This is a read-only archive. No new posts or registrations. Privacy Page
Software

seach files by manufacture

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Hi there. before I post my question, as per requested through the "how to post" thread, here is the top part of my HJT log showing my computer specs. Logfile of HijackThis v1.99.1 Scan saved at 2:41:14 PM, on 1/4/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Situation: I am having some sever memory issues, which I will not get into detail because I am already on the waiting list through the HJT forum, but my point is I do not know if the memory issue is dealing with that I might still have remaining files from older AV programs that I have used previously, or if it is a rootkit. So, while I am still waiting for someone to reply to my HJT log in the HJT forum, my first theroy I thought of doing is to see if it is possible to search for all files but filter it by Manufacture name. Is this possible? If so, then how? Or is this what the box "search for text in file" is for?
Hi killerbob,

Sure, you can search your files using any criterion that you wish.
Unfortunately, intuitively selecting file search criterion may or may not find all of what you hope to find.
But then, what are you going to do with what you do find? That is real the question.

There's plenty of stuff on any owner/user's machine that may look suspicious but actually be beneficial.
For instance, in Host Files and in Restricted Zone, an owner/user is likely to find items that not only appear suspicious but can be named with downright disgusting wording. Yet those files are most likely there to identify and alert your machine to prevent browsing to known risky location.

Similarly, your Windows Security Center has identification files to look for the existance of various firewall and AV utilities. Finding the "identification file" does not necessarily mean that the Firewall or AV utility is installed on the owner/user's machine, only that XP regualarly looks for and alerts if those applications are functional. Removing an "identification file" would not remove the identified application, but it would "cripple" XP's ability to recognize the presense and usefulness of such an application if it was encountered in the future.

Similarly, in the Registry, XP looks for items by scanning with long lists of common application names, most of which are never on any particular owner/user's machine. But XP still needs to be able to find and identify such applications if ever installed, in order to allow them to function usefully.

The Trick is to know "where" to look for applications and processes that may be running and influencing your machine's performance. That's where HJT and other advanced tools used by trained experts come into play. With the skill of a trained HJT advisor, coupled with HJT and other advanced tools to locate important files that would be overlooked or misunderstood without the appropriate tool and the necessary training.

A couple of examples:
You identify a "suspicious" file: sabprocenum.sys
This item is most often identified with SuperAdBlocker, which may have been deliberately installed for useful purposes. The same filename, examined from more advanced perspectives may actually be hazardous, but skilled individuals should be consulted to make that determination.

You do not identify another possibly "suspicious" file that does exist on your machine: SPTISRV.exe
This item is most often identified with a legitimate Sony application for video on demand, and finds that the file is neither dangerous, nor essential. Still other methods of examining the same file do occasionally itentify it as a backdoor/trojan.

What are you going to do when your search finds such files?

I highly recommend that you be patient in your waiting for response from a HJT advisor, and make no changes until receiving competent recommendations from that expert.

A final note:
You indicate that your machine has become slowed down to a crawl.
It appears that in order to post your HJT Log, you've "disabled" a variety of items in order improve your system's RAM resources. That's a good idea that results in unintentional bad consequences.
Those "disabled items" are still on and influencing your machine, but the HJT Expert will not be able to "see" them for analysis.

Rule of thumb: When posting a HJT Log, allow "all" services/processes/applications currently installed on your machine to be running active, so that their reference will appear in the HJT Log for appropriate analysis. (even if that means the machine is slowed to a crawl) (afterall, that's part of why you initially decided to seek help)

Later, after your HJT Advisor assists you in clearing your machine of Malware, please feel welcome to return here for additional assistence with the "system side" of any problem resolutions that remains.

Best Regards
Thank for explaining the files that I have mentioned in a previous thread. However, I think I have confused you with this thread. I am not looking for any viruses or rootkits on my own. I am looking for old AV programs that I have used in the past. The reason for this is because I cannot have more than one AV program running or installed when I install McAfee. I am having problems with McAfee as well as memory issues. In addition, new stuff has creeped up. The first thing that happen today was this, with no start-up files running, and with a fresh reboot, my memory was down to 20MB. The second thing that happen to me, which was just recent is, I cannot boot into Windows at all without selecting "safe mode with networking". I know this is very dangeruos, but I had to do something so that I could mention my problem, and ask how should I let the HJT forum people know what new things have crept up with-out replying to my HJT since it has been only 3 days.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI