Spyware: WebSpecials - webspec.dll

<< Spyware Adware Detection and Removal

<< Windows Tutorials - Herong's Tutorial Examples

This section provides a tutorial example on remove spyware 'WebSpecials' and related files webspec.dll.

Symptom: Unknown.

HijackThis Report: I ran HijackThis on my friend's system and saw this line:

O4 - HKLM\..\Run: [WebSpecials] rundll32 
   "C:\Program Files\WebSpecials\webspec.dll",run

Quick Research: I did a Google search on "WebSpecials remove" and located a good description from http://www.scanspyware.net/info/WebSpecials.htm. It says that "WebSpecials is an adware that brings frequent advertisements to your computer screen."

What I Did:

1. Looked at c:\program files\WebSpecials, found the file, and failed to delete it directly:

>dir c:\program files\WebSpecials
   webspec.dll
   ...

>rmdir c:\program files\WebSpecials
   webspec.dll in use

2. Run HijackThis > "Open the Misc Tools section" > "Delete a file on reboot", select c:\program files\WebSpecials\webspec.dll, and reboot the system.

Result: WebSpecials is gone.

Sections in This Chapter

What Is Spyware?

"HijackThis" - Spyware and Browser Hijacker Detector

"HijackThis" Report Entry Types

Spyware: WebBar - htwtb.bin and bar.dll

Spyware: SurfBuddy - sbuddy.dll

Spyware: WebSpecials - webspec.dll

Spyware: DSSAgent - DSSAgent.exe

Transponder: Best Offer - farmmext.exe

Spyware: dinst.exe - dsr.dll