I think I should start off by Thanking you people for taking the time to look at this.
This was detected while I scanned with Spybot 1.4 and find I couldn't get rid of it, I've been reading a few of the posts here on Command Service and so I thought I should post for help, basically.
This is the Spybot Results I just scanned, copied and pasted on here:
Possible hijacker: Global settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Styles\Use My Stylesheet!=W=0
CallingHome.biz: Temporary folder (Directory, fixed)
C:\Documents and Settings\Nang Voong`\Local Settings\Temp\THI2F2A.tmp
CallingHome.biz: Temporary folder (Directory, fixed)
C:\Documents and Settings\Nang Voong`\Local Settings\Temp\THI58EF.tmp
Command Service: Settings (Registry key, fixing failed)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdService
Command Service: Settings (Registry key, fixing failed)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\cmdService
Command Service: Settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\cmdService
ISearchTech.ISTsvc_Updater: Text file (File, fixed)
C:\Documents and Settings\Nang Voong`\Local Settings\Temp\shortcuts.txt
Web-Nexus: Library (File, fixed)
C:\WINDOWS\SYSTEM32\wuauclt.dll
Web-Nexus: Settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\qstat
Web-Nexus: Text file (File, fixing failed)
C:\WINDOWS\SYSTEM32\vgactl.cpl
WildTangent: Program directory (Directory, fixed)
C:\WINDOWS\wt\wtDRM\
Windows Security Center.AntiVirusOverride: Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride!=dword:0
WildTangent: Settings (Registry value, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Java VM\ClassPath=...;C:\Program Files\WildTangent\Apps\DRM0302Java.jar...
WildTangent: Program directory (Directory, fixed)
C:\WINDOWS\wt\
WildTangent: Library (File, fixed)
C:\WINDOWS\wt\WDInUsePlugin.dll
WildTangent: Settings (Registry key, fixed)
HKEY_USERS\.DEFAULT\Software\WildTangent
WildTangent: Settings (Registry key, fixed)
HKEY_USERS\S-1-5-19\Software\WildTangent
WildTangent: Settings (Registry key, fixed)
HKEY_USERS\S-1-5-20\Software\WildTangent
WildTangent: Settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-606747145-1580436667-725345543-1003\Software\WildTangent
WildTangent: Settings (Registry key, fixed)
HKEY_USERS\S-1-5-18\Software\WildTangent
NewDotNet: Class ID (SearchControl Class) (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{DD770A75-CE18-11D5-98D8-00E018981B9E}
Avenue A, Inc.: Tracking cookie (Firefox: default) (Cookie, fixed)
DoubleClick: Tracking cookie (Firefox: default) (Cookie, fixed)
MediaPlex: Tracking cookie (Firefox: default) (Cookie, fixed)
--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---
2005-12-25 unins000.exe (51.41.0.0)
2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2005-05-31 Update.exe (1.4.0.0)
2005-05-31 advcheck.dll (1.0.2.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2005-05-31 Tools.dll (2.0.0.2)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2005-12-23 Includes\Cookies.sbi (*)
2005-12-23 Includes\Dialer.sbi (*)
2005-12-23 Includes\Hijackers.sbi (*)
2005-12-23 Includes\Keyloggers.sbi (*)
2005-12-23 Includes\Malware.sbi (*)
2005-12-23 Includes\Revision.sbi (*)
2005-12-23 Includes\Security.sbi (*)
2005-12-23 Includes\Spybots.sbi (*)
2005-12-23 Includes\Trojans.sbi (*)
2005-02-17 Includes\Tracks.uti
2005-12-23 Includes\PUPS.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
Thanks again
This was detected while I scanned with Spybot 1.4 and find I couldn't get rid of it, I've been reading a few of the posts here on Command Service and so I thought I should post for help, basically.
This is the Spybot Results I just scanned, copied and pasted on here:
Possible hijacker: Global settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Styles\Use My Stylesheet!=W=0
CallingHome.biz: Temporary folder (Directory, fixed)
C:\Documents and Settings\Nang Voong`\Local Settings\Temp\THI2F2A.tmp
CallingHome.biz: Temporary folder (Directory, fixed)
C:\Documents and Settings\Nang Voong`\Local Settings\Temp\THI58EF.tmp
Command Service: Settings (Registry key, fixing failed)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdService
Command Service: Settings (Registry key, fixing failed)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\cmdService
Command Service: Settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\cmdService
ISearchTech.ISTsvc_Updater: Text file (File, fixed)
C:\Documents and Settings\Nang Voong`\Local Settings\Temp\shortcuts.txt
Web-Nexus: Library (File, fixed)
C:\WINDOWS\SYSTEM32\wuauclt.dll
Web-Nexus: Settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\qstat
Web-Nexus: Text file (File, fixing failed)
C:\WINDOWS\SYSTEM32\vgactl.cpl
WildTangent: Program directory (Directory, fixed)
C:\WINDOWS\wt\wtDRM\
Windows Security Center.AntiVirusOverride: Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride!=dword:0
WildTangent: Settings (Registry value, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Java VM\ClassPath=...;C:\Program Files\WildTangent\Apps\DRM0302Java.jar...
WildTangent: Program directory (Directory, fixed)
C:\WINDOWS\wt\
WildTangent: Library (File, fixed)
C:\WINDOWS\wt\WDInUsePlugin.dll
WildTangent: Settings (Registry key, fixed)
HKEY_USERS\.DEFAULT\Software\WildTangent
WildTangent: Settings (Registry key, fixed)
HKEY_USERS\S-1-5-19\Software\WildTangent
WildTangent: Settings (Registry key, fixed)
HKEY_USERS\S-1-5-20\Software\WildTangent
WildTangent: Settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-606747145-1580436667-725345543-1003\Software\WildTangent
WildTangent: Settings (Registry key, fixed)
HKEY_USERS\S-1-5-18\Software\WildTangent
NewDotNet: Class ID (SearchControl Class) (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{DD770A75-CE18-11D5-98D8-00E018981B9E}
Avenue A, Inc.: Tracking cookie (Firefox: default) (Cookie, fixed)
DoubleClick: Tracking cookie (Firefox: default) (Cookie, fixed)
MediaPlex: Tracking cookie (Firefox: default) (Cookie, fixed)
--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---
2005-12-25 unins000.exe (51.41.0.0)
2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2005-05-31 Update.exe (1.4.0.0)
2005-05-31 advcheck.dll (1.0.2.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2005-05-31 Tools.dll (2.0.0.2)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2005-12-23 Includes\Cookies.sbi (*)
2005-12-23 Includes\Dialer.sbi (*)
2005-12-23 Includes\Hijackers.sbi (*)
2005-12-23 Includes\Keyloggers.sbi (*)
2005-12-23 Includes\Malware.sbi (*)
2005-12-23 Includes\Revision.sbi (*)
2005-12-23 Includes\Security.sbi (*)
2005-12-23 Includes\Spybots.sbi (*)
2005-12-23 Includes\Trojans.sbi (*)
2005-02-17 Includes\Tracks.uti
2005-12-23 Includes\PUPS.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
Thanks again
Last edited: