asked on

Detect WebWatcher on my computer

I think someone has installed spying software on my PC. Probably WebWatcher but not sure. I called WebWatcher and they said I have to send them a notarized letter that I own the computer before they will tell me if it's on here. Anybody been successful at detecting this stuff?

WebWatcher website says they are totally invisible. that's hard to believe.

SOLUTION

bbruns

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

mattbiel

ASKER

Thanks, yeah, I do know how to use both of those but wasn't sure how effective they would be. I have also used Dr.Web in the past. But, can I know for certain that my computer is "clean" if these scans come up empty? If not, is there any way to be certain?

bbruns

Well, in theory, there's no way to be sure either way - that company could be lying too, and for all you know, they could take that letter you send them and use it to attempt to steal your identity.

Do you really want to put your trust in a company that makes a living from violating computer crime laws (on a side note, you may want to contact your state's attorney general about that)?

I use MalwareBytes pretty heavily, so I have alot of faith in it finding things.

This page here from Spybot might be very useful as well to you in seeing if you really are infected with this nasty.

mattbiel

ASKER

No, I definitely don't trust this company which is why I'm not gonna bother sending a notarized letter. They are in the deceit business as you mentioned. I'm just trying to find a way to make sure this computer is clean other than having to reformat.

thanks for the spybot link, I"ll check it out

ASKER CERTIFIED SOLUTION

sykojester

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

mattbiel

ASKER

Thanks Skyojester, that's good info. I have used Process Explorer before. How did you / how could you, determine which DLL was the WebWatcher? I don't need to be able to remove it. If I can determine that it is indeed in there then I will reformat. But if Process Explorer comes up normal I'll assume I'm clean. The problem is, I don't know what's normal and what's not when it comes to the contents of Process Explorer. Any ideas on this part of it?

sykojester

If you have multiple browsers such as Firefox & IE and/or Outlook running, you can compare the DLLs running under each process for a common denominator. You will want to open these process properties via Process Explorer & view the Threads tabs to view DLLs loaded under each process.

If you have any questions abouta particular thread feel free to post a screenshot or just list any DLLs listed you think may be suspect.

Common DLLs loaded under iexplorer.exe would be ntdll.dll, ietutil.dll, ieframe.dll, rasman.dll, wininet.dll, & msvcrt.dll.

You can select a specific DLL listed & click the Module button to view its properties and full path.

mattbiel

ASKER

I scanned with MalwareBytes, Dr.Web Cureit, and ComboFix. All came up clean. Then I downloaded a free trial of WebWatcher onto the computer because I called WebWatcher support and they said that if the full version is on there you can't install the trial. Since I was able to install the trial, this means that WebWatcher must not be on there. Thanks guys!