Grr Spyware

Well good luck with school…. heres the log….. Thanks Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. Find.bat is running from: C:\Documents and Settings\[removed]\My Documents\Downloads\FindIT\Find It NT-2K-XP ——- System Files in System32 Directory ——- Volume in drive C is DSK1_VOL1 Volume Serial Number is 69DD-EC80 Directory of C:\WINNT\System32 01/03/2005 01:11p dllcache 09/30/1999 07:21p 166,672 mstext35.dll 09/28/1999 09:42p 1,050,896 msjet35.dll 09/09/1999 10:06p 252,688 msexcl35.dll 09/09/1999 10:06p 168,720 msltus35.dll 08/25/1999 02:57p 415,504 msrepl35.dll 06/10/1999 09:34a 24,848 msjter35.dll 06/10/1999 09:34a 123,664 msjint35.dll 06/07/1999 06:59p 250,128 mspdox35.dll 04/25/1999 05:00p 287,504 Msxbse35.dll 04/25/1999 05:00p 368,912 Vbar332.dll 04/25/1999 05:00p 252,176 Msrd2x35.dll 11 File(s) 3,361,712 bytes 1 Dir(s) 87,270,633,472 bytes free ——- Hidden Files in System32 Directory ——- Volume in drive C is DSK1_VOL1 Volume Serial Number is 69DD-EC80 Directory of C:\WINNT\System32 01/07/2005 12:28p 4,212 zllictbl.dat 01/03/2005 01:11p dllcache 01/04/2004 03:14p GroupPolicy 01/04/2004 03:08p 21,692 folder.htt 01/04/2004 03:08p 271 desktop.ini 3 File(s) 26,175 bytes 2 Dir(s) 87,270,633,472 bytes free ———- Files Named "Guard" ————- Volume in drive C is DSK1_VOL1 Volume Serial Number is 69DD-EC80 Directory of C:\WINNT\System32 ——— Temp Files in System32 Directory ——– Volume in drive C is DSK1_VOL1 Volume Serial Number is 69DD-EC80 Directory of C:\WINNT\System32 12/07/1999 07:00a 2,577 CONFIG.TMP 1 File(s) 2,577 bytes 0 Dir(s) 87,270,629,376 bytes free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] ———— Keys Under Notify ———— REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] "DLLName"="Ati2evxx.dll" "Asynchronous"=dword:00000000 "Impersonate"=dword:00000001 "Lock"="AtiLockEvent" "Logoff"="AtiLogoffEvent" "Logon"="AtiLogonEvent" "Disconnect"="AtiDisConnectEvent" "Reconnect"="AtiReConnectEvent" "Safe"=dword:00000000 "Shutdown"="AtiShutdownEvent" "StartScreenSaver"="AtiStartScreenSaverEvent" "StartShell"="AtiStartShellEvent" "Startup"="AtiStartupEvent" "StopScreenSaver"="AtiStopScreenSaverEvent" "Unlock"="AtiUnLockEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif] "DLLName"="wzcdlg.dll" "Logon"="WZCEventLogon" "Logoff"="WZCEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000000 —————— Locate.com Results —————— C:\WINNT\SYSTEM32\ zllictbl.dat Fri Jan 7 2005 12:28:46p …H. 4,212 4.11 K 1 item found: 1 file, 0 directories. Total of file sizes: 4,212 bytes 4.11 K ———— Strings.exe Qoologic Results ———— ————– Strings.exe Aspack Results ————- —————– HKLM Run Key —————— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Synchronization Manager"="mobsync.exe /logon" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "UpdReg"="C:\\WINNT\\Updreg.exe" "Jet Detection"="C:\\Program Files\\Creative\\SBAudigy\\PROGRAM\\ADGJDet.exe" "IntelliType"="\"C:\\Program Files\\Microsoft Hardware\\Keyboard\\type32.exe\"" "POINTER"="C:\\Program Files\\Microsoft Hardware\\Mouse\\point32.exe" "SymTray - Norton SystemWorks"="C:\\Program Files\\Common Files\\Symantec Shared\\SymTray.exe SetReg" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "GhostStartTrayApp"="C:\\Program Files\\Norton SystemWorks\\Norton Ghost\\GhostStartTrayApp.exe" "AcctMgr"="C:\\Program Files\\Norton SystemWorks\\Password Manager\\AcctMgr.exe /startup" "QD FastAndSafe"="C:\\Program Files\\Norton SystemWorks\\Password Manager\\AcctMgr.exe /startup" "NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe" "ZingSpooler"="C:\\Program Files\\Common Files\\Zing\\ZingSpooler.exe" "InCD"="C:\\Program Files\\Ahead\\InCD\\InCD.exe" "SSC_UserPrompt"="C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\UsrPrmpt.exe" "MBM 5"="\"C:\\Program Files\\Motherboard Monitor 5\\MBM5.EXE\"" "ShowIcon_SmartDisk Corporation_SmartDisk Flash Media Reader Support 2.1"="\"C:\\Program Files\\SmartDisk\\Flash Media Reader\\shwicon.exe\" -t\"SmartDisk Corporation\\SmartDisk Flash Media Reader Support 2.1\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "LVCOMSX"="C:\\WINNT\\system32\\LVCOMSX.EXE" "LogitechVideoRepair"="C:\\Program Files\\Logitech\\Video\\ISStart.exe " "LogitechVideoTray"="C:\\Program Files\\Logitech\\Video\\LogiTray.exe" "Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\"" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0\\bin\\jusched.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" 

everything seems ok i'm asking for advice on the last remaining file it appears that its legit but i don't why it is reported by findit

hi
i've gotten the information

looks like that file was legit after all … findit was doing its job of listing new files

you installed zonealarm within 90days of using findit … so that file was listed

I'm pleased to announced …

YOU ARE CLEAN !!!!

Many many thanks for all your help!!!! Yes I renewed my license of ZA prior to this mess…. Good luck at school and you are truly lethal when it comes to Spyware!!!!

glad to help
below is my clean post for you … in case you missed the last one

A few tips here for you to stay clear of malware
Check for windows critical updates regularly
Use a FIREWALL
a good one can be downloaded here
Zone Alarm
The following programs will protect your computer from most spyware or malware
Adaware
Spybot
Spyware Blaster
IE-Spyad
spywareguard

Update your virus and spyware detection definitions weekly

You may benefit from reading the article "How Did I Get Infected In The First Place" for information on how to secure your PC from spyware/adware/malware.There are several small free programs mentioned there that help with securing your PC against this type of problem

We accept donations to keep the site running

Glad we could help.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for e-mail)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.