dwspy32.dll

[denied_11]

I recently ran Webroot's SpySweeper for the first time, and it detected a system monitor called "Spyworks" (which AdAware and Spybot S&D have never detected). A little searching on my hard drive turned up these 3 items:

Dwspy32.dll (Application extension)
Ccbtn32.ocx (OCX file)
Dwsbc32.ocx (OCX file)

Would these be residue from my now-fixed spyware infestation? Or did someone sit down at my machine and install some surveillance software ("snoopware")?

Is there any way to find out what application they are attached to? Or when it was installed?

I've looked into SPYCOP, looks like a good program (although expensive). Any opinions?

Please help -- I'm now afraid to type anything on my keyboard... :( Thanks!

[Pieter_Arntz]

Hi denied_11,

If you look here: http://www.hallogram.com/spyworks/

To find out if it is still active and if so, what is using it download: What's Happening (http://www.turboware.com/WhatsHappening.htm)

HTH,

Pieter

[denied_11]

Pieter, Thanks for responding so quickly.

The first link you gave me... yes, I see my friend dwspy32.dll there, but to be honest, I didnt understand a thing on that page (i'm a bit of a computer dunce), but it sounds like it's a programmers tool?

I ran What's Happening, and didnt see any of those 3 items.

Suggestions? Thanks! :)

[Pieter_Arntz]

Hi denied_11,

In that case you should be able to delete Dwspy32.dll without Windows complaining that it is in use.

And see if you can find Dwshk.ocx on your computer. That is the keyboard logging part of the utility.

If it is no longer in use it is hard to find out how it got there or what was using it.

You could try a Find Files for files that were created at the same time.

Regards,

Pieter

[denied_11]

Hi Pieter, OK, I deleted those three items, but i was unable to find dwshk.ocx. I hope i'm doing it right: Start > Find > Files or Folders > typed "dwshk.ocx" under Named > Look In C, subfolders checked. I also tried Start > Run > "C:\WINDOWS\SYSTEM/dwshk.ocx". No luck there either.

Is this a good sign, or is my lack of expertise showing again?

Also, what's your opinion of SPYCOP? And do snoopware detectors simply detect and notify, or do they also disable/uninstall?

Thanks! :)

[Pieter_Arntz]

Hi denied_11,

That is a good sign, assuming you have hidden files and folders showing.
To "unhide" hidden files and folders:
Launch My Computer from the Desktop Icon.
Select View, Details.
Select the Folders button.
Select Tools, Folder Options. Then select the View Tab. Select the Show hidden files and folders radio button is selected
and that the Hide file extensions for known file types check box is unchecked. Once this is done, select Apply and then
Like Current Folder (located near the top of the Folder Options box). Then select OK.

As for Spycop, read this post:
http://www.wilderssecurity.com/showthread.php?t=17255;start=msg123882#msg123882

I never tried the program myself, but other members may have more information for you.

Regards,

Pieter

[denied_11]

Thanks for your help, Pieter! :)