1 reply to this topic

[chrism]

I found some wierd files on spy sweeper
is there any free programs to remove them or manual instructions?

Here is a log:

9:59 PM: Traces Found: 11
9:59 PM: Full Sweep has completed. Elapsed time 00:14:00
9:59 PM: File Sweep Complete, Elapsed Time: 00:10:47
9:59 PM: c:\documents and settings\~\local settings\application data\microsoft\messenger\************@hotmail.com\sharingmetadata\*******@gmail.com\dfsr\staging\cs{f0bf93b5-8f46-faef-84d1-6d8f7428ebbe}\11\11-{ebbc130d-1331-43e0-9cc1-f25cd423704b}-v11-{ebbc130d-1331-43e0-9cc1-f25cd423704b}-v11-partial.frx (ID = 0)
9:59 PM: Found System Monitor: potentially rootkit-masked files
9:56 PM: C:\WildMedia.exe (ID = 88929)
9:55 PM: C:\Documents and Settings\~\My Documents\Chris Stuff\freekgbkeylogger-193.exe (ID = 277882)
9:55 PM: Found System Monitor: kgb spy
9:51 PM: C:\System Volume Information\_restore{f29eeb5c-b7ae-4043-9af6-1cad32fa487c}\RP599\A0110970.exe (ID = 330988)
9:51 PM: Found Adware: whenu savenow
9:48 PM: Starting File Sweep
9:48 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
9:48 PM: Starting Cookie Sweep
9:48 PM: Registry Sweep Complete, Elapsed Time:00:00:33
9:48 PM: HKU\S-1-5-18\software\microsoft\internet explorer\extensions\cmdmapping\ || {120e090d-9136-4b78-8258-f0b44b4bd2ac} (ID = 127930)
9:48 PM: HKU\S-1-5-21-515967899-343818398-682003330-1003\software\microsoft\windows\currentversion\explorer\menuorder\start menu\programs\zango\ (ID = 554173)
9:48 PM: Found Adware: 180search assistant/zango
9:48 PM: HKU\S-1-5-21-515967899-343818398-682003330-1003\software\microsoft\internet explorer\main\ || updater2 (ID = 146720)
9:48 PM: Found Adware: wildmedia
9:48 PM: HKU\S-1-5-21-515967899-343818398-682003330-1003\software\pmx\ (ID = 127697)
9:48 PM: Found Adware: hotnow
9:48 PM: HKU\S-1-5-21-515967899-343818398-682003330-1003\software\microsoft\internet explorer\main\ || search bar_bak (ID = 115924)
9:48 PM: Found Adware: cws-aboutblank
9:48 PM: HKLM\system\currentcontrolset\enum\root\legacy_wintoolssvc\ (ID = 146518)
9:48 PM: Found Adware: websearch toolbar
9:48 PM: HKU\.default\software\microsoft\internet explorer\extensions\cmdmapping\ || {120e090d-9136-4b78-8258-f0b44b4bd2ac} (ID = 127909)
9:48 PM: Found Adware: ie driver
9:48 PM: Starting Registry Sweep
9:48 PM: Memory Sweep Complete, Elapsed Time: 00:02:36
9:45 PM: Starting Memory Sweep
9:45 PM: Sweep initiated using definitions version 758
9:45 PM: Spy Sweeper 5.0.7.1608 started
9:45 PM: | Start of Session, Tuesday, September 12, 2006 |
********
9:45 PM: | End of Session, Tuesday, September 12, 2006 |
9:43 PM: Common Ad Sites Shield: On
9:43 PM: Keylogger Shield: On
9:43 PM: IE Tracking Cookies Shield: Off
9:43 PM: IE Tracking Cookies Shield: On
9:43 PM: IE Tracking Cookies Shield: Off
9:42 PM: IE Tracking Cookies Shield: On
9:41 PM: Your definitions are up to date.
9:41 PM: Your spyware definitions have been updated.
Keylogger Shield: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites Shield: Off
Hosts File Shield: On
Spy Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
9:40 PM: Shield States
9:40 PM: Spyware Definitions: 734
9:40 PM: Spy Sweeper 5.0.7.1608 started
9:40 PM: Spy Sweeper 5.0.7.1608 started
9:40 PM: | Start of Session, Tuesday, September 12, 2006 |
********


Thank You

[rridgely]

Do you have ewido? I believe it would remove all of those.

Download Ewido Anti-Spyware

• Load Ewido and then click the Update tab at the top. Under Manual Update click Start update.
  
• After the update finishes (the status bar at the bottom will display "Update successful")
  
• Click on the Scanner tab at the top and then click on Complete System Scan
  
• Ewido will list any infections found on the left, when the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. Ewido will then display "All actions have been applied" on the right.
  
• Click on "Save Report", then "Save Report As". This will create a text file which you can then save to the Desktop and post back

[/code]

After you scan with it come back with the scan log and a hijack this log if you want.