Rob, If the software is nothing that the user actually needs to run, and it can't be removed normally, You could try using Lava soft's adaware to purge the system.=20 http://www.lavasoft.de/support/download/ It's default scan will go through the file system and the registry for known spyware *.dlls and executables, and then tell you what it found before performing any removal. You even have a backup option in the event that an item shows up for removal that you feel might actually be needed.=20 Another option, although less than ideal (though the overall setup here sounds less than ideal) might be to add some type of personal firewall to the user's system. Tinysoftware and zonealarm both have free rule based software firewall solutions that can be setup to stop un-wanted apps from getting out to the internet, while letting the rest of the system run as usual. Either of these options might save you the headache of having to re-install the OS and recover any user settings.=20 HTH J=20 -----Original Message----- From: Rob Beekmans [mailto:robbeekmans@xxxxxxxxxxxxx]=20 Sent: Sunday, May 18, 2003 2:36 AM To: thin@xxxxxxxxxxxxx Subject: [THIN] Re: OT: removing spy software Mark, I could do that but I don't want to block her completely....I will have =3D to eventually I guess. I'm gone discuss the reinstallation tommorow with her, or disconnect her from the network. I've tried several rules but this spy stuff is pretty good. Mind you we contacted the vendor for this software is illegal in Europe, =3D in the US everthing is allowed it seems as long as it is uesd on foreigners.......=3D20 Thanks for the reply... Grx Rob -----Oorspronkelijk bericht----- Van: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] Namens Mark CALLEJA Verzonden: zondag 18 mei 2003 11:22 Aan: thin@xxxxxxxxxxxxx Onderwerp: [THIN] Re: OT: removing spy software Rob Can you setup a rule on the ISA box to restrict the IP or workstation of the user?? Then they would not need to be in the domain. Have you simply denied the sites (a lot of overhead but is effective.. :) ) Regards Mark Calleja Coordinator Network Systems=3D20 Network Systems Dept Housing and Works (08) 9222 4941 mark.calleja@xxxxxxxxxxxxx >>> robbeekmans@xxxxxxxxxxxxx 18/05/2003 16:36:52 >>> Hei, =3D20 I'm faced with a network were more companies use one DSL connection. One =3D of the companies use Citrix, here we can control everythng, no add. =3D software can be installed by end users The other network though is win98 /XP =3D clients with no server, they use shares on each workstation to distribute data (foolish way). One of the clients on this network has "Realtime Spy" software installed, so it can be monitored from outside, this creates a =3D lot of internet traffic and it seems they can take control of her actions, = =3D we've seen downloads of over 200M of MP3 on several days. =3D20 I've tried all things to stop it but'it seems the only way is to =3D reinstall the pc. There is a ISA server acting as firewall but it sees the traffic =3D as UNKNOWN. The problem is that they are not in the domain where the ISA = =3D server is working, so I can't create good rules to stop it, even with several control software they only are designed for domain level. =3D20 What I'm looking for is a tool to stop any traffic from any pc IP based. =3D any help would be welcome =3D20 grx Rob ******************************************************** This Week's Sponsor - Emergent Online EOL's Universal Printer new Features include: Network Printing, Pagestreaming, 2400 DPI. No Client Software Required! http://www.go-eol.com/=3D20 ********************************************************** For Archives, to Unsubscribe, Subscribe or=3D20 set Digest or Vacation mode use the below link: http://thethin.net/citrixlist.cfm=3D20 ********************************************************************** This footnote confirms that this email message has been swept by =3D MIMEsweeper for the presence of computer viruses. ********************************************************************** ******************************************************** This Week's Sponsor - Emergent Online EOL's Universal Printer new Features include: Network Printing, Pagestreaming, 2400 DPI. No Client Software Required! http://www.go-eol.com/ ********************************************************** For Archives, to Unsubscribe, Subscribe or=3D20 set Digest or Vacation mode use the below link: http://thethin.net/citrixlist.cfm ******************************************************** This Week's Sponsor - Emergent Online EOL's Universal Printer new Features include: Network Printing, Pagestreaming, 2400 DPI. No Client Software Required! http://www.go-eol.com/ ********************************************************** For Archives, to Unsubscribe, Subscribe or=20 set Digest or Vacation mode use the below link: http://thethin.net/citrixlist.cfm ******************************************************** This Week's Sponsor - Emergent Online EOL's Universal Printer new Features include: Network Printing, Pagestreaming, 2400 DPI. No Client Software Required! http://www.go-eol.com/ ********************************************************** For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode use the below link: http://thethin.net/citrixlist.cfm