Spybot problems

Help me if you can. 1. Is there a way for me to mark an issue I have started so that I can log in and go straight to that topic/issue without running through the entire list. An easy tracking of just my posting and replies. 2. SpyBot gives me an message every time I try to update the defenition files. It runs for a short time then pops up and says "BAD CHECKSUM" it never puts the green check mark and sayas definitions updated. Do I have a problem?

Click this link http://forums.tomcoyote.org/index.php?showtopic=49926&hl;=

Then book mark it. But it looks like you have started more than one thread

Are you still needing help?

Little eagle, I cannot find my other postings but as of last friday I never recieved replies to the logs I posted. I posted log files twice I believe about two weeks apart.

Book mark this thread http://forums.tomcoyote.org/index.php?act=…st&f;=27&t;=51239

Post your log here and I'll take a look at your log.

You other threads were deleted

Please download Ewido Security Suite it is a trial version of the program.

• Install ewido security suite
• Launch ewido, there should be an icon on your desktop double-click it.
• The program will now go to the main screen

You will need to update ewido to the latest definition files.

• On the left hand side of the main screen click update
• Then click on Start Update

The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update Ewido.
Ewido manual updates

Once the updates are installed do the following:

• Reboot in safe mode
• Click on scanner
• Click on Complete System Scan and the scan will begin.
• NOTE: During some scans with ewido it is finding cases of false positives.**
  • You will need to step through the process of cleaning files one-by-one.
  • If ewido detects a file you KNOW to be legitimate, select none as the action.
  • DO NOT select "Perform action on all infections"
  • If you are unsure of any entry found select none for now.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
• Click Save report.
• Save the report .txt file to your desktop.

Now close ewido security suite.
**(Ewido for example has been flagging parts of AVG Anti-Virus, pcAnywhere and the game "Risk")

This was the report you suggested I save to my desktop. Is this the end of the process? Will Ewido catch future items before they get to my system? I appreciate all the help but still would like to know if there are some programs that are messing with me that I should avoid. In particular do you know if BearShare Pro is a problem even though they told me the pro version did NOT contain spyware and adware? Thank you again for your help. Kevin ewido security suite - Scan report ——————————————————— + Created on: 11:42:13 AM, 11/16/2005 + Report-Checksum: F80AAECB + Scan result: HKLM\SOFTWARE\Classes\CLSID\\ -> Spyware.AproposMedia : Cleaned with backup HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{6EC11407-5B2E-4E25-8BDF-77445B52AB37} -> Spyware.VX2 : Cleaned with backup HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{6EC11407-5B2E-4E25-8BDF-77445B52AB37}\\ -> Spyware.VX2 : Cleaned with backup HKLM\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX\CLSID\\ -> Spyware.MiniBug : Cleaned with backup HKLM\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX.1\CLSID\\ -> Spyware.MiniBug : Cleaned with backup HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9E248641-0E24-4DDB-9A1F-705087832AD6}\\CLSID -> Spyware.VX2 : Cleaned with backup HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Spyware.WebRebates : Cleaned with backup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/System32/msjava.dll\\{05CE4481-8015-11D3-9811-C4DA9F000000} -> Spyware.WebRebates : Cleaned with backup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DisplayUtility -> Spyware.Delfin : Cleaned with backup HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000010-6F7D-442C-93E3-4A4827C2E4C8} -> Spyware.InternetOptimizer : Cleaned with backup HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10E42047-DEB9-4535-A118-B3F6EC39B807} -> Spyware.SideFind : Cleaned with backup HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{86227D9C-0EFE-4F8A-AA55-30386A3F5686} -> Spyware.YourSiteBar : Cleaned with backup HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A3FDD654-A057-4971-9844-4ED8E67DBBB8} -> Spyware.ISTBar : Cleaned with backup HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F4E04583-354E-4076-BE7D-ED6A80FD66DA} -> Spyware.BargainBuddy : Cleaned with backup HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000010-6F7D-442C-93E3-4A4827C2E4C8} -> Spyware.InternetOptimizer : Cleaned with backup HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10E42047-DEB9-4535-A118-B3F6EC39B807} -> Spyware.SideFind : Cleaned with backup HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{86227D9C-0EFE-4F8A-AA55-30386A3F5686} -> Spyware.YourSiteBar : Cleaned with backup HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A3FDD654-A057-4971-9844-4ED8E67DBBB8} -> Spyware.ISTBar : Cleaned with backup HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F4E04583-354E-4076-BE7D-ED6A80FD66DA} -> Spyware.BargainBuddy : Cleaned with backup C:\Documents and Settings\dwaddell\Cookies\[removed][1].txt -> Spyware.Cookie.Burstbeacon : Cleaned with backup C:\Documents and Settings\dwaddell\Cookies\[removed][1].txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\285C0B18-9775-442C-9DB3-EF7E84\768351AE-9F0A-4FD7-96DE-3EDBB9 -> TrojanDownloader.Qoologic.ak : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\42A8F85F-EDA4-48DD-8CA8-054E68\0003A02F-10B5-430C-A605-35B1B6 -> TrojanDownloader.Small : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\F0ABED98-0BE7-4E91-8DE8-99D01D\127B6B71-3DED-498A-BF20-3E0CF5 -> TrojanDownloader.Small : Cleaned with backup C:\Program Files\Mozilla Firefox\plugins\npzango.dll.tcf -> Spyware.WinAD : Cleaned with backup C:\WINDOWS\SYSTEM32\jsdksjd.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup C:\WINDOWS\SYSTEM32\medgs1.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINDOWS\SYSTEM32\nakoj.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup C:\WINDOWS\SYSTEM32\naqrbnc.exe -> Trojan.Pakes : Cleaned with backup C:\WINDOWS\SYSTEM32\naqrbnc.exe.tcf -> TrojanDownloader.Qoologic.ac : Cleaned with backup C:\WINDOWS\SYSTEM32\NNSCAA638.EXE -> Spyware.NewDotNet : Cleaned with backup C:\WINDOWS\SYSTEM32\rcntirk.dll -> TrojanDownloader.Qoologic.af : Cleaned with backup C:\WINDOWS\SYSTEM32\testit.exe.tcf -> TrojanDownloader.IstBar.is : Cleaned with backup C:\WINDOWS\SYSTEM32\venturaa_installer.exe -> Spyware.BookedSpace : Cleaned with backup C:\WINDOWS\SYSTEM32\vgactl.cpl -> TrojanDownloader.Qoologic.ad : Cleaned with backup C:\WINDOWS\SYSTEM32\w031319.Stub.exe.tcf -> TrojanDownloader.Delmed.a : Cleaned with backup C:\WINDOWS\Temp\Cookies\[removed][2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup C:\WINDOWS\Temp\Cookies\[removed][1].txt -> Spyware.Cookie.Adjuggler : Cleaned with backup C:\WINDOWS\Temp\Cookies\kpeterson@ysbweb[1].txt -> Spyware.Cookie.Ysbweb : Cleaned with backup ::Report End

Can you post another hijackthis log please. As soon as we get you PC clean we will. then we will get to securing your PC. To do it know will slow the fixes to add programs that will keep you from making changes. As far as P2P programs I'll have to check and see.

You are running HJT from a temporary file or desktop we will be cleaning out all of you temp. files latter you will need to make a new folder for HijackThis. Instructions can be found here.

Close all programs leaving only HijackThis running. Place a check against each of the following,

O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra button: Microsoft AntiSpyware helper - {19621EBE-ECD9-49FB-A315-A3636EE0F77F} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {19621EBE-ECD9-49FB-A315-A3636EE0F77F} - (no file) (HKCU)

Click on Fix Checked when finished and exit HijackThis.

Please follow a few tips to remain malware free:

Make sure you keep your Windows OS current by visiting Windows update
occasionaly to download and install any critical updates and service packs. With out these you are leaving the backdoor open.

Also download, install and keep updated- Antivirus Software (and use only one):
Free for home users:
avast! 4 Home Edition Download
AVG free version 7.0 AVG free version v6.0 updates ended 12/31/04
AntiVir Personal Edition

Adjust your browser settings: Change your(active x) settings in IE. With IE open go to tools, internet options, security tab. Click on the internet globe, then custom level. Set the first option "download signed active x controls" to prompt, the next two to disable. Read more:
Internet Explorer Privacy & Security Settings
Working with Internet Explorer 6 Security
Many exploits are directed at Internet Explorer, you dont have to use it. Try a different browser:
Like Firefox,
And Thunderbird for controling spam in your e-mail.

Install a firewall. A firewall will control what comes in from the internet and what leaves your computer to the internet. A firewall will also alert you when a application trys to connect to the internet from your computer, this is a good way to catch crapware or trojans, trying to connect out bound from your computer- whats that and why does it need a internet connection? You can deny it access it until more investigation is done. Zone Alarm is a free and easy to use firewall, that will provide in and outbound protection. Microsoft XP firewall only provides inbound protection, but is not as robust as third party firewalls, Be sure to run only >one< firewall.If you use another, be sure to disable XP's built in firewall.A inexpensive NAT hardware router with SPI (firewall)would be even better,along with a software firewall.
Zone Alarm
Kerio Personal Firewall
Outpost Firewall

Download, install and update before using:(if these are constantly finding malware, then you need to make some changes)
Ad-Aware SE Personal edition
Spybot Search and destroy
Becarful with spyware "removers and scanners"– there are many "rogue/suspect" programs that "claim to remove" spyware.

Other programs to consider:
SpywareBlaster
IE-SPYAD
AntiTrojan software to fill in the gap:
a2 free
Ewido Security Suite
Trojan Hunter (30 day trial version)

Learn More:
Tony's article So how did I get infected in the first place?
How to Secure (and Keep Secure) My (New) Computer(s)
Home Computer Security
Wilders Security Advisors

Watch what you download, and where you download it from.
Many programs come bundled with "extra" crapware you may not want. Make sure you know what it is you will be downloading and installing. Visit the makers website, learn more about the program, Does the program you want come bundled with other "3rd party" programs? What do the 3rd party programs do? Will they deliver ads? Track your surfing habits?.You may be installing more than you think, Read the EULA agreement, you know that paragraph of stuff you "agree to" before the software installs? Stay away from warez and crack sites. Becarful what you download from file sharing networks.If you are not sure, scan it with your Antivirus app. A small file (in KB) is probably not what you think it is. Some p2p clients also install 3rd party stuff you probably dont want.

One of the best features of Windows ME or XP is the System Restore option.
However after what has been cleaned out viruses and hackers you will want to reset your restore points.

For (win XP)

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.


Please read of these
http://www.spywareinfo.com/newsletter/archives/0903/3.php
http://www.winmx.com :: WinMX seb site insted of kazaa.

http://www.spywareinfo.com/articles/p2p/
http://www.spywareinfo.com/articles/kazaa/
http://www.spywareinfo.com/forums/index.php?showtopic=36546


If you have anymore questions please post back.

Thank you so much for all your help. I will contact our tech people for help with the firewall. I think that either our router or the Internet Service provided by Time Warner our Cable provider has a firewall. Actually BearShare the file sharing software I mentioned tells me that some of my performance issues with them are that they are being blocked by my firewall. I appreciate all your time and help more than you know. Ionly wish we could find some way to destroy all malware, spyware and the vermin who create and distribute them. Kevin

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php