PDA

View Full Version : spybot 0 threats list of error during checking ?


inventor
2006-08-12, 18:25
12 Aug Sat
spybot 0 threats list of error during checking ? I used cwshredder and spybot finished today Sat 12 Aug ok with no threats but what are all these red triangles? Error during check yet they are no threat? So is my system ready to click on tea time ? thanks
inventor**@att.net
http://www.inventor-warp-speed.com/



--- Search result list ---
Error during check!: AdGoblin [1] (Access violation at address 00402426 in module 'SPYBOTSD.EXE'. Read of address 03F1FF4C) ()


Error during check!: CoolWWWSearch.Feat2Installer [1731] (Invalid pointer operation) ()


Error during check!: CoolWWWSearch.HomeSearch [47] (Invalid pointer operation) ()


Error during check!: CoolWWWSearch.HomeSearch [56] (Invalid pointer operation) ()


Error during check!: CoolWWWSearch.HomeSearch [78] (Invalid pointer operation) ()


Error during check!: CoolWWWSearch.HomeSearch [136] (Invalid pointer operation) ()


Error during check!: CoolWWWSearch.HomeSearch [161] (Invalid pointer operation) ()


Error during check!: CoolWWWSearch.HomeSearch [179] (Invalid pointer operation) ()


Error during check!: CoolWWWSearch.HomeSearch [206] (Invalid pointer operation) ()


Error during check!: CoolWWWSearch.HomeSearch [224] (Invalid pointer operation) ()


Error during check!: CoolWWWSearch.HomeSearch [242] (Invalid pointer operation) ()


Error during check!: CoolWWWSearch.HomeSearch [260] (Invalid pointer operation) ()


Error during check!: CoolWWWSearch.HomeSearch [269] (Invalid pointer operation) ()


Error during check!: CoolWWWSearch.SmartSearch [0] (Invalid pointer operation) ()


Error during check!: Antigen [3] (Invalid pointer operation) ()


Error during check!: ISearchTech.ISTDownloader [13] (Invalid pointer operation) ()


Error during check!: 180Solutions.SearchAssistant [285] (Access violation at address 00402426 in module 'SPYBOTSD.EXE'. Read of address 04304BA0) ()


Error during check!: 180Solutions.SearchAssistant [591] (Invalid pointer operation) ()


Error during check!: C2.lop [2] (Invalid pointer operation) ()


Error during check!: Cydoor [6] (Invalid pointer operation) ()


Error during check!: Armageddon [4] (Invalid pointer operation) ()


Error during check!: CoolWWWSearch.IE-Extension [12] (Invalid pointer operation) ()


Error during check!: Dropper [14] (Invalid pointer operation) ()


Error during check!: Fake.Windows_API_Library [3] (Invalid pointer operation) ()


Error during check!: Subseven215 [0] (Invalid pointer operation) ()


Error during check!: Zwax (Invalid pointer operation) ()


Congratulations!: No immediate threats were found. ()



--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

2006-08-10 unins000.exe (51.41.0.0)
2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2005-05-31 Update.exe (1.4.0.0)
2006-02-06 advcheck.dll (1.0.2.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2006-02-20 Tools.dll (2.0.0.2)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2006-08-04 Includes\Cookies.sbi (*)
2006-08-04 Includes\Dialer.sbi (*)
2006-08-04 Includes\Hijackers.sbi (*)
2006-08-04 Includes\Malware.sbi (*)
2006-08-04 Includes\Keyloggers.sbi (*)
2006-08-04 Includes\Revision.sbi (*)
2006-08-04 Includes\Security.sbi (*)
2006-08-04 Includes\Spybots.sbi (*)
2006-08-04 Includes\Trojans.sbi (*)
2005-02-17 Includes\Tracks.uti
2006-08-04 Includes\PUPS.sbi (*)



--- System information ---
Windows 98 (Build: 2222) A


--- Startup entries list ---
Located: HK_LM:Run, Gene USB Monitor
command: C:\WINDOWS\SYSTEM\USBMonit.exe
file: C:\WINDOWS\SYSTEM\USBMonit.exe
size: 45056
MD5: 241db1dbe67cfae3da0da7bbd7a6524e

Located: HK_LM:Run, LoadPowerProfile
command: Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
file: C:\WINDOWS\Rundll32.exe
size: 24576
MD5: 3857d93aa630abbd63467db4aeffce2c

Located: HK_LM:Run, Microsoft IntelliType Pro
command: "C:\Program Files\Microsoft Hardware\Keyboard\speedkey.exe"
file: C:\Program Files\Microsoft Hardware\Keyboard\speedkey.exe
size: 30208
MD5: 0213a257eb74b904fd416a7c2d09c1ae

Located: HK_LM:Run, Microsoft WebServer
command: C:\Program Files\WebSvr\System\svctrl /init
file:

Located: HK_LM:Run, NvCplDaemon
command: RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
file: C:\WINDOWS\RUNDLL32.EXE
size: 24576
MD5: 3857d93aa630abbd63467db4aeffce2c

Located: HK_LM:Run, nwiz
command: nwiz.exe /install
file: C:\WINDOWS\SYSTEM\nwiz.exe
size: 323584
MD5: fce4275c64509c25c2606d90fd285b7f

Located: HK_LM:Run, POINTER
command: point32.exe
file:

Located: HK_LM:Run, ScanRegistry
command: C:\WINDOWS\scanregw.exe /autorun
file: C:\WINDOWS\scanregw.exe
size: 86016
MD5: f123231689e2ab2fa5c636b99314501f

Located: HK_LM:Run, SystemTray
command: SysTray.Exe
file: C:\WINDOWS\SYSTEM\SysTray.Exe
size: 32768
MD5: 73681085dcd0997e531240100ca12b28

Located: HK_LM:Run, TaskMonitor
command: C:\WINDOWS\taskmon.exe
file: C:\WINDOWS\taskmon.exe
size: 28672
MD5: f795110611101279aa15997801abaca0

Located: HK_LM:Run, TPP Auto Loader
command: C:\WINDOWS\TPPALDR.EXE
file: C:\WINDOWS\TPPALDR.EXE
size: 118784
MD5: 41701380b16877a69e84a8be7fe535dd

Located: HK_LM:RunServices, LoadPowerProfile
command: Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
file: C:\WINDOWS\Rundll32.exe
size: 24576
MD5: 3857d93aa630abbd63467db4aeffce2c

Located: HK_LM:RunServices, Microsoft WebServer
command: C:\Program Files\WebSvr\System\inetsw95 -w3svc
file:

Located: HK_LM:RunServices, SchedulingAgent
command: mstask.exe
file: C:\WINDOWS\SYSTEM\mstask.exe
size: 111888
MD5: 39d6b416d9c73a7729cdaed247430d21

Located: HK_CU:Run, NvMediaCenter
command: RUNDLL32.EXE C:\WINDOWS\SYSTEM\NVMCTRAY.DLL,NvTaskbarInit
file: C:\WINDOWS\RUNDLL32.EXE
size: 24576
MD5: 3857d93aa630abbd63467db4aeffce2c

Located: Startup (user), Microsoft Office.lnk
command: C:\Program Files\Microsoft Office\Office\OSA9.EXE
file: C:\Program Files\Microsoft Office\Office\OSA9.EXE
size: 65588
MD5: a89d195caf6a030b152e2a4cabe7018d



--- Browser helper object list ---


--- ActiveX list ---


--- Process list ---
PID: -7369343 (2119113809) C:\WINDOWS\SYSTEM\KERNEL32.DLL
size: 471040
MD5: 375B0813980AE17DCC689E913AB9DD7B
PID: -9883 (-7369343) C:\WINDOWS\SYSTEM\MSGSRV32.EXE
size: 11920
MD5: 15020A139F22CDBF9C70AA8D80F6AE0E
PID: -12555 (-9883) C:\WINDOWS\SYSTEM\MPREXE.EXE
size: 28672
MD5: 562D04789250A81CE629D60646A0D191
PID: -121023 (-12555) C:\WINDOWS\SYSTEM\MSTASK.EXE
size: 111888
MD5: 39D6B416D9C73A7729CDAED247430D21
PID: -6667 (-12555) C:\PROGRAM FILES\WEBSVR\SYSTEM\INETSW95.EXE
size: 15872
MD5: 58B294D1B9FED8E5A98C91296484E8F9
PID: -100515 (-9883) C:\WINDOWS\EXPLORER.EXE
size: 180224
MD5: B22B28F61B1BB06723019307F0FAACFC
PID: -162599 (-100515) C:\WINDOWS\TASKMON.EXE
size: 28672
MD5: F795110611101279AA15997801ABACA0
PID: -148099 (-100515) C:\WINDOWS\SYSTEM\SYSTRAY.EXE
size: 32768
MD5: 73681085DCD0997E531240100CA12B28
PID: -173195 (-100515) C:\WINDOWS\SYSTEM\USBMONIT.EXE
size: 45056
MD5: 241DB1DBE67CFAE3DA0DA7BBD7A6524E
PID: -242179 (-100515) C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\SPEEDKEY.EXE
size: 30208
MD5: 0213A257EB74B904FD416A7C2D09C1AE
PID: -230599 (-100515) C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
size: 69632
MD5: 0D914B23BBC2DD4F6AFF314E1EBDB2AC
PID: -160559 (-100515) C:\WINDOWS\TPPALDR.EXE
size: 118784
MD5: 41701380B16877A69E84A8BE7FE535DD
PID: -214767 (-100515) C:\WINDOWS\RUNDLL32.EXE
size: 24576
MD5: 3857D93AA630ABBD63467DB4AEFFCE2C
PID: -314683 (-253563) C:\WINDOWS\SYSTEM\DDHELP.EXE
size: 49152
MD5: 0677824ECBB0E8D08BEB93FFE9AB60D8
PID: -313419 (-242179) C:\WINDOWS\RUNDLL32.EXE
size: 24576
MD5: 3857D93AA630ABBD63467DB4AEFFCE2C
PID: -144211 (-148099) C:\WINDOWS\SYSTEM\WMIEXE.EXE
size: 16384
MD5: 3DFE9CA6728C02CCD8309DC66B1DFEB1
PID: -133607 (-100515) C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE
size: 4393096
MD5: 09CA174A605B480318731E691DC98539


--- Browser start & search pages list ---
Spybot - Search & Destroy browser pages report, 8/12/06 9:15:02 AM

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.msn.com/access/allinone.asp
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.inventor-warp-speed.com/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\@
http://home.microsoft.com/access/autosearch.asp?p=%s
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
C:\WINDOWS\SYSTEM\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm


--- Winsock Layered Service Provider list ---


--- Uninstall list ---
(DXM_Runtime)

(ICW)

Microsoft Internet Explorer 5.5 and Internet Tools (IE40)
uninstall cmd: rundll32 setupwbv.dll,IE5Maintenance "C:\Program Files\Internet Explorer\Setup\SETUP.EXE" /g "C:\WINDOWS\IE Uninstall Log.Txt"

(DirectDrawEx)

(IE5BAKEX)

(SchedulingAgent)

(MobileOptionPack)

(MSJavaVM)

(MSTASK)

NetMeeting 3.0 (NetMeeting)

Microsoft Outlook Express 5 (OutlookExpress)
uninstall cmd: "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /UNINSTALL /PROMPT

(AddressBook)
uninstall cmd: "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /UNINSTALL /PROMPT

(Branding)

USB Storage Driver (GENEUIDE)
uninstall cmd: DelUIDrv.exe

WinZip (WinZip)
uninstall cmd: "C:\PROGRAM FILES\WINZIP\WINZIP32.EXE" /uninstall

(expinst)

(IEREADME)

(HTMLHelp)

(128PATCH)

(fontcore)

(IEData)

(IE4Data)

(IE_EXTRA)

(VGX)

Macromedia Flash Player 8 8 (ShockwaveFlash)
uninstall cmd: C:\WINDOWS\SYSTEM\Macromed\Flash\UninstFl.exe
publisher: Macromedia
help link: http://www.macromedia.com/go/flashplayer_support/

(ADIELangPack)
uninstall cmd: RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\AD.inf, Uninstall

(Microsoft NetShow Player 2.0)

(MPlayer2)

NVIDIA Windows 95/98/ME Display Drivers (NVIDIA)
uninstall cmd: rundll32.exe C:\WINDOWS\SYSTEM\nvinst32.dll,NvUninstall9x NVAGP.INF

Microsoft IntelliType Pro (Microsoft IntelliType Pro)
uninstall cmd: C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Microsoft Hardware\Keyboard\Uninst.isu" -c"C:\Program Files\Microsoft Hardware\Keyboard\sutils.dll"

Microsoft IntelliPoint (IntelliPoint)
uninstall cmd: C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Microsoft Hardware\Mouse\Uninst.isu" -c"C:\Program Files\Microsoft Hardware\Mouse\Uninstal.dll"

Microsoft Office 2000 Premium 9.00.2720 ({00000409-78E1-11D2-B60F-006097C998E7})
version: 150997664
version (major): 9
estimated size: 5606
install date: 7/2/05
install source: F:\
uninstall cmd: MsiExec.exe /I{00000409-78E1-11D2-B60F-006097C998E7}
publisher: Microsoft Corporation
help link: http://www.microsoft.com/support
readme: C:\Program Files\Microsoft Office\Office\ofread9.txt

Microsoft Web Publishing Wizard 1.6 (WebPost)
uninstall cmd: RunDll32 ADVPACK.DLL,LaunchINFSection C:\WINDOWS\INF\wpie5x86.inf,WebPostUninstall

Personal Web Server (Personal Web Server)
uninstall cmd: C:\Program Files\WebSvr\System\mswebndi.exe /REMOVE

Microsoft Image Composer 1.5 (Image Composer)
uninstall cmd: C:\Program Files\Microsoft Image Composer\setup\acmsetup.exe /t setup.stf

ACDSee (ACDSee)
uninstall cmd: C:\PROGRA~1\ACDSYS~1\ACDSEE\UNWISE.EXE C:\PROGRA~1\ACDSYS~1\ACDSEE\INSTALL.LOG

Microsoft Internet Explorer 5 Web Accessories (IE5WA)
uninstall cmd: RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\IE5WA.inf, Uninstall

Nero 6 (Nero - Burning Rom!UninstallKey)
uninstall cmd: C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL

Adobe Reader 6.0 6.0 ({AC76BA86-7AD7-1033-7B44-000000000001})
version: 100663296
version (major): 6
estimated size: 101344
install date: 20050822
install location: C:\Program Files\Adobe\Acrobat 6.0\Reader\
install source: C:\WINDOWS\CACHE\ADOBE READER 6\
uninstall cmd: MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-000000000001}
publisher: Adobe Systems Incorporated
comments:
contact: Customer Support Department
help link: http://www.adobe.com/support/main.html
help telephone:
readme: C:\Program Files\Adobe\Acrobat 6.0\Reader\Readme.htm

Ad-aware 6 Personal 6.0. (Ad-aware 6 Personal)
uninstall cmd: C:\PROGRA~1\LAVASOFT\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\LAVASOFT\AD-AWA~1\INSTALL.LOG
publisher: Lavasoft Sweden
comments: Ad-aware VI Personal
help link: http://www.lavasoftusa.com

Win9x-ME Promise Ultra100 TX2 (tm) IDE Controller (Ultra)
uninstall cmd: RunDll32 ptistp.dll,LaunchINFSection C:\WINDOWS\INF\other\Promise TechnologyUltra.inf;Ultra100TX2.Uninstall;VEN_105A&DEV_4D68

CROA 1.6 1.6 (CROA_is1)
install location: C:\Program Files\CROA\
uninstall cmd: "C:\Program Files\CROA\unins000.exe"
publisher: David Crowell

USB 2.0 Mass Storage Driver 1.00.000 ({D3DF500C-37E2-4D73-9395-32F474F4966F})
version: 16777216
install location: C:\WINDOWS\
uninstall cmd: RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RUNTIME\0700\INTEL32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D3DF500C-37E2-4D73-9395-32F474F4966F}\SETUP.EXE" -l0x9 -uninst

USB Storage Adapter FX (TPP) (TPPFX)
uninstall cmd: tppun.exe TPPFX

Adobe Photoshop v4.0 (Adobe Photoshop v4.0)
uninstall cmd: C:\WINDOWS\uninst.exe -fC:\Adobe\Photoshop\DeIsL1.isu

Ad-aware 6 Professional 6.0.3.162 (Ad-aware 6 Professional)
uninstall cmd: C:\PROGRA~1\LAVASOFT\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\LAVASOFT\AD-AWA~1\INSTALL.LOG
publisher: Lavasoft Sweden
comments: Ad-aware VI Professional
help link: http://www.lavasoftusa.com

SpywareBlaster v2.5.3 (SpywareBlaster_is1)
uninstall cmd: "C:\Program Files\SpywareBlaster\unins000.exe"

Spybot - Search & Destroy 1.4 1.4 (Spybot - Search & Destroy_is1)
install location: C:\Program Files\Spybot - Search & Destroy\
uninstall cmd: "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
publisher: Safer Networking Limited



--- System Services ---
Service (registry key): Class
Start: 0
Type: 0
Error Control: 0

Service (registry key): VxD
Start: 0
Type: 0
Error Control: 0

Service (registry key): Winsock
Start: 0
Type: 0
Error Control: 0

Service (registry key): WDMFS
Display name: WDM Windows File System Mapper
Image path: \SystemRoot\System32\Drivers\wdmfs.sys
Start: 0
Type: 0
Error Control: 0

Service (registry key): RemoteAccess
Start: 0
Type: 0
Error Control: 0

Service (registry key): Arbitrators
Start: 0
Type: 0
Error Control: 0

Service (registry key): ACPI
Start: 0
Type: 0
Error Control: 0

Service (registry key): USB
Start: 0
Type: 0
Error Control: 0

Service (registry key): WinSock2
Start: 0
Type: 0
Error Control: 0

Service (registry key): NPSTUB
Start: 0
Type: 0
Error Control: 0

Service (registry key): EventLog
Start: 0
Type: 0
Error Control: 0

Service (registry key): W3SVC
Display name: Microsoft HTTP World Wide Web Server
Start: 0
Type: 0
Error Control: 0

Service (registry key): InetInfo
Start: 0
Type: 0
Error Control: 0

Service (registry key): MsFtpSvc
Start: 0
Type: 0
Error Control: 0

Service (registry key): ProtectedStorage
Start: 0
Type: 0
Error Control: 0
steamwiz
2006-08-12, 23:54
HI

The way i interpret it, is that spybot is having trouble checking to see if you have those infections... it's not saying you have them...

windows98 ?

Are you having any problems ?

The best I can advise is that you uninstall spybot & download a fresh copy...

The rest of your spybot log is clean...

I edited your e-mail address ... never post your e-mail in an open forum, spambots scan the forums for addresses & then bombard them with spam e-mails...

steam
inventor
2006-08-13, 01:03
spybot log is clean... red triangels what are they?
thanks
Greg
tashi
2006-08-13, 03:44
inventor, I merged two other topics:
http://forums.spybot.info/showthread.php?t=6567

Please do not start another one in the malware removal forum for the same computer, thank you.

"Post reply" to this one instead.
steamwiz
2006-08-13, 22:27
Hi

The red triangle is there because of the error ... hence "Error during check!:"

This was a problem in earlier versions of spybot ... version 1.4 should have resolved this...

But I see you are running version 1.4 ... so I suspect it is corrupt in some way...

Uninstall it and download a fresh copy...

uninstall instructions :-

http://www.safer-networking.org/en/faq/27.html

More detailed uninstall instructions can be found here (to be sure you get a clean install, when you reinstall) :-

http://forums.spybot.info/showpost.php?p=3130&postcount=2

steam
inventor
2006-08-14, 03:51
steamwiz - I removed spybot and reinstalled via your instructions and did not get any red triangles posted the report below... banned sites are check in spybot but then I ran adware and got wwwinfospace all banned under adware.... then I tried to run both adware and spybot and this did not work IE would not let me pull down any favorites and all the text on the opening page was squashed and in a default font... so I closed adware and just have spybot open. IE works normal now...
1. can you test and see if you can run spybot and adware?
2. In my research hijackthis seems the best! As it installs in the config... can you program this into 1.5 or 2.5 of spybot as CoolwwwSearch and others install before spybot and adware are started....
3. I also have zone alarm which I like for blocking popups I can not stop any popups with spybot can you add a pop up blocker in version 1.5?
4. Do you think spybot would have detected CoolwwwSearch if it was on my computer?
thanks
Greg
http://www.electricwindmillcar.com/



--- Search result list ---
HitBox: Tracking cookie (Internet Explorer: invent) (Cookie, fixed)


DoubleClick: Tracking cookie (Internet Explorer: invent) (Cookie, fixed)


Advertising.com: Tracking cookie (Internet Explorer: invent) (Cookie, fixed)


Avenue A, Inc.: Tracking cookie (Internet Explorer: invent) (Cookie, fixed)


HitBox: Tracking cookie (Internet Explorer: invent) (Cookie, fixed)


MediaPlex: Tracking cookie (Internet Explorer: invent) (Cookie, fixed)



--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

2006-08-13 unins000.exe (51.41.0.0)
2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2005-05-31 Update.exe (1.4.0.0)
2006-02-06 advcheck.dll (1.0.2.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2006-02-20 Tools.dll (2.0.0.2)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2006-08-11 Includes\Cookies.sbi (*)
2006-08-11 Includes\Dialer.sbi (*)
2006-08-11 Includes\Hijackers.sbi (*)
2006-08-11 Includes\Keyloggers.sbi (*)
2006-08-11 Includes\Malware.sbi (*)
2006-08-11 Includes\Revision.sbi (*)
2006-08-11 Includes\Security.sbi (*)
2006-08-11 Includes\Spybots.sbi (*)
2006-08-11 Includes\Trojans.sbi (*)
2005-02-17 Includes\Tracks.uti
2006-08-11 Includes\PUPS.sbi (*)



--- System information ---
Windows 98 (Build: 2222) A


--- Startup entries list ---
Located: HK_LM:Run, Gene USB Monitor
command: C:\WINDOWS\SYSTEM\USBMonit.exe
file: C:\WINDOWS\SYSTEM\USBMonit.exe
size: 45056
MD5: 241db1dbe67cfae3da0da7bbd7a6524e

Located: HK_LM:Run, LoadPowerProfile
command: Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
file: C:\WINDOWS\Rundll32.exe
size: 24576
MD5: 3857d93aa630abbd63467db4aeffce2c

Located: HK_LM:Run, Microsoft IntelliType Pro
command: "C:\Program Files\Microsoft Hardware\Keyboard\speedkey.exe"
file: C:\Program Files\Microsoft Hardware\Keyboard\speedkey.exe
size: 30208
MD5: 0213a257eb74b904fd416a7c2d09c1ae

Located: HK_LM:Run, Microsoft WebServer
command: C:\Program Files\WebSvr\System\svctrl /init
file:

Located: HK_LM:Run, NvCplDaemon
command: RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
file: C:\WINDOWS\RUNDLL32.EXE
size: 24576
MD5: 3857d93aa630abbd63467db4aeffce2c

Located: HK_LM:Run, nwiz
command: nwiz.exe /install
file: C:\WINDOWS\SYSTEM\nwiz.exe
size: 323584
MD5: fce4275c64509c25c2606d90fd285b7f

Located: HK_LM:Run, POINTER
command: point32.exe
file:

Located: HK_LM:Run, ScanRegistry
command: C:\WINDOWS\scanregw.exe /autorun
file: C:\WINDOWS\scanregw.exe
size: 86016
MD5: f123231689e2ab2fa5c636b99314501f

Located: HK_LM:Run, SpybotSnD
command: "C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE"
file: C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE
size: 4393096
MD5: 09ca174a605b480318731e691dc98539

Located: HK_LM:Run, SystemTray
command: SysTray.Exe
file: C:\WINDOWS\SYSTEM\SysTray.Exe
size: 32768
MD5: 73681085dcd0997e531240100ca12b28

Located: HK_LM:Run, TaskMonitor
command: C:\WINDOWS\taskmon.exe
file: C:\WINDOWS\taskmon.exe
size: 28672
MD5: f795110611101279aa15997801abaca0

Located: HK_LM:Run, TPP Auto Loader
command: C:\WINDOWS\TPPALDR.EXE
file: C:\WINDOWS\TPPALDR.EXE
size: 118784
MD5: 41701380b16877a69e84a8be7fe535dd

Located: HK_LM:RunServices, LoadPowerProfile
command: Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
file: C:\WINDOWS\Rundll32.exe
size: 24576
MD5: 3857d93aa630abbd63467db4aeffce2c

Located: HK_LM:RunServices, Microsoft WebServer
command: C:\Program Files\WebSvr\System\inetsw95 -w3svc
file:

Located: HK_LM:RunServices, SchedulingAgent
command: mstask.exe
file: C:\WINDOWS\SYSTEM\mstask.exe
size: 111888
MD5: 39d6b416d9c73a7729cdaed247430d21

Located: HK_CU:Run, NvMediaCenter
command: RUNDLL32.EXE C:\WINDOWS\SYSTEM\NVMCTRAY.DLL,NvTaskbarInit
file: C:\WINDOWS\RUNDLL32.EXE
size: 24576
MD5: 3857d93aa630abbd63467db4aeffce2c

Located: Startup (user), Microsoft Office.lnk
command: C:\Program Files\Microsoft Office\Office\OSA9.EXE
file: C:\Program Files\Microsoft Office\Office\OSA9.EXE
size: 65588
MD5: a89d195caf6a030b152e2a4cabe7018d



--- Browser helper object list ---


--- ActiveX list ---


--- Process list ---
PID: -7369341 (2119113811) C:\WINDOWS\SYSTEM\KERNEL32.DLL
size: 471040
MD5: 375B0813980AE17DCC689E913AB9DD7B
PID: -9881 (-7369341) C:\WINDOWS\SYSTEM\MSGSRV32.EXE
size: 11920
MD5: 15020A139F22CDBF9C70AA8D80F6AE0E
PID: -12553 (-9881) C:\WINDOWS\SYSTEM\MPREXE.EXE
size: 28672
MD5: 562D04789250A81CE629D60646A0D191
PID: -121021 (-12553) C:\WINDOWS\SYSTEM\MSTASK.EXE
size: 111888
MD5: 39D6B416D9C73A7729CDAED247430D21
PID: -6665 (-12553) C:\PROGRAM FILES\WEBSVR\SYSTEM\INETSW95.EXE
size: 15872
MD5: 58B294D1B9FED8E5A98C91296484E8F9
PID: -102197 (-9881) C:\WINDOWS\EXPLORER.EXE
size: 180224
MD5: B22B28F61B1BB06723019307F0FAACFC
PID: -162569 (-102197) C:\WINDOWS\TASKMON.EXE
size: 28672
MD5: F795110611101279AA15997801ABACA0
PID: -148197 (-102197) C:\WINDOWS\SYSTEM\SYSTRAY.EXE
size: 32768
MD5: 73681085DCD0997E531240100CA12B28
PID: -137129 (-102197) C:\WINDOWS\SYSTEM\USBMONIT.EXE
size: 45056
MD5: 241DB1DBE67CFAE3DA0DA7BBD7A6524E
PID: -256733 (-102197) C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\SPEEDKEY.EXE
size: 30208
MD5: 0213A257EB74B904FD416A7C2D09C1AE
PID: -142381 (-102197) C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
size: 69632
MD5: 0D914B23BBC2DD4F6AFF314E1EBDB2AC
PID: -228789 (-102197) C:\WINDOWS\TPPALDR.EXE
size: 118784
MD5: 41701380B16877A69E84A8BE7FE535DD
PID: -203345 (-258029) C:\WINDOWS\SYSTEM\DDHELP.EXE
size: 49152
MD5: 0677824ECBB0E8D08BEB93FFE9AB60D8
PID: -203913 (-102197) C:\WINDOWS\RUNDLL32.EXE
size: 24576
MD5: 3857D93AA630ABBD63467DB4AEFFCE2C
PID: -253001 (-256733) C:\WINDOWS\RUNDLL32.EXE
size: 24576
MD5: 3857D93AA630ABBD63467DB4AEFFCE2C
PID: -292105 (-148197) C:\WINDOWS\SYSTEM\WMIEXE.EXE
size: 16384
MD5: 3DFE9CA6728C02CCD8309DC66B1DFEB1
PID: -292973 (-102197) C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE
size: 4393096
MD5: 09CA174A605B480318731E691DC98539


--- Browser start & search pages list ---
Spybot - Search & Destroy browser pages report, 8/13/06 5:52:35 PM

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.msn.com/access/allinone.asp
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.inventor-warp-speed.com/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\@
http://home.microsoft.com/access/autosearch.asp?p=%s
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
C:\WINDOWS\SYSTEM\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm


--- Winsock Layered Service Provider list ---


--- Uninstall list ---
(DXM_Runtime)

(ICW)

Microsoft Internet Explorer 5.5 and Internet Tools (IE40)
uninstall cmd: rundll32 setupwbv.dll,IE5Maintenance "C:\Program Files\Internet Explorer\Setup\SETUP.EXE" /g "C:\WINDOWS\IE Uninstall Log.Txt"

(DirectDrawEx)

(IE5BAKEX)

(SchedulingAgent)

(MobileOptionPack)

(MSJavaVM)

(MSTASK)

NetMeeting 3.0 (NetMeeting)

Microsoft Outlook Express 5 (OutlookExpress)
uninstall cmd: "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /UNINSTALL /PROMPT

(AddressBook)
uninstall cmd: "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /UNINSTALL /PROMPT

(Branding)

USB Storage Driver (GENEUIDE)
uninstall cmd: DelUIDrv.exe

WinZip (WinZip)
uninstall cmd: "C:\PROGRAM FILES\WINZIP\WINZIP32.EXE" /uninstall

(expinst)

(IEREADME)

(HTMLHelp)

(128PATCH)

(fontcore)

(IEData)

(IE4Data)

(IE_EXTRA)

(VGX)

Macromedia Flash Player 8 8 (ShockwaveFlash)
uninstall cmd: C:\WINDOWS\SYSTEM\Macromed\Flash\UninstFl.exe
publisher: Macromedia
help link: http://www.macromedia.com/go/flashplayer_support/

(ADIELangPack)
uninstall cmd: RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\AD.inf, Uninstall

(Microsoft NetShow Player 2.0)

(MPlayer2)

NVIDIA Windows 95/98/ME Display Drivers (NVIDIA)
uninstall cmd: rundll32.exe C:\WINDOWS\SYSTEM\nvinst32.dll,NvUninstall9x NVAGP.INF

Microsoft IntelliType Pro (Microsoft IntelliType Pro)
uninstall cmd: C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Microsoft Hardware\Keyboard\Uninst.isu" -c"C:\Program Files\Microsoft Hardware\Keyboard\sutils.dll"

Microsoft IntelliPoint (IntelliPoint)
uninstall cmd: C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Microsoft Hardware\Mouse\Uninst.isu" -c"C:\Program Files\Microsoft Hardware\Mouse\Uninstal.dll"

Microsoft Office 2000 Premium 9.00.2720 ({00000409-78E1-11D2-B60F-006097C998E7})
version: 150997664
version (major): 9
estimated size: 5606
install date: 7/2/05
install source: F:\
uninstall cmd: MsiExec.exe /I{00000409-78E1-11D2-B60F-006097C998E7}
publisher: Microsoft Corporation
help link: http://www.microsoft.com/support
readme: C:\Program Files\Microsoft Office\Office\ofread9.txt

Microsoft Web Publishing Wizard 1.6 (WebPost)
uninstall cmd: RunDll32 ADVPACK.DLL,LaunchINFSection C:\WINDOWS\INF\wpie5x86.inf,WebPostUninstall

Personal Web Server (Personal Web Server)
uninstall cmd: C:\Program Files\WebSvr\System\mswebndi.exe /REMOVE

Microsoft Image Composer 1.5 (Image Composer)
uninstall cmd: C:\Program Files\Microsoft Image Composer\setup\acmsetup.exe /t setup.stf

ACDSee (ACDSee)
uninstall cmd: C:\PROGRA~1\ACDSYS~1\ACDSEE\UNWISE.EXE C:\PROGRA~1\ACDSYS~1\ACDSEE\INSTALL.LOG

Microsoft Internet Explorer 5 Web Accessories (IE5WA)
uninstall cmd: RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\IE5WA.inf, Uninstall

Nero 6 (Nero - Burning Rom!UninstallKey)
uninstall cmd: C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL

Adobe Reader 6.0 6.0 ({AC76BA86-7AD7-1033-7B44-000000000001})
version: 100663296
version (major): 6
estimated size: 101344
install date: 20050822
install location: C:\Program Files\Adobe\Acrobat 6.0\Reader\
install source: C:\WINDOWS\CACHE\ADOBE READER 6\
uninstall cmd: MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-000000000001}
publisher: Adobe Systems Incorporated
comments:
contact: Customer Support Department
help link: http://www.adobe.com/support/main.html
help telephone:
readme: C:\Program Files\Adobe\Acrobat 6.0\Reader\Readme.htm

Ad-aware 6 Personal 6.0. (Ad-aware 6 Personal)
uninstall cmd: C:\PROGRA~1\LAVASOFT\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\LAVASOFT\AD-AWA~1\INSTALL.LOG
publisher: Lavasoft Sweden
comments: Ad-aware VI Personal
help link: http://www.lavasoftusa.com

Win9x-ME Promise Ultra100 TX2 (tm) IDE Controller (Ultra)
uninstall cmd: RunDll32 ptistp.dll,LaunchINFSection C:\WINDOWS\INF\other\Promise TechnologyUltra.inf;Ultra100TX2.Uninstall;VEN_105A&DEV_4D68

CROA 1.6 1.6 (CROA_is1)
install location: C:\Program Files\CROA\
uninstall cmd: "C:\Program Files\CROA\unins000.exe"
publisher: David Crowell

USB 2.0 Mass Storage Driver 1.00.000 ({D3DF500C-37E2-4D73-9395-32F474F4966F})
version: 16777216
install location: C:\WINDOWS\
uninstall cmd: RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RUNTIME\0700\INTEL32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D3DF500C-37E2-4D73-9395-32F474F4966F}\SETUP.EXE" -l0x9 -uninst

USB Storage Adapter FX (TPP) (TPPFX)
uninstall cmd: tppun.exe TPPFX

Adobe Photoshop v4.0 (Adobe Photoshop v4.0)
uninstall cmd: C:\WINDOWS\uninst.exe -fC:\Adobe\Photoshop\DeIsL1.isu

Ad-aware 6 Professional 6.0.3.162 (Ad-aware 6 Professional)
uninstall cmd: C:\PROGRA~1\LAVASOFT\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\LAVASOFT\AD-AWA~1\INSTALL.LOG
publisher: Lavasoft Sweden
comments: Ad-aware VI Professional
help link: http://www.lavasoftusa.com

Adobe Shockwave Player 10.1.3.18 (Adobe Shockwave Player)
uninstall cmd: C:\WINDOWS\SYSTEM\MACROMED\SHOCKW~2\UNWISE.EXE C:\WINDOWS\SYSTEM\MACROMED\SHOCKW~2\Install.log
publisher: Adobe Systems, Inc.
help link: http://www.adobe.com/support/shockwave

(Shockwave)

Spybot - Search & Destroy 1.4 1.4 (Spybot - Search & Destroy_is1)
install location: C:\Program Files\Spybot - Search & Destroy\
uninstall cmd: "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
publisher: Safer Networking Limited



--- System Services ---
Service (registry key): Class
Start: 0
Type: 0
Error Control: 0

Service (registry key): VxD
Start: 0
Type: 0
Error Control: 0

Service (registry key): Winsock
Start: 0
Type: 0
Error Control: 0

Service (registry key): WDMFS
Display name: WDM Windows File System Mapper
Image path: \SystemRoot\System32\Drivers\wdmfs.sys
Start: 0
Type: 0
Error Control: 0

Service (registry key): RemoteAccess
Start: 0
Type: 0
Error Control: 0

Service (registry key): Arbitrators
Start: 0
Type: 0
Error Control: 0

Service (registry key): ACPI
Start: 0
Type: 0
Error Control: 0

Service (registry key): USB
Start: 0
Type: 0
Error Control: 0

Service (registry key): WinSock2
Start: 0
Type: 0
Error Control: 0

Service (registry key): NPSTUB
Start: 0
Type: 0
Error Control: 0

Service (registry key): EventLog
Start: 0
Type: 0
Error Control: 0

Service (registry key): W3SVC
Display name: Microsoft HTTP World Wide Web Server
Start: 0
Type: 0
Error Control: 0

Service (registry key): InetInfo
Start: 0
Type: 0
Error Control: 0

Service (registry key): MsFtpSvc
Start: 0
Type: 0
Error Control: 0

Service (registry key): ProtectedStorage
Start: 0
Type: 0
Error Control: 0
steamwiz
2006-08-14, 19:44
Hi

I'm not surprised you had problems if you were trying to run Spybot & Adaware at the same time...

2 programs scanning your system, doing the same thing at the same time are bound to conflict...

It's OK to have spybot & Adaware installed, but you should update and run one, then wait till it has finished before updating and running the other...

I've passed your comments on ...

--
Something you should be aware of, if you aren't allready...

You should have updated IE to IE6 a long time ago IE5.5 is extremely insecure...

Also read these links about win98...

End of support for Windows 98 and Windows Me
http://forums.spybot.info/showpost.php?p=28501&postcount=5


End of support for Windows 98/ME; will Spybot follow suit?
http://forums.spybot.info/showthread.php?t=4497

steam
tashi
2006-08-14, 20:46
2. In my research hijackthis seems the best! As it installs in the config... can you program this into 1.5 or 2.5 of spybot as CoolwwwSearch and others install before spybot and adware are started....
HijackThis doesn't scan the entire system and is only used for undetected or hard to remove nasties.

Also, HijackThis is an advanced tool and should not be used by inexperienced users to avoid damage to the system. If you delete items without knowing what they are, it can lead to other problems, ie:losing your Internet connection or problems running Windows.

In a nutshell, if you do not have advanced knowledge about computers you should not fix entries using HijackThis without consulting an expert.

HijackThis belongs to the developer Merijn Bellekom (http://www.merijn.org/) and as such his tool is a stand-alone and will not be incorporated into Spybot-S&D.



3. I also have zone alarm which I like for blocking popups I can not stop any popups with spybot can you add a pop up blocker in version 1.5?

If you have suggestions for the next version of Spybot-S&D please post them here:
Spybot-S&D Beta (http://forums.spybot.info/forumdisplay.php?f=12)


4. Do you think spybot would have detected CoolwwwSearch if it was on my computer?

Spybot-S&D does detect certain variants of CWS. However there are many, and under new disguises. ;)

As the problem appears to be resolved this topic has been archived.

If you need it re-opened please send me or your helper a private message (pm) and provide a link to the thread.

Applies only to the original topic starter.