Tech Support Forum - View Single Post - Help: Trojan.downloader.small.cml, infection

G-Man89 · 08-03-2006, 01:28 PM

Here are the results from my last Spyware Scan which was yesterday:

Scans (basic information only):

Scan Results:
scan start: 02/08/2006 11:55:26 AM
scan stop: 02/08/2006 12:30:07 PM
scanned items: 169788
found items: 83
found and ignored: 0
tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Hosts Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner

Infection Name Location Risk
BearShare C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\BearShare.lnk Info & PUAs
Tracking Cookie(s) C:\Documents and Settings\Dr Damdam\Cookies\dr damdam@2o7[1].txt Low
Tracking Cookie(s) C:\Documents and Settings\Dr Damdam\Cookies\dr damdam@atdmt[2].txt Low
Tracking Cookie(s) C:\Documents and Settings\Dr Damdam\Cookies\dr damdam@stat.onestat[2].txt Low
Advertising C:\Documents and Settings\Dr Damdam\Cookies\dr damdam@statcounter[2].txt Low
Tracking Cookie(s) C:\Documents and Settings\Dr Damdam\Cookies\dr damdam@tribalfusion[2].txt Low
BearShare C:\Documents and Settings\Dr Damdam\Desktop\BearShare.lnk Info & PUAs
I-Search Desktop Search Toolbar C:\RECYCLER\NPROTECT\01898988.VBS Elevated
TargetSavers C:\RECYCLER\NPROTECT\01899011 High
TargetSavers C:\RECYCLER\NPROTECT\01899013 High
TargetSavers C:\RECYCLER\NPROTECT\01899021.exe High
Zquest C:\RECYCLER\NPROTECT\01899022.exe Medium
AproposMedia C:\RECYCLER\NPROTECT\01899039.dll Medium
AproposMedia C:\RECYCLER\NPROTECT\01899040._ Medium
BearShare E:\Program Files\BearShare\BSidle.dll Info & PUAs
BearShare E:\Program Files\BearShare\Webstats.exe Info & PUAs
BearShare E:\RECYCLER\NPROTECT\00040765.exe Info & PUAs
BearShare HKCR\gnu\DefaultIcon## Info & PUAs
BearShare HKCR\gnu\shell\open\command## Info & PUAs
BearShare HKCR\gnufile\shell\open\command## Info & PUAs
BearShare HKCR\gnutella\DefaultIcon## Info & PUAs
BearShare HKCR\gnutella\shell\open\command## Info & PUAs
BearShare HKCU\AppEvents\EventLabels\BearShareChatNotifyMsg Info & PUAs
BearShare HKCU\AppEvents\EventLabels\BearShareChatNotifyMsg## Info & PUAs
BearShare HKCU\AppEvents\Schemes\Apps\BearShare Info & PUAs
BearShare HKCU\AppEvents\Schemes\Apps\BearShare## Info & PUAs
BearShare HKCU\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg Info & PUAs
BearShare HKCU\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg## Info & PUAs
BearShare HKCU\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current Info & PUAs
BearShare HKCU\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current## Info & PUAs
BearShare HKLM\SOFTWARE\BearShare Info & PUAs
BearShare HKLM\SOFTWARE\BearShare## Info & PUAs
BearShare HKLM\SOFTWARE\BearShare##InstallDir Info & PUAs
BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare Info & PUAs
BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare## Info & PUAs
BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare##DdeApplication Info & PUAs
BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare##DdeTopic Info & PUAs
BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare##DefaultIcon Info & PUAs
BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare##Description Info & PUAs
BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare##ShellExecute Info & PUAs
BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare\Type Info & PUAs
BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare\Type## Info & PUAs
BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare\Type##urn:bitprint Info & PUAs
BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare\Type##urn:sha1 Info & PUAs
BearShare HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17} Info & PUAs
BearShare HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17}## Info & PUAs
BearShare HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17}##ComponentID Info & PUAs
BearShare HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17}##IsInstalled Info & PUAs
BearShare HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17}##Locale Info & PUAs
BearShare HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17}##Version Info & PUAs
BearShare HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare Info & PUAs
BearShare HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare## Info & PUAs
BearShare HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare##DisplayIcon Info & PUAs
BearShare HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare##DisplayName Info & PUAs
BearShare HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare##DisplayVersion Info & PUAs
BearShare HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare##HelpLink Info & PUAs
BearShare HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare##Publisher Info & PUAs
BearShare HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare##UninstallString Info & PUAs
BearShare HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare##URLInfoAbout Info & PUAs
BearShare HKU\.DEFAULT\AppEvents\EventLabels\BearShareChatNotifyMsg Info & PUAs
BearShare HKU\.DEFAULT\AppEvents\EventLabels\BearShareChatNotifyMsg## Info & PUAs
BearShare HKU\.DEFAULT\AppEvents\Schemes\Apps\BearShare Info & PUAs
BearShare HKU\.DEFAULT\AppEvents\Schemes\Apps\BearShare## Info & PUAs
BearShare HKU\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg Info & PUAs
BearShare HKU\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg## Info & PUAs
BearShare HKU\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current Info & PUAs
BearShare HKU\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current## Info & PUAs
BearShare HKU\S-1-5-18\AppEvents\EventLabels\BearShareChatNotifyMsg Info & PUAs
BearShare HKU\S-1-5-18\AppEvents\EventLabels\BearShareChatNotifyMsg## Info & PUAs
BearShare HKU\S-1-5-18\AppEvents\Schemes\Apps\BearShare Info & PUAs
BearShare HKU\S-1-5-18\AppEvents\Schemes\Apps\BearShare## Info & PUAs
BearShare HKU\S-1-5-18\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg Info & PUAs
BearShare HKU\S-1-5-18\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg## Info & PUAs
BearShare HKU\S-1-5-18\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current Info & PUAs
BearShare HKU\S-1-5-18\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current## Info & PUAs
BearShare HKU\S-1-5-21-1123561945-115176313-725345543-1003\AppEvents\EventLabels\BearShareChatNotifyMsg Info & PUAs
BearShare HKU\S-1-5-21-1123561945-115176313-725345543-1003\AppEvents\EventLabels\BearShareChatNotifyMsg## Info & PUAs
BearShare HKU\S-1-5-21-1123561945-115176313-725345543-1003\AppEvents\Schemes\Apps\BearShare Info & PUAs
BearShare HKU\S-1-5-21-1123561945-115176313-725345543-1003\AppEvents\Schemes\Apps\BearShare## Info & PUAs
BearShare HKU\S-1-5-21-1123561945-115176313-725345543-1003\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg Info & PUAs
BearShare HKU\S-1-5-21-1123561945-115176313-725345543-1003\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg## Info & PUAs
BearShare HKU\S-1-5-21-1123561945-115176313-725345543-1003\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current Info & PUAs
BearShare HKU\S-1-5-21-1123561945-115176313-725345543-1003\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current## Info & PUAs

Bearshare seems to come up a lot so I think all they're referring to as a threat is Bearshare.

08-03-2006, 01:28 PM	#13 (permalink)
G-Man89 Registered User Join Date: Jul 2006 Posts: 18 OS: WinXP	Here are the results from my last Spyware Scan which was yesterday: Scans (basic information only): Scan Results: scan start: 02/08/2006 11:55:26 AM scan stop: 02/08/2006 12:30:07 PM scanned items: 169788 found items: 83 found and ignored: 0 tools used: General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Hosts Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner Infection Name Location Risk BearShare C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\BearShare.lnk Info & PUAs Tracking Cookie(s) C:\Documents and Settings\Dr Damdam\Cookies\dr damdam@2o7[1].txt Low Tracking Cookie(s) C:\Documents and Settings\Dr Damdam\Cookies\dr damdam@atdmt[2].txt Low Tracking Cookie(s) C:\Documents and Settings\Dr Damdam\Cookies\dr damdam@stat.onestat[2].txt Low Advertising C:\Documents and Settings\Dr Damdam\Cookies\dr damdam@statcounter[2].txt Low Tracking Cookie(s) C:\Documents and Settings\Dr Damdam\Cookies\dr damdam@tribalfusion[2].txt Low BearShare C:\Documents and Settings\Dr Damdam\Desktop\BearShare.lnk Info & PUAs I-Search Desktop Search Toolbar C:\RECYCLER\NPROTECT\01898988.VBS Elevated TargetSavers C:\RECYCLER\NPROTECT\01899011 High TargetSavers C:\RECYCLER\NPROTECT\01899013 High TargetSavers C:\RECYCLER\NPROTECT\01899021.exe High Zquest C:\RECYCLER\NPROTECT\01899022.exe Medium AproposMedia C:\RECYCLER\NPROTECT\01899039.dll Medium AproposMedia C:\RECYCLER\NPROTECT\01899040._ Medium BearShare E:\Program Files\BearShare\BSidle.dll Info & PUAs BearShare E:\Program Files\BearShare\Webstats.exe Info & PUAs BearShare E:\RECYCLER\NPROTECT\00040765.exe Info & PUAs BearShare HKCR\gnu\DefaultIcon## Info & PUAs BearShare HKCR\gnu\shell\open\command## Info & PUAs BearShare HKCR\gnufile\shell\open\command## Info & PUAs BearShare HKCR\gnutella\DefaultIcon## Info & PUAs BearShare HKCR\gnutella\shell\open\command## Info & PUAs BearShare HKCU\AppEvents\EventLabels\BearShareChatNotifyMsg Info & PUAs BearShare HKCU\AppEvents\EventLabels\BearShareChatNotifyMsg## Info & PUAs BearShare HKCU\AppEvents\Schemes\Apps\BearShare Info & PUAs BearShare HKCU\AppEvents\Schemes\Apps\BearShare## Info & PUAs BearShare HKCU\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg Info & PUAs BearShare HKCU\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg## Info & PUAs BearShare HKCU\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current Info & PUAs BearShare HKCU\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current## Info & PUAs BearShare HKLM\SOFTWARE\BearShare Info & PUAs BearShare HKLM\SOFTWARE\BearShare## Info & PUAs BearShare HKLM\SOFTWARE\BearShare##InstallDir Info & PUAs BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare Info & PUAs BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare## Info & PUAs BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare##DdeApplication Info & PUAs BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare##DdeTopic Info & PUAs BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare##DefaultIcon Info & PUAs BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare##Description Info & PUAs BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare##ShellExecute Info & PUAs BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare\Type Info & PUAs BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare\Type## Info & PUAs BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare\Type##urn:bitprint Info & PUAs BearShare HKLM\SOFTWARE\Magnet\Handlers\Bearshare\Type##urn:sha1 Info & PUAs BearShare HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17} Info & PUAs BearShare HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17}## Info & PUAs BearShare HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17}##ComponentID Info & PUAs BearShare HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17}##IsInstalled Info & PUAs BearShare HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17}##Locale Info & PUAs BearShare HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17}##Version Info & PUAs BearShare HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare Info & PUAs BearShare HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare## Info & PUAs BearShare HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare##DisplayIcon Info & PUAs BearShare HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare##DisplayName Info & PUAs BearShare HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare##DisplayVersion Info & PUAs BearShare HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare##HelpLink Info & PUAs BearShare HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare##Publisher Info & PUAs BearShare HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare##UninstallString Info & PUAs BearShare HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare##URLInfoAbout Info & PUAs BearShare HKU\.DEFAULT\AppEvents\EventLabels\BearShareChatNotifyMsg Info & PUAs BearShare HKU\.DEFAULT\AppEvents\EventLabels\BearShareChatNotifyMsg## Info & PUAs BearShare HKU\.DEFAULT\AppEvents\Schemes\Apps\BearShare Info & PUAs BearShare HKU\.DEFAULT\AppEvents\Schemes\Apps\BearShare## Info & PUAs BearShare HKU\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg Info & PUAs BearShare HKU\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg## Info & PUAs BearShare HKU\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current Info & PUAs BearShare HKU\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current## Info & PUAs BearShare HKU\S-1-5-18\AppEvents\EventLabels\BearShareChatNotifyMsg Info & PUAs BearShare HKU\S-1-5-18\AppEvents\EventLabels\BearShareChatNotifyMsg## Info & PUAs BearShare HKU\S-1-5-18\AppEvents\Schemes\Apps\BearShare Info & PUAs BearShare HKU\S-1-5-18\AppEvents\Schemes\Apps\BearShare## Info & PUAs BearShare HKU\S-1-5-18\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg Info & PUAs BearShare HKU\S-1-5-18\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg## Info & PUAs BearShare HKU\S-1-5-18\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current Info & PUAs BearShare HKU\S-1-5-18\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current## Info & PUAs BearShare HKU\S-1-5-21-1123561945-115176313-725345543-1003\AppEvents\EventLabels\BearShareChatNotifyMsg Info & PUAs BearShare HKU\S-1-5-21-1123561945-115176313-725345543-1003\AppEvents\EventLabels\BearShareChatNotifyMsg## Info & PUAs BearShare HKU\S-1-5-21-1123561945-115176313-725345543-1003\AppEvents\Schemes\Apps\BearShare Info & PUAs BearShare HKU\S-1-5-21-1123561945-115176313-725345543-1003\AppEvents\Schemes\Apps\BearShare## Info & PUAs BearShare HKU\S-1-5-21-1123561945-115176313-725345543-1003\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg Info & PUAs BearShare HKU\S-1-5-21-1123561945-115176313-725345543-1003\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg## Info & PUAs BearShare HKU\S-1-5-21-1123561945-115176313-725345543-1003\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current Info & PUAs BearShare HKU\S-1-5-21-1123561945-115176313-725345543-1003\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current## Info & PUAs Bearshare seems to come up a lot so I think all they're referring to as a threat is Bearshare.