are malicious. You may also scan your computer with anti-spyware or antivirus program to make sure that your computer is free from spyware.
November 8th, 2007 at 4:25 am
i have a program called ie defender on my hard drive it says its a spyware remover but i have a reason to believe its not, i cant delete the darn thing, im uninstalled it a million times but it doesnt do it and the files are nowhere to be found, its still inmy uninstall files but i cant remove it, everytime i go on the internet it pops up and trys to downlowd more,i cant use search engines but cause it says i have spyware i had a few trojans and virisus but they have all been removed, im so confused, i cant get this ie defender off my computer, thank you.
November 8th, 2007 at 12:58 pm
kris,
IEDefender is quite a new parasite. All the infection may be caused by the file which is on iedefender directory. You have to boot your computer in Safe Mode. Then switch off the IEDefender, search for directory named Iedefender and remove it. However, this will not help you to prevent the pop-up attacks, you have to use raliable anti-spyware software. Or if you are a computer expert, locate the BHO line in registry on your computer and remove malicious files.
November 24th, 2007 at 9:24 am
Hi all….I have upspiral attached to my internet. When trying to down load a scan for free detection program..I either a) get an DN4error page b) not able to open the scanning script. I have tried to delete it maually but thats just not my thing..
any suggustions
TIA
November 29th, 2007 at 12:21 pm
Alex,
If the manual removal is too hard for you, you have to use a reliable anti-spyware program. If you’re having problems with downloading any programs, you can use other computer connected to the internet, to download a program and then install it on your computer to clean the infection.
November 30th, 2007 at 12:47 am
My Compuer is infected by infostealer.gampass trojan. I want to remove this trojan. Please give instruction or removal softwares.
Thank You.
November 30th, 2007 at 1:11 pm
Soe Minn Oo,
Our suggestion for you is to use our free scanner to find out the locations of the infected files. Afterwards you have do remove the infected files from your machine (it is better to switch to Safe Mode). If this will be too difficult for you, you have to use a reliable anti-spyware program and update it often.
December 7th, 2007 at 12:26 am
On one of my computers I got that “secure PC cleaner” virus. I’d love to find its inventor and WATERBOARD the punk. Obviously, an ounce of prevention is worth a ton of cure. The other computer now has this “registry corrupt visit this website” popup and software malfunctions. It got infected only _3 minutes_ after hooking it to the Internet!
I thimk virus coders make a good justification for waterboarding and a trip to Gitmo.
December 7th, 2007 at 1:28 am
hi, im not able to find any spyware, but
1. when i use search engines like google or ask.com for surfing when i click a search link it will redirects the link to some shedlight.com somthing then i have to go back then click then click the link again.why is this happens?
2. and i find many unknown files in Temporary Internet Files.
3. now im using firefox webbrowse(previously IE) still in task manager processes many ieexplorers will be running.even though i havent opened any IE .why?
how can i get rid of these?
please help.
December 7th, 2007 at 12:58 pm
Mad Max,
It’s not so easy to waterboard them. The virus creators are stealing the money and they have schemes how to hide themselves.
December 7th, 2007 at 1:04 pm
viju,
Most likely you are having malware on your machine. Scan your computer with our free SpyHunter scanner to make sure, if your computer is infected. If there will be any infected files, you can see the locations where they are and remove them manually. Otherwise, you have to use a reliable antispyware program.
December 8th, 2007 at 2:28 am
hello i have a problem i can not open my task manager i trued alt ctrl dele and i tryed ctrl shift enter and i tryed run taskmgr and still it says administrator will not let you, and im the administrator.
December 8th, 2007 at 10:41 am
jason,
These steps should help you to enable Task Manager:
1. Click Start -> Run
2. Type REGEDIT
3. Click OK The Registry Editor will now open
4. Browse to the following key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\system
5. In the right pane, look for the value: DisableTaskMgr
6. Right click DisableTaskMgr and select Delete. (When prompted with “Are you sure you want to delete this value”, select Yes).
7. Now browse to the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
8. In the right pane, look for the value: DisableTaskMgr
9. Right click DisableTaskMgr and select Delete. (When prompted with “Are you sure you want to delete this value”, select Yes).
10. Close the Registry by choosing File | Exit
December 23rd, 2007 at 1:52 pm
hi I have a problem with WebDialer that I found while running spybot.
Error during check!
WebDialer [150] (Access violation at address 04893F52 in module ‘advcheck.dll Read of address 00000034)
I just don’t want to delete any necessary files/registry entries that will f up my comp. My comp is running OKAY at the moment, but I know that worser things may come. This is my families home computer so I don’t want it to get f’d up.
Please help.
December 24th, 2007 at 11:42 am
lew,
I suggest to you follow tha manual WebDialer removal instructions on http://spywareremove.com/removeWebDialer.html . Otherwise, you can scan your computer with our free SpyHunter scanner to find the locations of the infected files and try to remove them manually. If you think that this will be too difficult for you, the only way to get rid of this parasite is to use the reliable anti-spyware program.
December 25th, 2007 at 2:42 am
How do I enable access to the “add/remove programs function? I am the administrator but it say’s that access was denied and to contact the admin. I have the bravesentry virus and I’m trying to get rid of it.
PS: I believe manaully is only way to do it because I purchased Spyware Doctor from PC TOOLS and it did not completely remove the virus, every time I scan a new trojan dropper is found still.
Thanks,
Nick
December 26th, 2007 at 6:31 am
HI, I have downloaded the full version of SpyHunter and when I scan and “remove” the parasite “zlob.Trojan” from my system, it appears again when I re-scan my computer. I have followed the directions to manually remove it and none of the files it says to look for, appear. My question is: Does this mean that SpyHunter did remove the spyware or do I still have it and if I do how do I remove it? And if it did remove it, why does it keep on appearing on the list when I scan it again? PLease help me, thank you!
December 26th, 2007 at 10:07 am
Nick,
I suggest you to try to boot your computer in Safe Mode and try to remove this parasite. It may be, that your anti-spyware program does not has the newest definitions for the trojan that is on your computer. Try to contact the support team of your anti-spyware program. Otherwise, you can try to get another reliable anti-spyware program.
December 27th, 2007 at 11:15 am
Hugo F,
Zlob Trojan tends to renew very often and it changes the names of its files, so it may be, that SpyHunter does not has the updates for new zlob files. If you purchased the full SpyHunter version, all you have to do is to contact the support team and they will solve your problems.
January 6th, 2008 at 1:04 pm
I have a trojan virus: Ilomo on my computer and can’t find where to delete it - any suggestions. I think it just makes my computer run slow . . . UGH!
Thanks for the help - - -
January 7th, 2008 at 10:01 am
Bonnie,
I advise you to use our free scanner. It will find all the infected files and show their locations. Then you can use our instructions how to delete the infected files manually. And it is better to boot your computer in Safe Mode before deleting the infected files.
February 5th, 2008 at 12:32 pm
Anti-virus/spyware detected “….\sytem32\hook.dll” but is unable to delete it. I can find it and rename it and/or delete it. I have read that deleting it might crash and/or “destroy” the ‘puter . Your thoughts, please. Thanks.
February 6th, 2008 at 11:11 am
Dale Radford,
More information about hook.dll you can find on http://www.spywareremove.com/removehookdll.html . Try to boot your computer in Safe Mode and scan with your anti-virus/ anti-spyware program once again - it is more possible that it will remove the infected file. Otherwise, I advice you to scan your computer with our Free Spyhunter scanner, which will not remove, but will find the infected files and show their locations. Afterwards boot your computer in Safe Mode and detele the infected files.
February 7th, 2008 at 5:50 pm
I’m having a problem removing “win32.agent”. My HijackThis log shows them as “Remote access manager”. Of course when I go into safe mode and try removing them, they just keep coming back.. Any assistance would be excellent, I’ve also tried going into add/remove programs and removing any suspicious looking programs.. So far, nothing..
February 7th, 2008 at 9:04 pm
I’m having trouble removing 2 viruses.. When I delete either one of them, they come right back. My HijackThis log shows them as activexds.exe, and asctrls.exe.. From what I understand it’s win32.agent. I would really appreciate any advice..
February 8th, 2008 at 1:24 pm
Anthony LoPresto,
You have to remove all the files which are starting when you boot your system and if you leave one of them, they are regenerating and comes back again. You can scan your computer with our free scanner or other anti-spyware programs to find all the infected files you have to remove. Afterwards boot your computer in Safe Mode and remove the infected files. Otherwise you have to get a reliable anti-spyware program.
February 9th, 2008 at 12:34 pm
My girlfriend appears to be infected with this trojan ” Backdoor.Win32.IRCBot.biq”.
Her copy of AVG antivrus popped up a msg saying she was infected with SHeur.aqih.
I have tried to find more info about this trojan on the net but have found very little on this beastie.
Apparently she can no longer connect to the internet with the infected machine.
Main problem is that I am in Australia and she is in Hong Kong, so I am unable to give her any real help.
Any info on this malignant trojan and removal or removal tool would be greatly appreciated.
She was infected through an email with picture attachment sent to her from a friend.
This friend was chatting with her on msn, but it wasn’t really her friend.
So it seems her msn was hacked as she contacted her friend who said that she didn’t send the email to her.
Sorry I can’t give you anymore info.
February 12th, 2008 at 2:13 am
My Computer is driving me on edge.
1. This website Webcry or something keeps annoying me while trying to click on something in google. i can acces websites but only if i right click then open.
2. My computer keeps saying theres a trojan/ spyware , everyone is trying to advertise something to get rid of it which probably not work.
3. i’m only a kid so i can’t do by downloading something.
Please Please Please Please Please Please Please Please Please Please Please Help me! I’m so desperate i actually typed out the pleases.
February 12th, 2008 at 10:24 am
Cher,
More information about WebCry you can find on http://www.spywareremove.com/removeWebcry.html . But it is most likely that you have got some trojan on your computer, which displays pop-ups that your computer is infected and suggests you to download WebCry. I advice you to scan your computer with our free scanner. It will find the infected files and show their locations. Then boot your computer in Safe Mode and delete the infected files. This should help you. Otherwise, the solution is to get a reliable anti-spyware program.
February 12th, 2008 at 1:27 pm
Alan,
What a complicated situation. The only advice I can give you is to get a reliable anti-spyware/anti-virus software. Afterwards, she should use another computer to get the latest updates for this program (usually they are on the software page), because she can’t access the Internet from her computer, as I understood. And then she should install the updates on her computer, boot her system in Safe Mode and try to scan and remove the infected files.
February 18th, 2008 at 12:20 am
I was doing the spyshredder removal guide but I can’t find the spyshredder folder when I search. I know I have it (it constantly reminds me). Any solutions on how to find it?
February 19th, 2008 at 6:48 pm
Name,
You can scan your computer with our free scanner, which will find the infected files and show their locations. Afterward, boot your computer in Safe Mode and delete the infected files.
February 25th, 2008 at 8:41 pm
Okay now I have deleted SpyShredder over five times now and it keeps coming back. When I do delete it the way you show it comes back when I start up my computer again. What do I do to completely delete it so when my computer starts up again it won’t be on my system.
March 2nd, 2008 at 12:54 pm
I think I got this “mirar” virus from youtube, Ive also tried to destroy it on pskill but the software always fails to install, when ever i simply try to remove it in program files a pop up comes up for mirar unistall software and it tells me that mirar is not responsible for the pop ups that come up and they are grateful for my busness. I would try to destroy it in safemode but i cant seem to find instructions on how to do that
March 2nd, 2008 at 12:56 pm
I just really need some help
March 2nd, 2008 at 6:31 pm
i have a trojan on my computer called “Troj/vitrum-gen” located in pmnli.dll ive tried the steps on this website to get rid of pmnli.dll and im stuck on the step where it says hover over the “in foler” and copy and paste it in the url adress. or something like that. ive searched for it and i only get one file that comes up is one file that says pmnli.dll and i cannot delete it because it’s being used by other applications or person. this virus is also infected in ilnmp.ini
i am in need of help!
March 11th, 2008 at 7:42 am
i downloaded a stealth keylogger and decided to get rid of it. well norton deleted the exe file to uninstall it and so im stuck with trying to get it off here. the site person is no help at all of course. but i know its still there because it is still logging where were going. i dont know if the file sysmon.dll should be deleted and i dont know where it has attached itself. help……..
March 11th, 2008 at 5:00 pm
My computer is telling me that i am infected with the spyware Zlob and my search of my computer cannot find it. how can i find zlob and kill it.
March 13th, 2008 at 1:18 am
Hi. Im so frustrated. My windows security center kept showing bubbles in the bottom toolbar that said: my computer is threaten with “Win32.banker.fstrojan.spyagent.da”. And when I clicked on that bubble it directed me to google search result of spyware cleaner tools.
I tried scanning with a number of anti spyware, ie. spyware doctor, ad aware and spyhunter too, I also did it on safe mode, but the results did not show the said spyware my windows security claims.
I also tried searching for the file using windows file search tool as advised here: http://www.spywareremove.com/removetrojanspywin32bankerp_20dll.html, but still could not find it.
I cannot open my task manager either. I tried typing REGIDIT like you advised Jason above, still didnot work.
I am at my wits end. I donot want to reformat my computer if I can help it. But is there any other way???
cheers for your help.
March 13th, 2008 at 4:09 am
hey i have problem wif service.exe
C:\WINNT\system32\services.exe
error #
-1073740972
it says.. 60 seconds to shutdown, when that pop up comes out, i cant open or close anything… plz advise me >.
April 1st, 2008 at 1:44 pm
Hi,
I have been reading these messages and I have so many trojans and malwares loaded my system I can’t do anything. I have spent at least 24 hours in total trying to get rid of them. I brought a software yesterday but I still have these problems. I figured out last night I have to manually delete them but what do I do with the ones that say I cannot delete them. I am going to try the regedit process because I get that error too.
I just wanted to say this is a helpful sight.
Thanks.
April 10th, 2008 at 5:32 am
Im on metal of honor and someone put a hack and spam on me –that says—- im a wallhack kick me—-plus i cant shoot any more cause every time i shoot –that say come up –pl help me
April 22nd, 2008 at 9:09 pm
okay
so i’ve gotten the infostealer virus (by the way, what does it do?), and i can’t find the file that has it. I know i have it because when i tried to quarantine (norton anti-virus) the file it said it did. the file however is now gone from the quarantine (i accidently restored it without reparing it), but i know that the virus is still there because none of the desktop images show up, and is incredibly slow. i can’t find the file, i can’t scan the computer, and i can’t do anything at all! tell me how can i get rid of this nuisance?!
please help me!
April 22nd, 2008 at 9:22 pm
hi here again!
sorry, but to help the message i just left above, my computer has completely FROZEN i can’t download ANY virus protection programs whatsoever because of the infostealer virus. i can’t locate the virus at all. none of the shortcuts on the desktop show up- basically the background is the same but without the shortcuts. i haven’t been able to access anything except quarantine but that is now useless. i can’t find the file with the virus so i can’t quarantine it. however i still know that there is a virus because all the many problems
i hope that could clarify any problems!