Eyz
Topic Starter
Hello,
Looking for a little information on these 2 Spyware/Grayware. Over the past days i`ve formatted atleast 6 times and this always comes back, from what very little information i can find people seem to think its a keylogger but seems as if they are not sure.
First off these are 100% clean formats, no old files at all, and ive only installed afew programs which are all from trusted company`s. Yet Trend-micro always seems to find TSPY_AGENT.TQ/TSPY_CIMUZ lurking in my system after awhile. By that i mean right after i format and do ALL MY UPDATES my system scan`s 100% clean. Then i installed all my programs and did a other scan which came up clean, afterwards i installed a game of mine "World of warcraft" from a trusted company then i turned my pc off awhile, came back did a scan and there it was again. No one seems to really know what these files are from what i`ve researched from search engines. Formatted time and time again and they always seem to return.
Trend-Micro shows no file path so i dont know where the so called files are located and it`s the ONLY virus scanner to pick it up. I have Spyblaster installed & enabled, every update for WinXP Pro. Basicly im trying to narrow down exactly what this is, Trend-Micro offers to clean it but it cannot clean the TSPY_AGENT.TQ file yet even so afterwards if i rescan it is gone completly, still leaves me a little cautious about my system if infact it is a keylogger. So basicly im looking to see if anyone knows forsure what this file is, im starting to think its something involved with my game world of warcraft because it seems to appear right after i install it. Im still at a loss as i said formatted over and over and always returns.
If anyone has any information on what this file exactly is or what its related to would be a big help its starting to drive me nuts formatting over and over. Bitdefender ,Panda & Ewido all scan clean Trend-Micro is the only one to pick it up. Just looking to find out exactly what this file is and if i should be alarmed.
Thanks in advance - Eyz
http://img209.imageshack.us/my.php?i…tled001ii6.jpg
http://img140.imageshack.us/my.php?i…tled002kt2.jpg
http://img140.imageshack.us/my.php?i…tled003nz5.jpg
http://img209.imageshack.us/my.php?i…tled004qh1.jpg
HJT Was ran in normal mode, i have a few unnecessary system services disabled.
Logfile of HijackThis v1.99.1
Scan saved at 7:12:58 AM, on 7/29/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HJT\analyse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?rs=1
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1154134581294
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1154136117184
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
Looking for a little information on these 2 Spyware/Grayware. Over the past days i`ve formatted atleast 6 times and this always comes back, from what very little information i can find people seem to think its a keylogger but seems as if they are not sure.
First off these are 100% clean formats, no old files at all, and ive only installed afew programs which are all from trusted company`s. Yet Trend-micro always seems to find TSPY_AGENT.TQ/TSPY_CIMUZ lurking in my system after awhile. By that i mean right after i format and do ALL MY UPDATES my system scan`s 100% clean. Then i installed all my programs and did a other scan which came up clean, afterwards i installed a game of mine "World of warcraft" from a trusted company then i turned my pc off awhile, came back did a scan and there it was again. No one seems to really know what these files are from what i`ve researched from search engines. Formatted time and time again and they always seem to return.
Trend-Micro shows no file path so i dont know where the so called files are located and it`s the ONLY virus scanner to pick it up. I have Spyblaster installed & enabled, every update for WinXP Pro. Basicly im trying to narrow down exactly what this is, Trend-Micro offers to clean it but it cannot clean the TSPY_AGENT.TQ file yet even so afterwards if i rescan it is gone completly, still leaves me a little cautious about my system if infact it is a keylogger. So basicly im looking to see if anyone knows forsure what this file is, im starting to think its something involved with my game world of warcraft because it seems to appear right after i install it. Im still at a loss as i said formatted over and over and always returns.
If anyone has any information on what this file exactly is or what its related to would be a big help its starting to drive me nuts formatting over and over. Bitdefender ,Panda & Ewido all scan clean Trend-Micro is the only one to pick it up. Just looking to find out exactly what this file is and if i should be alarmed.
Thanks in advance - Eyz
http://img209.imageshack.us/my.php?i…tled001ii6.jpg
http://img140.imageshack.us/my.php?i…tled002kt2.jpg
http://img140.imageshack.us/my.php?i…tled003nz5.jpg
http://img209.imageshack.us/my.php?i…tled004qh1.jpg
HJT Was ran in normal mode, i have a few unnecessary system services disabled.
Logfile of HijackThis v1.99.1
Scan saved at 7:12:58 AM, on 7/29/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HJT\analyse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?rs=1
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1154134581294
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1154136117184
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe