Windows Tutorials - Herong's Tutorial Examples
Dr. Herong Yang, Version 5.00

Spyware: DSSAgent - DSSAgent.exe

This section provides a tutorial example on remove spyware 'DSSAgent' and related files webspec.dll.

Symptom: Unknown.

HijackThis Report: I ran HijackThis on my friend's system and saw this line:

O4 - HKLM\..\Run: [DSS] C:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE

Quick Research: I did a Google search on "C:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE" and located a good description from http://archive.salon.com/tech/col/garf/2000/06/15/brodcast/:

... The program itself had been hidden deep within my Windows 
directory, apparently designed to look like a system file. Further
investigation revealed that the DSSAgent had been written by 
Broderbund and had been installed when my daughter loaded an 
Arthur's Reading Race CD-ROM onto my laptop the previous weekend.

There were thunderstorms over my destination, so while my jet ran 
racetracks in the sky, I fired up some tools and started pulling 
apart the DSSAgent program. I discovered that the DSSAgent 
contained a copy of the developer's kit for the Pretty Good Privacy
encryption system, that it contained the ability to send e-mail and
post forms to Web pages and that its creators had gone to great 
lengths to hide the software's function. And there was no copyright
message indicating who had written the program...

What I Did:

1. Looked at C:\WINDOWS\BBSTORE, found the directory, and deleted it:

>dir C:\WINDOWS\BBSTORE\DSS
   DSSAGENT.EXE
   ...

>rmdir C:\WINDOWS\BBSTORE
   .\DSS\*.* removed
   .\ScopeUsr\Software\The learning company\education division
      \arthur's preschool

So the software, "arthur's preschool", is also removed. I guess this spyware was actually distributed as part "arthur's preschool".

2. Run "Start" > "Control Panel" > "Add and remove programs", found "Authur's Preschool", and removed it.

Result: DSSAgent is gone.

Sections in This Chapter

What Is Spyware?

"HijackThis" - Spyware and Browser Hijacker Detector

"HijackThis" Report Entry Types

Spyware: WebBar - htwtb.bin and bar.dll

Spyware: SurfBuddy - sbuddy.dll

Spyware: WebSpecials - webspec.dll

Spyware: DSSAgent - DSSAgent.exe

Transponder: Best Offer - farmmext.exe

Spyware: dinst.exe - dsr.dll

Dr. Herong Yang, updated in 2008
Spyware: DSSAgent - DSSAgent.exe