Combating Spyware in the Enterprise

Forensic Detection and Removal • Chapter 6 253

take a little while, as it has to analyze every bit of information in the virtual

machine. You should create a snapshot immediately after booting a test com-

puter so that you have a set starting point to which to return.

After creating a snapshot, work with the operating system as normal.

Install common spyware detection tools such as HijackThis and perform basic

scans for spyw^are components. As you attempt to remove components and

you document your actions, you may notice that spyware applications may

confound your attempts and infect the workstation all over again. In this case,

you can simpl ...