Hkey problems

Todays Spybot s&d results. — Report generated: 2005-10-12 09:27 — Windows Media SDK: Volume serial number (Registry value, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber Windows Media SDK: Computer name (Registry change, nothing done) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows Media\WMSDK\General\ComputerName!=ComputerName Windows Media SDK: Computer name (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Windows Media\WMSDK\General\ComputerName!=ComputerName Windows Media SDK: Computer name (Registry change, nothing done) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General\ComputerName!=ComputerName Windows Media SDK: Unique ID (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Windows Media\WMSDK\General\UniqueID!={00000000-0000-0000-0000-000000000000} Adobe Acrobat Reader 5: Recent file #8 (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Adobe\Acrobat Reader\5.0\AVGeneral\cRecentFiles\c8 Adobe Acrobat Reader 5: Recent file #1 (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Adobe\Acrobat Reader\5.0\AVGeneral\cRecentFiles\c1 Adobe Acrobat Reader 5: Recent file #2 (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Adobe\Acrobat Reader\5.0\AVGeneral\cRecentFiles\c2 Adobe Acrobat Reader 5: Recent file #3 (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Adobe\Acrobat Reader\5.0\AVGeneral\cRecentFiles\c3 Adobe Acrobat Reader 5: Recent file #4 (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Adobe\Acrobat Reader\5.0\AVGeneral\cRecentFiles\c4 Adobe Acrobat Reader 5: Recent file #5 (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Adobe\Acrobat Reader\5.0\AVGeneral\cRecentFiles\c5 Adobe Acrobat Reader 5: Recent file #6 (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Adobe\Acrobat Reader\5.0\AVGeneral\cRecentFiles\c6 Adobe Acrobat Reader 5: Recent file #7 (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Adobe\Acrobat Reader\5.0\AVGeneral\cRecentFiles\c7 Common Dialogs: History (68 files) (Registry key, nothing done) HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3 Internet Explorer: AutoComplete data (14 files) (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Internet Explorer\IntelliForms\SPW Internet Explorer: Download directory (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Internet Explorer\Download Directory!= Internet Explorer: User agent (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent!=Mozilla/4.0 (compatible; MSIE; Win32) Internet Explorer: User agent (Registry change, nothing done) HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent!=Mozilla/4.0 (compatible; MSIE; Win32) Log: Shutdown: System32\wbem\logs\wmiprov.log (Backup file, nothing done) C:\WINDOWS\System32\wbem\logs\wmiprov.log Log: Activity: ntbtlog.txt (Backup file, nothing done) C:\WINDOWS\ntbtlog.txt Log: Activity: SchedLgU.Txt (Backup file, nothing done) C:\WINDOWS\SchedLgU.Txt Log: Install: setupapi.log (Backup file, nothing done) C:\WINDOWS\setupapi.log Log: Install: wmsetup.log (Backup file, nothing done) C:\WINDOWS\wmsetup.log Log: Shutdown: System32\wbem\logs\mofcomp.log (Backup file, nothing done) C:\WINDOWS\System32\wbem\logs\mofcomp.log Log: Shutdown: System32\wbem\logs\wbemess.lo_ (Backup file, nothing done) C:\WINDOWS\System32\wbem\logs\wbemess.lo_ Log: Shutdown: System32\wbem\logs\wbemess.log (Backup file, nothing done) C:\WINDOWS\System32\wbem\logs\wbemess.log MS Direct3D: Most recent application (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Direct3D\MostRecentApplication\Name!= MS Direct3D: Most recent application (Registry change, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name!= MS DirectDraw: Most recent application (Registry change, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name!= MS DirectInput: Most recent application ID (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\DirectInput\MostRecentApplication\Id!= MS DirectInput: Most recent application (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\DirectInput\MostRecentApplication\Name!= MS Management Console: Recent command list (3 files) (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Microsoft Management Console\Recent File List MS Media Player: Anonymous ID (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\MediaPlayer\Preferences\SendUserGUID!=B=0 MS Media Player: Client ID (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\MediaPlayer\Player\Settings\Client ID!= MS Media Player: Last opened playlist (Registry value, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\MediaPlayer\Preferences\LastPlaylist MS Media Player: Last selected node (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\MediaPlayer\MediaLibraryUI\MLLastSelectedNode!= MS Media Player: Last selected track index (Registry value, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\MediaPlayer\Preferences\LastPlaylistIndex MS Media Player: Recent open directory (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\MediaPlayer\Player\Settings\OpenDir!= MS Media Player: Search terms history (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\MediaPlayer\AutoComplete\MediaSearch MS Office 10.0 (PowerPoint): recent file list (1 files) (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Office\10.0\PowerPoint\Recent File List MS Office 10.0 (Word): Recently used documents list (Registry value, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Office\10.0\Word\Data\Settings MS Office 10.0: Access recent file (6 files) (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Office\10.0\Access\Settings MS Office 10.0: Internet history (Registry value, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Office\10.0\Common\Internet\UseRWHlinkNavigation MS Regedit: Recent open key (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\LastKey!= MS Search Assistant: Typed search terms history (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Search Assistant\ACMru RealOne Player 2 (aka RealPlayer 6.0): Most recent skins #1 (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\RealNetworks\RealPlayer\6.0\Preferences\MostRecentSkins1\!= RealOne Player 2 (aka RealPlayer 6.0): Last login time (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\RealNetworks\RealPlayer\6.0\Preferences\LastLoginTime\!= RealOne Player 2 (aka RealPlayer 6.0): Last open file directory (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\RealNetworks\RealPlayer\6.0\Preferences\LastOpenFileDir\!= RealOne Player 2 (aka RealPlayer 6.0): Most recent clips #1 (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\RealNetworks\RealPlayer\6.0\Preferences\MostRecentClips1\!= RealOne Player 2 (aka RealPlayer 6.0): Most recent clips #2 (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\RealNetworks\RealPlayer\6.0\Preferences\MostRecentClips2\!= RealOne Player 2 (aka RealPlayer 6.0): Most recent clips #3 (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\RealNetworks\RealPlayer\6.0\Preferences\MostRecentClips3\!= RealOne Player 2 (aka RealPlayer 6.0): Most recent clips #4 (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\RealNetworks\RealPlayer\6.0\Preferences\MostRecentClips4\!= RealOne Player 2 (aka RealPlayer 6.0): Most recent clips #5 (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\RealNetworks\RealPlayer\6.0\Preferences\MostRecentClips5\!= RealOne Player 2 (aka RealPlayer 6.0): Most recent clips #6 (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\RealNetworks\RealPlayer\6.0\Preferences\MostRecentClips6\!= RealOne Player 2 (aka RealPlayer 6.0): Most recent clips #7 (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\RealNetworks\RealPlayer\6.0\Preferences\MostRecentClips7\!= RealOne Player 2 (aka RealPlayer 6.0): Most recent clips #8 (Registry change, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\RealNetworks\RealPlayer\6.0\Preferences\MostRecentClips8\!= Windows Explorer: Last Copy/MoveTo folder (Registry value, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\CopyMoveTo\LastFolder Windows Explorer: Last visited history (13 files) (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU Windows Explorer: Recent file global history (Registry key, nothing done) HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs Windows Explorer: Recent wallpaper list (52 files) (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\Wallpaper\MRU Windows Explorer: Stream history (4 files) (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU Windows.OpenWith: Open with list - .BMP extension (7 files) (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\OpenWithList Windows.OpenWith: Open with list - .ASX extension (3 files) (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ASX\OpenWithList Windows.OpenWith: Open with list - .AVI extension (7 files) (Registry key, nothing done) HKEY_USERS\S-1-5-21-1448448909-1402772363-1073767117-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AVI\OpenWithList — Spybot - Search && Destroy version: 1.3 — 2005-04-26 Includes\Cookies.sbi 2005-08-19 Includes\Dialer.sbi 2005-08-19 Includes\Hijackers.sbi 2005-08-16 Includes\Keyloggers.sbi 2004-11-29 Includes\LSP.sbi 2005-08-19 Includes\Malware.sbi 2005-08-12 Includes\PUPS.sbi 2005-04-27 Includes\Revision.sbi 2005-08-19 Includes\Security.sbi 2005-08-16 Includes\Spybots.sbi 2005-02-17 Includes\Tracks.uti 2005-08-19 Includes\Trojans.sbi

Second bump on the 5th Day.

Hello M Chaz and welcome to TomCoyote.

You are using an old version of Spybot S&D. Please uninstall it and install the new version as described below. Also, install Ad-Aware SE Personal 1.06 and run a scan with it as instructed.

Scanning With Spybot S&D;:

• Downloaded and Install Spybot S&D; accepting the Default Settings.
• In the Menu Bar at the top of the Spybot window you will see 'Mode'. Make certain that 'default mode' has a check mark beside it.
• Close ALL windows except Spybot S&D.
• Click the button to ‘Search for Updates’ then download and install the Updates.
• Next click the button ‘Check for Problems’
• When Spybot is complete, it will be showing ‘RED’ entries bold 'Black' entries and ‘GREEN’ entries in the window.
• Make certain there is a check mark beside all of the RED entries ONLY.
• Choose ‘Fix Selected Problems’ and allow Spybot to fix the RED entries.
• REBOOT to complete the scan and clear memory.
• Do not enable Tea Timer until the log is clean as it will prevent the fix from working.

Scanning With Ad-Aware SE:

• Download and Install Ad-Aware SE, keeping the default options. However, some of the settings will need to be changed before your first scan.
• Close ALL windows except Ad-Aware SE.
• Click on the‘world’ icon at the top right of the Ad-Aware SE window and let AdAware SE update the reference list for the adware and malware.
• Once the update is finished click on the ‘Gear’ icon (second from the left at the top of the window) to access the preferences/settings window.
  • In the ‘General’ window make sure the following are selected in green:
    • Automatically save log-file
    • Automatically quarantine objects prior to removal
    • Safe Mode (always request confirmation)
  • Under Definitions:
    • Prompt to udate outdated definitions - set the number of days
  • Click on the ‘Scanning’ button on the left and select in green :
    • Under Driver, Folders & Files:
      • Scan Within Archives
    • Under Select drives & folders to scan -
      • choose all hard drives
    • Under Memory & Registry: all green
    • Scan active processes
    • Scan registry
    • Deep-scan registry
    • Scan my IE favorites for banned URLs
    • Scan my Hosts file
  • Click on the ‘Advanced’ button on the left and select in green:
    • Under Shell Integration:
      • Move deleted files to recycle bin
    • Under Logfile Detail Level: (all green)
      • include addtional object information
      • DESELECT - include negligible objects information
      • include environment information
    • Under Alternate Data Streams:
      • Don't log streams smaller than 0 bytes
      • Don't log ADS with the following names: CA_INOCULATEIT
  • Click the ‘Tweak’ button and select in green:
    • Under the ‘Scanning Engine’:
      • Unload recognized processes during scanning
      • Scan registry for all users instead of current user only
    • Under the ‘Cleaning Engine’:
      • Always try to unload modules before deletion
      • During removal, unload Explorer and IE if necessary
      • Let Windows remove files in use at next reboot
    • Under the Log Files:
      • Include basic Ad-aware SE settings in logfile
      • Include additional Ad-aware SE settings in logfile
      • Create logfile for removal operations.
      • Please do not check or make green: Include Module list in logfile
• Click on ‘Proceed’ to save the settings.
• Click ‘Start’
  • Choose:'Perform Full System Scan'
  • DESELECT "Search for negligible risk entries", as negligible risk entries (MRU's) are not considered to be a threat.
• Click ‘Next’ and Ad-Aware SE will scan your hard drive(s) with the options you have selected and clean automatically.
• If Ad-Aware SE finds bad entries, you will receive a list of what it found in the window, click "Next".
• The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".
• Save the logfile when asked.
• REBOOT to complete the removal of what Ad-Aware SE found.

Post a fresh HijackThis log as a reply to this topic.
Let us know how the computer is working now.

I should have explained that the DSO exploits were a known false positive with the old version of Spybot S&D.

Step 1
Open HijackThis, run a scan, then check the following:

O4 - Global Startup: Continue Setup.lnk = E:\Msminst\Setup.exe
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZRfox000

Optional items to check with HijackThis.
Fix only if you or an administrator did not set this restriction in Internet Explorer or a program such as Spybot S&D wasn't used to set it.

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

With all other programs and browsers closed, click fix checked.


Step 2
Reboot the computer and scan with HijackThis. Post the new log as a reply to this thread.
Let us know how the computer is behaving now.

Your new log appears clean.

Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

1. Right-click My Computer, and then click Properties.
2. On the System Restore tab, put a check mark in the 'Turn Off System Restore' check box.
3. Click OK, and then click Yes.
4. Restart the computer.
5. Repeat steps 1 - 2, this time clearing the box beside 'Turn Off System Restore', click 'OK'.


I suggest that you download these programs to help keep the computer clean:

Spyware Blaster - Blocks bad ActiveX items from installing on your computer. Spyware Blaster runs silently in the background.
ie-spyad - Puts over 12,000 bad URLs into your restricted sites for Internet Explorer.
Google Toolbar - Blocks many unwanted pop-ups in Internet Explorer.
Firefox - 'Safer' alternative to the Internet Explorer web browser.
ZoneAlarm - Free firewall program if you currently are not using one.

Update these regularly.

You may also want to read the following posts to learn how to better secure your computer.
"So how did I get infected in the first place"
"Securing Your PC After An Attack"

Be sure to keep Windows and your Anti-virus updated.

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php