Most SpyWare is simply programmed with a static path for the location of the SpyWare executable. Whenever I discover SpyWare on a workstation, I remove it (including registry entries) and do one of two things:
1. Delete the executable and replace with an empty directory with the same name as the previous executable file.
2. Delete the entire directory and replace with a file with the same name as the previous directory.

Since a file cannot replace a directory with the same name or vice versa, no more troubles from that particular SpyWare agent!

Kevin Shannon, MCSE
Kevin.M-ctr.Shannon@faa.gov


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/113/16827#16827