Sign In | Register
Side-Effect Scanner Help
Below are the guidelines on Side-Effect syntax that you will need to provide.

Full Path and Filename

The specified full path and filename should ideally start from one of the following prefixes:
  • c:\
  • %CommonAppData%
  • %ProgramFiles%
  • %System%
  • %Windir%
  • %Programs%
  • %StartMenu%
  • %DesktopDir%
  • %DownloadedProgramFiles%
  • %CommonPrograms%
  • %CommonDocuments%
  • %Temp%
  • %UserProfile%
  • %Startup%
  • %CommonDesktopDir%
  • %AppData%
  • %Favorites%
  • %Recent%
  • %InternetCache%
  • %LocalSettings%
  • %LocalAppData%
  • %FontsDir%
  • %CommonStartMenu%
  • %MyDocuments%
  • %CommonStartup%
  • %CommonFavorites%
NOTES: 
The prefixes above specify Shell Folders. For example, "%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

EXAMPLE:
Try searching for "%system%\adfmon.exe" or "%temp%\policyexplore.exe"

Registry Key

Ideally, the specified registry key should be copied from Regedit.exe (select the key, click Edit, click Copy Key Name).
If your registry key starts from an abbreviated registry hive, such as HKLM, Side Effect Scanner will try to normalise your key. For example, it will replace HKLM with HKEY_LOCAL_MACHINE.

For example, try searching for "HKCU\Software\Win_Fixer_2006"

CLSID

A universally unique identifier (UUID) that identifies a COM component should be ideally be provided in the following syntax:
{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}

For example, try searching for "{A646CE7E-951E-44D1-B93C-F7136DA41E58}"

URL

Side Effect Scanner allows you to check is some URL is used by any known threat.

For example, try searching for "adwarefinder.com"

Any Side Effect (Default)

Any Side Effect syntax combines the syntax of all Side Effect categories listed above.

Get Back to the Side Effect Scanner