Windows Tutorials - Herong's Tutorial Examples - Version 5.62, by Dr. Herong Yang
Spyware: WebSpecials - webspec.dll
This section provides a tutorial example on remove spyware 'WebSpecials' and related files webspec.dll.
HijackThis Report: I ran HijackThis on my friend's system and saw this line:
O4 - HKLM\..\Run: [WebSpecials] rundll32 "C:\Program Files\WebSpecials\webspec.dll",run
Quick Research: I did a Google search on "WebSpecials remove" and located a good description from http://www.scanspyware.net/info/WebSpecials.htm. It says that "WebSpecials is an adware that brings frequent advertisements to your computer screen."
What I Did:
1. Looked at c:\program files\WebSpecials, found the file, and failed to delete it directly:
>dir c:\program files\WebSpecials webspec.dll ... >rmdir c:\program files\WebSpecials webspec.dll in use
2. Run HijackThis > "Open the Misc Tools section" > "Delete a file on reboot", select c:\program files\WebSpecials\webspec.dll, and reboot the system.
Result: WebSpecials is gone.
Table of Contents