Before I go to HJT

Joeb102072 · 07-31-2006, 09:33 AM

I just wanted some adivise, I dont have a problem at all with going through all the steps listed in the HJT thread but my issue maybe a simple explanation and may not need all that right now. So, I figured I would throw it out there and see if I can get some advise. I have all the latest spyware definitions I use Spy Sweeper and McAfee Total Protection for Small Buisness. Always updated and frequent scans are scheduled. Well, maybe not as frequent as it should be for Spy Sweeper but McAfee is always on. So I did a spyware scan last week and my results came up with at least 11 threats detected. I told the sweep to quarantine and not allow them at start up. It went through the process and all seemed ok. But when I went back in to check things out again I noticed that those 11 threats are allowed to start when windows starts. I even tried looking in the directories that Spy Sweeper has detected these start up programs in and they dont exist. Is there a problem with spysweeper or is there a hidden file here that is hosting all of these threats. I find it odd that no matter what when I go back to spysweeper settings the boxes I checked to deny the start up of these programs are all check as being allowed to start. Any Suggestions? Thanks.

dorts · 07-31-2006, 09:43 AM

Hi,

Can you give us more information on the threats detected? Like names of them, file paths etc.

Geekgirl · 07-31-2006, 09:43 AM

Yes plz look over the First Steps at Removing Malware , I also suggested this in your other thread.

Joeb102072 · 07-31-2006, 10:15 AM

I will go and start the process of removing all spyware and Malware as suggested. In fact I am going to do it right after this post. As for the names, here they are: ist istbar, 180search assistant/zango, winad, ieplugin, altnet, topsearch, exact bullseye, ist powerscan, ist surf accuracy, webrebates, and one more thats listed but doesnt give a threat level and it says "NoSpyName" kinda weird. all the above have multiple associated files attached to them. Here are where most of them claim to reside.
HKLM\software\micrsoft\windows\currentversion\run\ || "adware name" ist service, media gateway, etc....

The other is C:\system volume information\_ restore{"huge alpha numeric line here"}rp706\a0107481.exe

Thanks,
Joe

dorts · 08-01-2006, 01:39 AM

I would recommend you to follow the steps in the link Geekgirl posted and post a HJT log.

07-31-2006, 09:33 AM	#1 (permalink)
Joeb102072 Registered User Join Date: Jul 2006 Posts: 27 OS: Win XP Pro	Before I go to HJT I just wanted some adivise, I dont have a problem at all with going through all the steps listed in the HJT thread but my issue maybe a simple explanation and may not need all that right now. So, I figured I would throw it out there and see if I can get some advise. I have all the latest spyware definitions I use Spy Sweeper and McAfee Total Protection for Small Buisness. Always updated and frequent scans are scheduled. Well, maybe not as frequent as it should be for Spy Sweeper but McAfee is always on. So I did a spyware scan last week and my results came up with at least 11 threats detected. I told the sweep to quarantine and not allow them at start up. It went through the process and all seemed ok. But when I went back in to check things out again I noticed that those 11 threats are allowed to start when windows starts. I even tried looking in the directories that Spy Sweeper has detected these start up programs in and they dont exist. Is there a problem with spysweeper or is there a hidden file here that is hosting all of these threats. I find it odd that no matter what when I go back to spysweeper settings the boxes I checked to deny the start up of these programs are all check as being allowed to start. Any Suggestions? Thanks.

07-31-2006, 09:43 AM	#2 (permalink)
dorts Analyst, Security Team Join Date: Mar 2006 Location: Singapore Posts: 1,599 OS: Windows XP SP2 My System	Hi, Can you give us more information on the threats detected? Like names of them, file paths etc. __________________ If you think TSF have helped you, please kindly donate to TSF and help keep this site free to all.

07-31-2006, 09:43 AM	#3 (permalink)
Geekgirl Assistant Manager, Microsoft Support Join Date: Jan 2005 Location: Six-burgh, Pennsylvania Posts: 14,171 OS: XP Home SP3/XP Pro SP3/Vista Ultimate SP2/Windows 7 Professional	Yes plz look over the First Steps at Removing Malware , I also suggested this in your other thread. __________________ Compare NOD32 to your current antivirus and anti-spyware solution, HERE How to back up and restore the registry in Windows XP and Windows Vista Or Windows 7 How to back up and restore the registry in Windows 98/ ME / NT 4.0 / 2000 I DO NOT ACCEPT EMAILS AND WILL NOT REPLY TO THEM !!!!! TSF DOES NOT SUPPORT ASSISTANCE THROUGH EMAIL OR PRIVATE MESSAGES, PLEASE KEEP ALL QUESTIONS IN THE OPEN FORUM *The Pittsburgh Steelers - 6 X Superbowl Champions !!!!!!!* *The Pittsburgh Penguins - 2009 Stanley Cup Champions !!!!!!!*

08-01-2006, 01:39 AM	#5 (permalink)
dorts Analyst, Security Team Join Date: Mar 2006 Location: Singapore Posts: 1,599 OS: Windows XP SP2 My System	I would recommend you to follow the steps in the link Geekgirl posted and post a HJT log. __________________ If you think TSF have helped you, please kindly donate to TSF and help keep this site free to all.

07-31-2006, 10:15 AM	#4 (permalink)
Joeb102072 Registered User Join Date: Jul 2006 Posts: 27 OS: Win XP Pro	I will go and start the process of removing all spyware and Malware as suggested. In fact I am going to do it right after this post. As for the names, here they are: ist istbar, 180search assistant/zango, winad, ieplugin, altnet, topsearch, exact bullseye, ist powerscan, ist surf accuracy, webrebates, and one more thats listed but doesnt give a threat level and it says "NoSpyName" kinda weird. all the above have multiple associated files attached to them. Here are where most of them claim to reside. HKLM\software\micrsoft\windows\currentversion\run\ \|\| "adware name" ist service, media gateway, etc.... The other is C:\system volume information\_ restore{"huge alpha numeric line here"}rp706\a0107481.exe Thanks, Joe