
Think you have spyware? Troubleshooting is easy!
Spyware is a very common problem in relation to the Windows OS and is very easy to install; however, the launching of spyware can easily go unnoticed unless certain steps are taken.
Before going through the process of installing a spyware removal program (best recommended: Spybot - Search & Destroy), I would like to share two tips with you that can determine probability of having spyware active on your computer.
MSConfig:
Do you remember files named win.ini and system.ini back in the Windows 3.x days? This is the place in Windows 95+ where users (mainly professionals) can modify these files. I would not recommend changing anything in these files as they can seriously alter the functionality of your operating system. However, in this instance, we are going to be viewing and possibly modifying the “Startup” section of MSConfig. To execute this program, go to Start > Run, type in msconfig, and click “OK.” Once this has been done, a System Configuration Utility will appear (shown below).
![]()
Spyware usually runs on startup so that it may automatically run when you start using your computer. In MSConfig, click on the Startup tab, and you may: see some files that you either may not recognize, do not make any sense with random letters that are not located within your Program Files folder (e.g. xz0dsb.exe), or lines within MSConfig that are checked that do not have any information whatsoever.
If you do notice some files that you do not recognize, it is best to perform a google search on the file in question before unchecking it as it may be a very important file that another piece of software needs to run on startup to function successfully. If not needed, go ahead and uncheck the file(s) and click OK. You may also want to attempt to halt the productivity of these files in Task Manager. If not, unfortunately the file will not stop until your Windows OS has been restarted.
Netstat:
Another way to inspect the running of spyware on your computer is to monitor your internet connection’s activity. A simple way to do this is by running netstat from Windows’ Command Prompt (yes, Windows does have this common Linux tool). To run netstat, go to Start > Run, and in the text box type ‘cmd’ (without quotes). This will bring up the Command Prompt window which I have provided a graphic of below.
![]()
At the command prompt command line, type ‘netstat -b 1′ (without quotes). Netstat will report network statistics based on your connectivity. With the “-b,” this will present you with a list of internet connections along with the processes associated with them, and the “1″ specifies the interval in seconds of that netstat checks these processes. If you see a process appear that you do not recognize and it is connecting with a website that you are not accessing, mostly likely it is spyware or some form of information collecting program. Again, the best way of gaining knowledge of the process(es) in question is by performing a google search and seeing what the majority of people are saying about it/them.
There are hundreds of ways to check for spyware, but these above are just a few common, and quick ways to stay informed.
iEntry 10th Anniversary
LinuxHaxor
WindowHaxor
MacHaxor















[...] Think you have spyware? Troubleshooting is easy! [...]
I always found WinHex easy to use if you want to peek into the memory (where DLL files can be loaded). Icesword, McAfee Rootkit Detective, and Sophos Anti-Rootkit are nice rootkit scanners to use as well. Others prefer Trend’s HijackThis or possibly even Microsoft/Sysinternals ProcessExplorer to the tools that you mentioned, but I do use MSConfig and netstat all the damn time for many other reasons.