Re: Downloads and Spyware
From: Shenan Stanley (news_helper_at_hushmail.com)
Date: 09/05/04
- Next message: RRR_News: "Re: unpartitioning a drive"
- Previous message: Thorsten Matzner: "Re: Windows 98/xp"
- In reply to: Pete Q: "Re: Downloads and Spyware"
- Messages sorted by: [ date ] [ thread ]
Date: Sun, 5 Sep 2004 14:24:43 -0500
Pete Q wrote:
> Thanks for the tip! I wasn't aware you could crosspost.
> How is this done?
Depends on your current method of posting. The web page instructions would
differ from the Outlook Express instructions and the Outlook Express
instructions would differe from FreeAgent instructions.
> As far as the spyware is concerned it sounds like you are
> saying in nearly all cases I should delete if Ad-aware or
> spybot finds it. (I haven't installed spybot yet but was
> planning to do this as well)
Correct. Although the process is not perfect, I have cleaned systems with
more than 1200 (some just cookies) of spyware/adware/malware and erasing
them had no ill effect. I cannot say it NEVER has an ill effect - but most
of the time - none.
> You referenced the WTOOLS as being one of the worst. I am
> assuming that "WTOOLS" AND "WINTOOLS" are considered the
> same with the latter being equally bad? I had some files
> that were identified as WTOOLS and others and WINTOOLS.
This site may help you sort through the logs:
http://www.xtremecomputing.co.uk/forum/showthread.php?t=2248
This one is someone with wtools problems:
http://help.lockergnome.com/index.php?showtopic=24072
> Next to the temp files most of the others that were
> identified were the following. I would appreciate if you
> could scroll down the list quickly and let me know if you
> see anything that you think should be kept. (Again, this
> is my first time with the spyware experience and just
> want to make sure I am not getting rid of something I
> need).
>
> obj[63]=File : C:\System Volume Information\_restore
> {AEE18235-44F1-49E2-A53B-7A4B7FDD6850}\RP149\A0018436.exe
> obj[64]=File : C:\System Volume Information\_restore
> {AEE18235-44F1-49E2-A53B-7A4B7FDD6850}\RP158\A0018660.exe
> obj[65]=File : C:\System Volume Information\_restore
> {AEE18235-44F1-49E2-A53B-7A4B7FDD6850}\RP159\A0018728.dll
> obj[66]=File : C:\System Volume Information\_restore
> {AEE18235-44F1-49E2-A53B-7A4B7FDD6850}\RP159
> \snapshot\MFEX-1.DAT
>
>
> obj[8]=Regkey : protocols\name-space
> handler\res\wtoolsb.resprotocol
> obj[9]=Regkey : wtoolsb.resprotocol
> obj[10]=Regkey : clsid\{a8deb4a5-d9ef-4d21-b4f6-
> 921475004e7d}
> obj[11]=Regkey : clsid\{87766247-311c-43b4-8499-
> 3d5fec94a183}
> obj[12]=Regkey : clsid\{87067f04-de4c-4688-bc3c-
> 4fcf39d609e7}
> obj[13]=Regkey : S-1-5-21-4083798302-572454927-963639892-
> 1003\software\wintools
> obj[14]=Regkey : software\wintools
> obj[15]=RegValue :
> Software\Microsoft\Windows\CurrentVersion\Run
> obj[16]=File : C:\Documents and Settings\Owner\Local
> Settings\Temp\IExploreSkins.exe
>
> obj[7]=Regkey : software\microsoft\internet
> explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
>
> obj[8]=Regkey : protocols\name-space
> handler\res\wtoolsb.resprotocol
> obj[9]=Regkey : wtoolsb.resprotocol
> obj[10]=Regkey : clsid\{a8deb4a5-d9ef-4d21-b4f6-
> 921475004e7d}
> obj[11]=Regkey : clsid\{87766247-311c-43b4-8499-
> 3d5fec94a183}
> obj[12]=Regkey : clsid\{87067f04-de4c-4688-bc3c-
> 4fcf39d609e7}
>
> POSSIBLE BROWSER HIJACK ATTEMPT
> »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
> obj[15]=RegData : Software\Microsoft\Internet
> Explorer\Main
> obj[16]=RegData : Software\Microsoft\Internet
> Explorer\Search
> obj[17]=RegData : S-1-5-21-4083798302-572454927-963639892-
> 1003\Software\Microsoft\Internet Explorer\Main
>
>
> ArchiveData(auto-quarantine- 2004-09-04 22-02-19.bckp)
> Referencefile : SE1R6 30.08.2004
I really see nothing that would be harmful to delete. I cannot say that
will completely rid you of all the spyware - but it looks like it should be
a good start. Reboot after you do it. Then immediately rerun the scanners.
-- <- Shenan -> -- The information is provided "as is", it is suggested you research for yourself before you take any advice - you are the one ultimately responsible for your actions/problems/solutions. Know what you are getting into before you jump in with both feet.
- Next message: RRR_News: "Re: unpartitioning a drive"
- Previous message: Thorsten Matzner: "Re: Windows 98/xp"
- In reply to: Pete Q: "Re: Downloads and Spyware"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
|
