replacing spyware files

[raverx3m]

i dont have enough knowledge about spyware and files that it downloads on your computer but most of them are either in user/temp directory or windows32

i had a few spyware programs and found the .exe files.

does anyone know if it would help instead of deleting the exe files to replace them with empty 0 byte of same name and enable "read only" function.
or does the spyware overwrite the read only function?

[Osiris]

You would probably get a access denied error message because that file is in use. Why would you want to do this anyways?

[peterhuang913]

Originally Posted by Osiris

You would probably get a access denied error message because that file is in use. Why would you want to do this anyways?

Keep the spyware but make it not work

[raverx3m]

ye that was kinda my idea if the spyware sees the file present it would assume that its already there. but i donno if it would still overwrite itsself or not

i had few exe files in my win32 directory replaced with write protected empty .exe files and so far none of them changed

can anyone help me out? confirm? disagree? anything..
i know theres people that have more knowledge about it on this board.

[peterhuang913]

Why not just remove the spyware than keep it?

[Mak213]

Remove it and take steps so that you dont get it again. That is the best course of action. Rather than just leave it alone and risk the changes it becomes active again and doesn something you will regret later.

[raverx3m]

lol i dont think i explained it clearly
i do remove it from registry and all the files except
the exe files that show up in task manages
the ones that are actually running
i open it in notepad and erase all the contents of the file and save it as a read only exe file
but i dont know if most spyware has the ability to overwrite files that are write protected by windows.

[peterhuang913]

Originally Posted by raverx3m

lol i dont think i explained it clearly
i do remove it from registry and all the files except
the exe files that show up in task manages
the ones that are actually running
i open it in notepad and erase all the contents of the file and save it as a read only exe file
but i dont know if most spyware has the ability to overwrite files that are write protected by windows.

You have the wrong idea of removing spyware... Also, you can't open an exe file with Notepad to change it...

[raverx3m]

why not? i did it many times
open notepad and drag the exe file there and empty the contents
click save as and save it with .exe extension
so whats the right way to remove spyware?

[Osiris]

going thru my guide and posting a hijackthis log