website defense check

cabra · August 30, 2009

When I run the security element of asc I have 33 items listed as unimmunized.

For example --zcodec.com--xxxtoolbar.com---spyshredder.com .When I tick the boxes to select them for immunize there is an error message and they remain listed.Also in the registry I cannot delete them. Anyone know how this can be done and also where I can find out if these entries are safe.

The error message I get reads, The"entry"cannot be opened.An error is preventing this key from being opened.Details-access is denied. I am running the reg-editor as administrator.

Thank You

enoskype · August 30, 2009

You have malware in your PC, you have to clean them before immunizing them.

Example:

SpyShredder, or Spy-Shredder, is the successor to the rogue anti-spyware program called SpySheriff

Use IObit Security 360 with latest definitions.

Use it's unlok function also if you find unaccessable files.

If unsuccesfull, use:

SmitFraudFix (Automated Fix)

Try MalwareBytes' Anti-Malware also.

Post your HijackThis report hereafter cleaning.

Cheers.

cabra · August 31, 2009

website defence check

Thank you for your reply.I have ran iobit security 360 and found 2 errors which were removed

IObit Security 360

OS:Windows Vista

Version:0.4.0.20

Define Version:1150

Time Elapsed:8/31/2009 7:26:39 PM

Objects Scanned:77187

Threats Found:2

Suspicious Malware_Heur, File, C:\Users\William Anne\Downloads\RegistryEasy.exe, 8-819

Dropper.SuperCool, File, C:\Users\William Anne\Downloads\WGAPluginInstall.exe, 12-877

I am having a problem posting hjt log as I get a message that I have exceeded the number of characters by 1000.I need further help on this.

I have also ran anti-malware ,spybot --nothing found and stopzilla which found 2 errors and removed them ,plus advanced system care pro which I mentioned found 33 and are still there unimmunized.

enoskype · August 31, 2009

When you use IS 360 Passive Defense, are they unblocked there?

Did you try regedit with Run as Administrator option in command prompt?

cabra · September 1, 2009

website defense check

Hi , The 33 items in website defense are still unimmunized after your suggestions. I have ran regedit as administrator in command and in safe mode but cannot delete the entries although I have only tried about 6 at random and get error message>error opening key access denied.

I have been unable to download smitfraudfix.exe as i get page not found error despite several attempts from different sources.

THIS IS PART 1 OF HJT LOG. PART 2 TO FOLLOW

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:36:40 PM, on 9/1/2009

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v8.00 (8.00.6001.18813)

Boot mode: Normal

Running processes:

C:\Windows\SOUNDMAN.EXE

C:\Program Files (x86)\SecureIT\SCControlPanel.exe

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\Program Files (x86)\Java\jre6\bin\jusched.exe

C:\Program Files (x86)\IObit\IObit Security 360\is360tray.exe

C:\Program Files (x86)\STOPzilla!\STOPzilla.exe

C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.uk

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=ytie

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.co.uk

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll

O1 - Hosts: ::1 localhost

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll

O2 - BHO: SITEguard BHO - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files (x86)\STOPzilla!\SZSG.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll

O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\siteadvisor\mcieplg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files (x86)\STOPzilla!\SZIEBHO.dll

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll

O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\siteadvisor\mcieplg.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll

O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files (x86)\STOPzilla!\SZSG.dll

cabra · September 1, 2009

website defense check

O4 - HKLM\..\Run: [sCControlPanel] "C:\Program Files (x86)\SecureIT\SCControlPanel.exe"

O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [iObit Security 360] C:\Program Files (x86)\IObit\IObit Security 360\IS360tray.exe

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\is3\anti-spyware\is3lsp.dll

O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\siteadvisor\mcieplg.dll

O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O23 - Service: a-squared Free Service (a2free) - Unknown owner - C:\Program Files (x86)\a-squared Free\a2service.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe

O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files (x86)\NOS\bin\getPlus_HelperSvc.exe

O23 - Service: Google Update Service (gupdate1c991fd5b874433) (gupdate1c991fd5b874433) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe

O23 - Service: IS360service - IObit - C:\Program Files (x86)\IObit\IObit Security 360\IS360srv.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe

O23 - Service: SecureIT Monitor (SCMonitor) - SecurityCoverage Inc. - C:\Program Files (x86)\SecureIT\scmonitor\SCMonitorService.exe

O23 - Service: SecureIT Update Service (scupdateservice) - SecurityCoverage Inc. - C:\Program Files (x86)\SecureIT\scmonitor\SCUpdateService.exe

O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files (x86)\Common Files\iS3\Anti-Spyware\SZServer.exe

O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - Unknown owner - C:\Windows\System32\TuneUpDefragService.exe (file missing)

O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - Unknown owner - C:\Windows\System32\TUProgSt.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

--

End of file - 10484 bytes

Many thanks for your time .hope this is of some use.

enoskype · September 1, 2009

Hi capra,

The below files are missing from your system, most probably as a result of having malware before.

lsass.exe : Local Security Authority Process

msdtc.exe : Microsoft Distributed Transaction Coordinator Service

nvvsvc.exe : NIVIDIA Display Driver Service

locator.exe : Rpc Locator

Slsvc.exe : Windows Software Licensing Service

spoolsv.exe : Spooler Sub System

TuneUpDefragService.exe : Tuneup Defrag Service

TUProgSt.exe : Tuneup Program Statistics Service

vds.exe : Virtual Disk Service

vssvc.exe : Volume Shadow Copy Service

WmiApSrv.exe : WMI Performance Reverse Adapter

wmpnetwk.exe : Windows Media Player Networking Service

Uninstall STOP Zilla, and Secure It, then, use:

sfc : system file checker (System Integrity Check and Repair)

You can find the procedure by a search.

Please have a look at here to take the ownership of a registry key to delete it.

You did not answer my question of "When you use IS 360 Passive Defense, are they unblocked there?"

Cheers.

cabra · September 2, 2009

website defence check

Hi , Yes the entries are still unblocked when checking with iso passive defence.

I select all--with all the boxes ticked , and select apply,but the entries remain unblocked. I will carry out your other instructions soon and reply.

Thank you.

cabra · September 2, 2009

website defence check

Hi Again,

I have uninstalled the two programs you suggested. I have carried out sfc and nothing was found to be wrong. no files were replaced.

I have been back into the registry to try and delete the entries which would not delete and changed permissions and it did not appear to work until by accident I managed to delete them eventually.When I clicked to delete I got error message-cannot be opened. An error is preventing this key from being opened. I got this even when trying to expand the entry and was ready to admit defeat until I went and tried delete again and after a small delay the entry did delete. I have done this with them all and they have all gone.

Also in iobit security the 33 entries which were listed as unblocked have now remained blocked.

The only outstanding problem appears to be the missing files you listed .I have not tried yet to find them manually until you reply, and also can I reinstall the 2 programmes I uninstalled???

Thank you

enoskype · September 2, 2009

Nice to know that everything is back in order.

Check each missing file if they are at their location. (I doubt the Nividia, one, Media player one, may be!!!)

Sfc, could have put the files to the correct places, so there is possibility that you can find them in places.

Try HijackThis again.

For STOPzilla please read this. I wouldn't use it if I were you!

You can use Secure IT, but remember always that it is an encyption program, so, other software may not access to the files manipulated by it.

Cheers.

cabra · September 3, 2009

website defense check

hi,

all the files seem to be where they should be.Is The hjt log O.K.?

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:07:56 PM, on 9/3/2009

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v8.00 (8.00.6001.18813)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe

C:\Windows\SOUNDMAN.EXE

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\Program Files (x86)\Java\jre6\bin\jusched.exe

C:\Program Files (x86)\IObit\IObit Security 360\is360tray.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe