Combating Spyware in the Enterprise

238 Chapter 6 • Forensic Detection and Removal

HiJackFree also features the ability to view applications that are tied in

with Windows Explorer through the Explorer Addons category. This list also

includes all BHOs installed on the system. Although HiJackFree does not let

you remove any data displayed, you can double-click on any suspicious item

and go directly to the Registry key in which the data is stored. From here

you can choose to investigate the data more deeply and remove it if necessary.

As with other tools, HiJackFree also allows you to view the Windows

Hosts file to detect any malicious manual domain resolutions. From within

thi