new to this

Discussion in 'adware, spyware & hijack cleaning' started by foeshiznit, Mar 23, 2004.

Thread Status:
Not open for further replies.
  1. foeshiznit

    foeshiznit Registered Member

    Joined:
    Mar 23, 2004
    Posts:
    2
    Location:
    alaska
    Sorry if this is not the right forum, but im new to all of this and I used my tds that i downloaded for demo but i also have got spybot and this showed up! Avenue A, Inc.: Tracking cookie or cookie of tracking site (File, fixed)
    C:\Documents and Settings\Jason Woods\Cookies\jason woods@atdmt[1].txt

    Commission Junction: Tracking cookie or cookie of tracking site (File, fixed)
    C:\Documents and Settings\Jason Woods\Cookies\jason woods@qksrv[1].txt

    DoubleClick: Tracking cookie or cookie of tracking site (File, fixed)
    C:\Documents and Settings\Jason Woods\Cookies\jason woods@doubleclick[1].txt

    FastClick: Tracking cookie or cookie of tracking site (File, fixed)
    C:\Documents and Settings\Jason Woods\Cookies\jason woods@fastclick[2].txt

    Gator: Tracking cookie or cookie of tracking site (File, fixed)
    C:\Documents and Settings\Jason Woods\Cookies\jason woods@gator[1].txt


    --- Spybot-S&D version: 1.2 ---
    2004-02-26 Includes\Cookies.sbi
    2004-02-29 Includes\Dialer.sbi
    2004-02-29 Includes\Hijackers.sbi
    2004-02-26 Includes\Keyloggers.sbi
    2004-02-29 Includes\Malware.sbi
    2003-03-16 Includes\plugin-ignore.ini
    2004-03-09 Includes\Revision.sbi
    2004-02-26 Includes\Security.sbi
    2004-02-29 Includes\Spybots.sbi
    2003-03-16 Includes\Temporary.sbi
    2004-02-26 Includes\Tracks.uti
    2004-02-29 Includes\Trojans.sbi spybot Avenue A, Inc.: Tracking cookie or cookie of tracking site (File, fixed)
    C:\Documents and Settings\Jason Woods\Cookies\jason woods@atdmt[1].txt

    Commission Junction: Tracking cookie or cookie of tracking site (File, fixed)
    C:\Documents and Settings\Jason Woods\Cookies\jason woods@qksrv[1].txt

    DoubleClick: Tracking cookie or cookie of tracking site (File, fixed)
    C:\Documents and Settings\Jason Woods\Cookies\jason woods@doubleclick[1].txt

    FastClick: Tracking cookie or cookie of tracking site (File, fixed)
    C:\Documents and Settings\Jason Woods\Cookies\jason woods@fastclick[2].txt

    Gator: Tracking cookie or cookie of tracking site (File, fixed)
    C:\Documents and Settings\Jason Woods\Cookies\jason woods@gator[1].txt


    --- Spybot-S&D version: 1.2 ---
    2004-02-26 Includes\Cookies.sbi
    2004-02-29 Includes\Dialer.sbi
    2004-02-29 Includes\Hijackers.sbi
    2004-02-26 Includes\Keyloggers.sbi
    2004-02-29 Includes\Malware.sbi
    2003-03-16 Includes\plugin-ignore.ini
    2004-03-09 Includes\Revision.sbi
    2004-02-26 Includes\Security.sbi
    2004-02-29 Includes\Spybots.sbi
    2003-03-16 Includes\Temporary.sbi
    2004-02-26 Includes\Tracks.uti
    2004-02-29 Includes\Trojans.sbi If someone could help me figure this so i could understand it would be greatly appreciated! :D
     
  2. bigc73542

    bigc73542 Retired Moderator

    Joined:
    Sep 21, 2003
    Posts:
    23,873
    Location:
    SW. Oklahoma
    Please follow instructions at the link. Thank You


    http://www.wilderssecurity.com/showthread.php?t=15913
     
  3. Detox

    Detox Retired Moderator

    Joined:
    Feb 9, 2002
    Posts:
    8,507
    Location:
    Texas, USA
    Hi there, and welcome to Wilders!

    Firstly, keep in mind that TDS is an anti-trojan program. Spybot S&D, on the other hand, is a spyware removal application. The things listed in your post are tracking cookies, etc - "spyware" which was removed by Spybot. Nasty little stuff that watches what you do and reports back to the makers so he can figure out what kinda spam he wants to hit you with.

    Are you having some system trouble or just wondering what the stuff was that Spybot found?

    BTW - the immunize feature of Spybot and Javacool's SpywareBlaster are good at keeping that spyware stuff from getting on your machine to begin with ;-)
     
  4. foeshiznit

    foeshiznit Registered Member

    Joined:
    Mar 23, 2004
    Posts:
    2
    Location:
    alaska
    After Step 3

    I downloaded Logfile of HijackThis v1.97.7
    Scan saved at 10:50:06 PM, on 3/23/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Dell\EUSW\Support.exe
    C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
    C:\PROGRA~1\mcafee.com\agent\McAgent.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
    C:\Program Files\TDS3\TDS-3.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\ProcessGuard Free\procguard.exe
    c:\progra~1\mcafee.com\vso\mcvsescn.exe
    C:\WINDOWS\msagent\AgentSvr.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\ProcessGuard Free\pg_msgprot.exe
    C:\WINDOWS\wanmpsvc.exe
    c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    c:\progra~1\mcafee.com\vso\mcvsftsn.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Jason Woods\Local Settings\Temp\Temporary Directory 1 for hijackthis1977[1].zip\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/*http://www.yahoo.com/ext/search/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/ymsgr/*http://www.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/*http://www.yahoo.com/ext/search/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/ymsgr/*http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com
    O1 - Hosts: 64.91.255.87 www.dcsresearch.com
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
    O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
    O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll
    O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
    O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
    O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
    O4 - HKLM\..\Run: [TDS3] C:\Program Files\TDS3\TDS-3.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Startup: Process Guard Free.lnk = C:\Program Files\ProcessGuard Free\procguard.exe
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
    O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
    O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
    I in stalled these,adware 6.0, and also have spybot12 S&D i apperciate you helpin me :D but the problems i am expereincing for slow loging on ,web browsing and my mouse likes to move by its self all the time
     
  5. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,332
    Location:
    Netherlands
    Hi foeshiznit,

    Before you start please unzip hijackthis.exe to a folder of it´s own. The program creates backups in the folder it is in. In a Temp folder they easily disappear.

    Check the following items in HijackThis.
    Close all windows except HijackThis and click Fix checked:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/*http://www.yahoo.com/ext/search/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/ymsgr/*http://www.yahoo.com

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/*http://www.yahoo.com/ext/search/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/ymsgr/*http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com

    O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

    Then reboot and read this on how to prevent future infections: http://boards.cexx.org/viewtopic.php?t=957

    Regards,

    Pieter
     
Thread Status:
Not open for further replies.