Evil Undelete-able Spyware
<div class="IPBDescription">What is it and why is it write protected</div> Okay, this has been bugging me for some time, but everytime I tried to deal with it I couldn't get rid of it. Thing is, it was never serious enough that I had to format. Basically, there is this spyware program on my PC called "WildTangent". It has done nothing to date, i.e. it doesn't cause any slowdowns, it doesn't throw up random ads and it really seems pretty much inactive. But nonetheless it would be dumb of me to leave it as is.
No big deal right? Just launch my anti-virus; (I use Ad-aware version 6.181) and remove it right? Well tough luck because it says it will never actually quarantine the file. So then I updated the reference file just in case, but now it doesn't even detect WildTangent, even though I know it is there... (The WildTangent folder and all the .dll files are still there.)
So then I try to delete the folder, except apparently that is write-protected. So I go to the folder options and turn off read only. I try to delete it again and it is still write-protected. And when I right click and check the properties, it is back to read-only!!
So what program or method do I use to circumvent this wily, evasive and oh so frustrating spyware? I figure chances are, there is at least a few among us here who know how to or have dealt with write-protected psuedo-invincible spyware before.
Any leads?
(Hopefully not mindblowlingly complicated ones though, if they are please break it down for me.)
~~EDIT~~
List of Possible Solutions:
* Spybot: Search and Destroy.
* Boot up in safe-mode.
* Edit my Registry. (Again if necessary.)
* Removal Instructions as provided by Dragon_Mech.
No big deal right? Just launch my anti-virus; (I use Ad-aware version 6.181) and remove it right? Well tough luck because it says it will never actually quarantine the file. So then I updated the reference file just in case, but now it doesn't even detect WildTangent, even though I know it is there... (The WildTangent folder and all the .dll files are still there.)
So then I try to delete the folder, except apparently that is write-protected. So I go to the folder options and turn off read only. I try to delete it again and it is still write-protected. And when I right click and check the properties, it is back to read-only!!
So what program or method do I use to circumvent this wily, evasive and oh so frustrating spyware? I figure chances are, there is at least a few among us here who know how to or have dealt with write-protected psuedo-invincible spyware before.
Any leads?
(Hopefully not mindblowlingly complicated ones though, if they are please break it down for me.)
~~EDIT~~
List of Possible Solutions:
* Spybot: Search and Destroy.
* Boot up in safe-mode.
* Edit my Registry. (Again if necessary.)
* Removal Instructions as provided by Dragon_Mech.
Comments
But <u>please</u> tell me there is another solution.
Either that or my adaware got rid of it for me...
I guess I ought to try Spybot, but I have a feeling unless a program specifically says it can deal with these, it probably won't be able to do anything. Just like Ad-Aware failed me.
EDIT: I was hoping that there is a specific way to deal with this thing; like some FAQ online or something, but when I google it I keep getting the tech forums and God knows what the heck they are saying.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
It's a shockwave plugin for 3d games and such...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run <!--QuoteEnd--></td></tr></table><div class='postcolor'><!--QuoteEEnd-->
In fact I did go and use Regedit and delete something from HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Even still, it continues to claim itself as write protected. What I deleted was called WildTangent so I knew that that should have been it.
<!--QuoteBegin--></div><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td><b>QUOTE</b> </td></tr><tr><td id='QUOTE'><!--QuoteEBegin--> Um... It's not spy ware...
It's a shockwave plugin for 3d games and such...
<!--QuoteEnd--></td></tr></table><div class='postcolor'><!--QuoteEEnd--> It is listed as spyware by several reliable anti-spyware sites. They say it leeches information and can also cause random popups. I had problems with it at one point but it just suddenly became inactive. So I let it be. I'll go ahead and try safemode.
it a program you can play games thru and then after you try them you buy them.... its never seemed to cause any problems tho, just shows up on spyware scanners, i dont recall having a problem deleting it tho <!--emo&???--><img src='http://www.unknownworlds.com/forums/html//emoticons/confused-fix.gif' border='0' style='vertical-align:middle' alt='confused-fix.gif' /><!--endemo-->
edit: sp
Thank you. This I must try.
msconfig will help you remove startup programs easily - it will even ell you where they are and everything (Startup folder, registry Run key). All very spiffy. I can practically guarantee it'll have something running. You may also find that the running program restores the startup settings so it may be wise to attempt to kill the process using Task Manager.
I've heard some good things about HijackThis. Also the tech forums mentioned it a ton of times. I will proabably download it even if I fix this spyware without it. That and spybot.
<span style='font-size:14pt;line-height:100%'><b>Status: Situation Resolved.</b></span>
Fix: <i>Apparently</i>, one more of the buggers was hiding in my Registry keeping the folder in constant use. It was in HKEY_CURRENT_USER/Software/WildTangent. Upon deleting this, the folder was no longer write protected. I immediately shift deleted it and did an Add Remove programs for it. I just ran a search for WildTangent and wt and deleted all the last vestiges of it after I verified for sure that they were in fact related to this most hated piece of garbage.
On a final note, I just wanted to thank everyone who bothered to reply to this thread, just kind of tells you something about the community when there are people in it willing to help like you all are. Thanks a lot, and I really mean that.
I don't think the term has a meaning on it's own. The term 'tangent' means a line that connects to a circle in only one place.