confused with spyware

lynandie · 05-21-2009, 12:11 AM

I've been researching spyware protection downloads. Cyber-defender was one that got high ratings, was suppose to be free scan so i downloaded and it found 17 infections in my registry. Not able to fix without paying cyber-defender fees. I researched more and found spyzooka, downloaded, scanned and it also found infections, but what troubles me is in those infections it found (Win32 cyberdefender) and spyzooka says it a malware. Confused!!! is it indeed malware? which spyware app. should i use? Help!

Rahina · 05-21-2009, 05:31 AM

Hello there!

Download DDS and save it to your desktop from Here
Disable any script blocker, and then double click dds.scr to run the tool.
When done, DDS will open two (2) logs:
DDS.txt
Attach.txt

Save both reports to your desktop. Post them back to your topic.

lynandie · 05-21-2009, 05:19 PM

DDS (Ver_09-05-14.01) - NTFSx86
Run by Linda at 17:39:30.21 on Thu 05/21/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.157 [GMT -4:00]

AV: ZoneAlarm Security Suite Antivirus *On-access scanning enabled* (Updated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
AV: CyberDefender Internet Security *On-access scanning enabled* (Updated) {EC29E618-5105-491F-8A8E-40563B36F02D}
FW: ZoneAlarm Security Suite Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
C:\Documents and Settings\Linda\Desktop\dds.pif

============== Pseudo HJT Report ===============

uDefault_Page_URL = hxxp://www.msn.com
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [CyberDefender Early Detection Center] "c:\program files\cyberdefender\antispyware\cdasaf.exe" /minimize
mRun: [C-Media Mixer] Mixer.exe /startup
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpimag~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/9/b/d/9bdc68ef-6a9f-4505-8fb8-d0d2d160e512/LegitCheckControl.cab
DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1144888855486
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - hxxp://a19.g.akamai.net/7/19/7125/1452/ftp.coupons.com/r3302/cpbrkpie.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

============= SERVICES / DRIVERS ===============

R1 KLIF;KLIF;c:\windows\system32\drivers\klif.sys [2009-4-2 150544]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2006-4-12 353672]
R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-1-14 226656]
R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
S3 CDAVFS;CDAVFS;c:\windows\system32\drivers\CDAVFS.sys [2009-5-20 67424]

=============== Created Last 30 ================

2009-05-20 20:55 68 a------- c:\windows\av_affiliate.ini
2009-05-20 20:55 68 a------- c:\windows\as_affiliate.ini
2009-05-20 20:50 67,424 a------- c:\windows\system32\drivers\CDAVFS.sys
2009-05-20 20:48 <DIR> --d----- c:\program files\CyberDefender
2009-05-14 18:26 14,592 ac------ c:\windows\system32\dllcache\kbdhid.sys
2009-05-14 18:26 14,592 a------- c:\windows\system32\drivers\kbdhid.sys
2009-05-03 19:58 <DIR> --d----- c:\documents and settings\linda\Tracing
2009-05-03 19:49 <DIR> --d----- c:\program files\Microsoft
2009-05-03 19:41 <DIR> --d----- c:\program files\common files\Windows Live
2009-04-25 01:30 <DIR> --dsh--- c:\documents and settings\linda\IECompatCache

==================== Find3M ====================

2009-05-21 17:40 440,570,400 a--sh--- c:\windows\system32\drivers\fidbox.dat
2009-05-21 17:31 5,899,856 a--sh--- c:\windows\system32\drivers\fidbox.idx
2009-05-05 14:31 4,212 a---h--- c:\windows\system32\zllictbl.dat
2009-03-31 19:20 72,584 a------- c:\windows\zllsputility.exe
2009-03-31 19:20 1,221,512 a------- c:\windows\system32\zpeng25.dll
2009-03-13 21:30 410,984 a------- c:\windows\system32\deploytk.dll
2009-03-08 04:34 914,944 a------- c:\windows\system32\wininet.dll
2009-03-08 04:34 43,008 a------- c:\windows\system32\licmgr10.dll
2009-03-08 04:33 18,944 a------- c:\windows\system32\corpol.dll
2009-03-08 04:33 420,352 a------- c:\windows\system32\vbscript.dll
2009-03-08 04:32 72,704 a------- c:\windows\system32\admparse.dll
2009-03-08 04:32 71,680 a------- c:\windows\system32\iesetup.dll
2009-03-08 04:31 34,816 a------- c:\windows\system32\imgutil.dll
2009-03-08 04:31 48,128 a------- c:\windows\system32\mshtmler.dll
2009-03-08 04:31 45,568 a------- c:\windows\system32\mshta.exe
2009-03-08 04:22 156,160 a------- c:\windows\system32\msls31.dll
2009-03-06 10:22 284,160 a------- c:\windows\system32\pdh.dll
2008-09-24 01:47 32,768 ac-sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008092420080925\index.dat

============= FINISH: 17:40:49.65 ===============

Rahina · 05-22-2009, 09:19 AM

Hi there!

Please read this post completely, it may make it easier for you if you copy and paste this post to a new text document or print it for reference later.

( 1 )

Please download the following NOW:

Antivir PersonalEdition Classic

And save it in your Programfiles, do not run it yet!

Installation manual located here: http://www.drtweak.com/index.php?topic=196.0

It helps alot IF you are able to acess these instructions using another pc!

( 2 )

I do not suggest you use any of those two spyware apps you mentioned in your first post. They do not ring a bell for me and i know better Security software which replaces those two you have now.

Please go to add/remove in the control panel and remove

Cyber-Defender

___________

You should now have One Antivirus downloaded to your programfiles map. Do not run it yet!

Disconnect your internet connection by unplugging your internet cabel from your pc, if possible!

Now Re-start your computer normally.

( 3 )

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts. If you choose to install more than one antivirus program on your computer, then only one of them should be active in memory at a time.

Go to Programfiles and Install Antivir Avira Antivirus that you downloaded.

When it is installed do the following:

Download RSIT by random/random and save it to your desktop.
Double click RSIT.exe to start the tool and click Continue at the disclaimer.
When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized.
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of log.txt here.
Please attach info.txt to your post.

To attach a file to a new post, simply

Click the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, and
copy and paste the following into the "Upload File from your Computer" box:
C:\rsit\info.txt
Click Upload.

If there was something in these instructions that you did not understand please ask for help and we'll continue after that.

' R

05-21-2009, 12:11 AM	#1 (permalink)
lynandie Registered User Join Date: May 2009 Posts: 2 OS: xp	confused with spyware I've been researching spyware protection downloads. Cyber-defender was one that got high ratings, was suppose to be free scan so i downloaded and it found 17 infections in my registry. Not able to fix without paying cyber-defender fees. I researched more and found spyzooka, downloaded, scanned and it also found infections, but what troubles me is in those infections it found (Win32 cyberdefender) and spyzooka says it a malware. Confused!!! is it indeed malware? which spyware app. should i use? Help!

05-21-2009, 05:31 AM	#2 (permalink)
Rahina Analyst, Security Team Join Date: Feb 2007 Posts: 252 OS: Windows XP Pro	Re: confused with spyware Hello there! Download DDS and save it to your desktop from Here Disable any script blocker, and then double click dds.scr to run the tool. When done, DDS will open two (2) logs: DDS.txt Attach.txt Save both reports to your desktop. Post them back to your topic. __________________ I fail to reply within 48 hours feel free to send me a PM. Last edited by Rahina; 05-21-2009 at 05:54 AM.

05-22-2009, 09:19 AM	#4 (permalink)
Rahina Analyst, Security Team Join Date: Feb 2007 Posts: 252 OS: Windows XP Pro	Re: confused with spyware Hi there! Please read this post completely, it may make it easier for you if you copy and paste this post to a new text document or print it for reference later. ( 1 ) Please download the following NOW: Antivir PersonalEdition Classic And save it in your Programfiles, do not run it yet! Installation manual located here: http://www.drtweak.com/index.php?topic=196.0 It helps alot IF you are able to acess these instructions using another pc! ( 2 ) I do not suggest you use any of those two spyware apps you mentioned in your first post. They do not ring a bell for me and i know better Security software which replaces those two you have now. Please go to add/remove in the control panel and remove Cyber-Defender ___________ You should now have One Antivirus downloaded to your programfiles map. Do not run it yet! Disconnect your internet connection by unplugging your internet cabel from your pc, if possible! Now Re-start your computer normally. ( 3 ) It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts. If you choose to install more than one antivirus program on your computer, then only one of them should be active in memory at a time. Go to Programfiles and Install Antivir Avira Antivirus that you downloaded. When it is installed do the following: Download RSIT by random/random and save it to your desktop. Double click RSIT.exe to start the tool and click Continue at the disclaimer. When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized. Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of log.txt here. Please attach info.txt to your post. To attach a file to a new post, simply Click the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, and copy and paste the following into the "Upload File from your Computer" box: C:\rsit\info.txt Click Upload. If there was something in these instructions that you did not understand please ask for help and we'll continue after that. ' R __________________ I fail to reply within 48 hours feel free to send me a PM. Last edited by Rahina; 05-22-2009 at 09:21 AM.