Spyware: DSSAgent - DSSAgent.exe

This section provides a tutorial example on remove spyware 'DSSAgent' and related files webspec.dll.

Symptom: Unknown.

HijackThis Report: I ran HijackThis on my friend's system and saw this line:

O4 - HKLM\..\Run: [DSS] C:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE

Quick Research: I did a Google search on "C:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE" and located a good description from http://archive.salon.com/tech/col/garf/2000/06/15/brodcast/:

... The program itself had been hidden deep within my Windows 
directory, apparently designed to look like a system file. Further
investigation revealed that the DSSAgent had been written by 
Broderbund and had been installed when my daughter loaded an 
Arthur's Reading Race CD-ROM onto my laptop the previous weekend.

There were thunderstorms over my destination, so while my jet ran 
racetracks in the sky, I fired up some tools and started pulling 
apart the DSSAgent program. I discovered that the DSSAgent 
contained a copy of the developer's kit for the Pretty Good Privacy
encryption system, that it contained the ability to send e-mail and
post forms to Web pages and that its creators had gone to great 
lengths to hide the software's function. And there was no copyright
message indicating who had written the program...

What I Did:

1. Looked at C:\WINDOWS\BBSTORE, found the directory, and deleted it:

>dir C:\WINDOWS\BBSTORE\DSS
   DSSAGENT.EXE
   ...

>rmdir C:\WINDOWS\BBSTORE
   .\DSS\*.* removed
   .\ScopeUsr\Software\The learning company\education division
      \arthur's preschool

So the software, "arthur's preschool", is also removed. I guess this spyware was actually distributed as part "arthur's preschool".

2. Run "Start" > "Control Panel" > "Add and remove programs", found "Authur's Preschool", and removed it.

Result: DSSAgent is gone.

Table of Contents

 About This Book

 Introduction to Microsoft Windows

 Introduction to Windows Explorer

 Introduction to Internet Explorer

 "Paint" Program and Computer Graphics

 GIMP - GNU Image Manipulation Program

 JPEG Image File Format Quality and Size

 GIF Image File Format and Transparent Background

 "WinZip" - ZIP File Compression Tool

 "WinRAR" - RAR and ZIP File Compression Tool

 FTP Server, Client and Commands

 "FileZilla" - Free FTP Client and Server

 Web Server Log Files and Analysis Tool - "Analog"

Spyware Adware Detection and Removal

 What Is Spyware?

 "HijackThis" - Spyware and Browser Hijacker Detector

 "HijackThis" Report Entry Types

 Spyware: WebBar - htwtb.bin and bar.dll

 Spyware: SurfBuddy - sbuddy.dll

 Spyware: WebSpecials - webspec.dll

Spyware: DSSAgent - DSSAgent.exe

 Transponder: Best Offer - farmmext.exe

 Spyware: dinst.exe - dsr.dll

 IE Addon Program Listing and Removal

 Vundo (VirtuMonde/VirtuMundo) - vtsts.dll Removal

 Trojan and Malware "Puper" Description and Removal

 VSToolbar (VSAdd-in.dll) - Description and Removal

 Spybot - Spyware Blocker, Detection and Removal

 Setting Up and Using Crossover Cable Network

 Home Network Gateway - DSL Modem/Wireless Router

 Windows Task Manager - The System Performance Tool

 "tasklist" Command Line Tool to List Process Information

 "msconfig" - System Configuration Tool

 Configuring and Managing System Services

 Windows Registry Key and Value Management Tools

 Startup Programs Removal for Better System Performance

 Winsock - Windows Sockets API

 Java on Windows

 Glossary of Terms

 Outdated Tutorials

 References

 PDF Printing Version