forum.vdsworld.com

tim6389 · Professional Member Joined: 01 Aug 2002 Posts: 790

well i have been trying to find out how they do this...if i find out i will post...if any one else finds out please post Smile

thanks

SnarlingSheep · Posted: Tue Apr 20, 2004 12:38 am Post subject:

Basically they startup in the places that Dread mentioned, or they create Browser Helper Objects that are loaded when you run IE.
If they're smart they do both, so when IE is loaded it can readd itself to the startup folder/keys.

I don't think I've seen anything but virii set themselves as the default program for certain extensions.
I had one once that set itself to run EXE's...messed everything up pretty nicely.

I think the best thing some spyware programs do that fools alot of users is name themselves something that looks like a Microsoft program, and put themselves in the Windows folder.

I'm not saying anyone here should do any of that, but it might help some people actually realize why they keep getting spyware.
If you don't know why a certain program is starting with windows, searching yahoo/google with the exe name will usually turn up good info on it.

tim6389 · Professional Member Joined: 01 Aug 2002 Posts: 790

that is the name of it "Browser Helper Objects" i knew there was a name for it but i couldn't recall what it was... can vds programs use that? or how does one make a Browser Helper Objects to say run a vds program when explorer does?

SnarlingSheep · Posted: Tue Apr 20, 2004 1:10 am Post subject:

From what's been posted on this forum, I guess it can't be done without a DLL to actually be the BHO and send info to/from the VDS app.

tim6389 · Professional Member Joined: 01 Aug 2002 Posts: 790

yea that is what i have been reading on the net to ( so far ) Sad

i'am going to keep looking around for info...maybe i will find something

Hooligan · Posted: Wed Apr 21, 2004 10:52 pm Post subject:

Have you tried replacing the shell? This reg hack will run myprog.exe as the shell...

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="myprog.exe".

Or if you only want to make it specific to the current user login, use:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"Shell"="myprog.exe"

That aught to confuse your buddy! Twisted Evil

Just make sure you leave a way to back that change out... Wink

Hooligan

tim6389 · Professional Member Joined: 01 Aug 2002 Posts: 790

hheeh

cool

will that work on all window versions?

thanks

Hooligan · Posted: Wed Apr 21, 2004 11:02 pm Post subject:

I believe only NT/2k/XP...

Hooligan

tim6389 · Professional Member Joined: 01 Aug 2002 Posts: 790

kk

thanks for the info

vtol · Posted: Thu Apr 22, 2004 2:09 am Post subject:

BHO Demon can tracks and can kill BHOs.

Go!Zilla, the downloading utility, installs a BHO created by Radiate (formerly Aureate Media); this BHO tracks which advertisements you see as you surf the Web.

I thought if your buddy had BHO Demon, might consider another way.. Idea

tim6389 · Professional Member Joined: 01 Aug 2002 Posts: 790

yea that is why i'am trying to find a good way Smile

heheheh

FreezingFire · **Admin Team** Joined: 23 Jun 2002 Posts: 3508

I don't really think there's any way to completely hide it; there will always
be a way to reverse the changes or things you add.

But most of these ways seem to be good enough to fool the average user.

tim6389 · Professional Member Joined: 01 Aug 2002 Posts: 790

yea i think you are right....i have enought info to work with it now Smile

thanks all for your help