Microsoft IE 6 Problem

Hi Charles & Lonny,
Finally got it with Lonny's help with copying & pasting.
The following list includes everything SpyBot listed & I removed:

--- Report generated: 2003-09-16 16:00 --- --- Spybot-S&D version: 1.2 ---
Advertising.com: Tracking cookie or cookie of tracking site (File, fixed)
C:\Documents and Settings\J Slow\Cookies\j slow@www.directnetadvertising[1].txt
Advertising.com: Tracking cookie or cookie of tracking site (File, fixed)
C:\Documents and Settings\JSlow\Cookies\j slow@advertising[2].txt
Alexa Related: What's related link (Replace file, fixed)
C:\WINDOWS\Web\RELATED.HTM
Avenue A, Inc.: Tracking cookie or cookie of tracking site (File, fixed)
C:\Documents and Settings\JSlow\Cookies\jslow@atdmt[2].txt
BDE Projector: Application settings (Registry key, fixed)

Thanks
HKEY_CLASSES_ROOT\Applications\BDEViewer.exe
BDE Projector: Updater settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\ZUpdate
BFast: Tracking cookie or cookie of tracking site (File, fixed)
C:\Documents and Settings\JSlow\Cookies\jslow@bfast[1].txt
Download Accelerator Plus: Default ad server (Registry change, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\SpeedBit\Download Accelerator\ADSDefaultServer=http://127.0.0.1
Download Accelerator Plus ads: Ad category (Registry key, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\SpeedBit\Download Accelerator\ADSSecondMedia
Download Accelerator Plus ads: Banner (Replace file, fixed)
C:\PROGRA~1\DAP\dap.gif
Download Accelerator Plus ads: Class (Registry key, fixed)
HKEY_CLASSES_ROOT\DAPIEBar.DAPIEBarBand.1
Download Accelerator Plus ads: Class (Registry key, fixed)
HKEY_CLASSES_ROOT\DAPIEBar.DAPIEBarBand
Download Accelerator Plus ads: Class ID (Registry key, fixed)
HKEY_CLASSES_ROOT\CLSID\{62999427-33FC-4baf-9C9C-BCE6BD127F08}
Download Accelerator Plus ads: Default ad category (Registry change, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\SpeedBit\Download Accelerator\ADSDefaultCategory=Default
Download Accelerator Plus ads: IE extension (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{669695BC-A811-4A9D-8CDF-BA8C795F261C}
DSO Exploit: Data source object exploit (Registry change, fixed)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004=W=3
DSO Exploit: Data source object exploit (Registry change, fixed)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004=W=3
DSO Exploit: Data source object exploit (Registry change, fixed)
HKEY_USERS\S-1-5-21-2966927733-1907411925-173008773-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004=W=3
DSO Exploit: Data source object exploit (Registry change, fixed)
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004=W=3
DSO Exploit: Data source object exploit (Registry change, fixed)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004=W=3
FastClick: Tracking cookie or cookie of tracking site (File, fixed)
C:\Documents and Settings\JSlow\Cookies\jslow@fastclick[2].txt
HitBox: Tracking cookie or cookie of tracking site (File, fixed)
C:\Documents and Settings\JSlow\Cookies\jslow@ehg-worldvision.hitbox[2].txt
HitBox: Tracking cookie or cookie of tracking site (File, fixed)
C:\Documents and Settings\JSlow\Cookies\jslow@ehg-idg.hitbox[2].txt
HitBox: Tracking cookie or cookie of tracking site (File, fixed)
C:\Documents and Settings\JSlow\Cookies\jslow@w101.hitbox[2].txt
HitBox: Tracking cookie or cookie of tracking site (File, fixed)
C:\Documents and Settings\JSlow\Cookies\jslow@ehg-dig.hitbox[1].txt
HitBox: Tracking cookie or cookie of tracking site (File, fixed)
C:\Documents and Settings\JSlow\Cookies\jslow@hitbox[2].txt
HitBox: Tracking cookie or cookie of tracking site (File, fixed)
C:\Documents and Settings\Slow\Cookies\jslow@phg.hitbox[2].txt
HitBox: Tracking cookie or cookie of tracking site (File, fixed)
C:\Documents and Settings\JSlow\Cookies\jslow@ehg-bestbuy.hitbox[1].txt
HitsLink: Tracking cookie or cookie of tracking site (File, fixed)
C:\Documents and Settings\JSlow\Cookies\jslow@counter.hitslink[1].txt
IPinsight: Browser helper object (Registry key, fixed) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000004CC-E4FF-4F2C-BC30-DBEF0B983BC9}
IPinsight: Class (Registry key, fixed)
HKEY_CLASSES_ROOT\IPInsigt.IPInsigtObj.1
IPinsight: Class ID (Registry key, fixed)
HKEY_CLASSES_ROOT\CLSID\{000004CC-E4FF-4F2C-BC30-DBEF0B983BC9}
IPinsight: Executable (File, fixing failed)
C:\WINDOWS\IPINSIGT.DLL
IPinsight: Executable (File, fixed)
C:\WINDOWS\Sentry.exe
IPinsight: Global settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\IPInsight
IPinsight: Installer (File, fixed)
C:\WINDOWS\INF\IPINSIGT.inf
IPinsight: Interface (Registry key, fixed)
HKEY_CLASSES_ROOT\Interface\{297AFC77-2039-4D3C-BEF9-598819EB2C8A}
IPinsight: Type library (Registry key, fixed)
HKEY_CLASSES_ROOT\Typelib\{BE35582C-9796-4CF1-AED9-556ADA120B38}
IPinsight: Uninstall settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IPinsight
MediaPlex: Tracking cookie or cookie of tracking site (File, fixed)
C:\Documents and Settings\John Slowikowski\Cookies\john slowikowski@mediaplex[1].txt
TargetNet: Tracking cookie or cookie of tracking site (File, fixed)
C:\Documents and Settings\JSlow\Cookies\slow@targetnet[2].txt
ValueClick: Tracking cookie or cookie of tracking site (File, fixed)
C:\Documents and Settings\JSlow\Cookies\jslow@valueclick[1].txt
VX2/f: Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{00000580-C637-11D5-831C-00105AD6ACF0}
VX2/f: Class (Registry key, fixed)
HKEY_CLASSES_ROOT\MSView.MSViewObj.1
VX2/f: Class (Registry key, fixed)
HKEY_CLASSES_ROOT\VX2.VX2Obj
VX2/f: Class ID (Registry key, fixed)
HKEY_CLASSES_ROOT\CLSID\{00000580-C637-11D5-831C-00105AD6ACF0}
VX2/f: Global settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\MSView
VX2/f: Interface (Registry key, fixed)
HKEY_CLASSES_ROOT\Interface\{4534CD6B-59D6-43FD-864B-06A0D843444A}
VX2/f: Library (File, fixing failed)
C:\WINDOWS\MSView.DLL
VX2/f: Type library (Registry key, fixed)
HKEY_CLASSES_ROOT\TypeLib\{690BCCB4-6B83-4203-AE77-038C116594EC}
Windows Media Player: Client ID (Registry change, fixed)
HKEY_USERS\S-1-5-21-2966927733-1907411925-173008773-1005\Software\Microsoft\MediaPlayer\Player\Settings\Client ID=
WurldMedia: Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{BF331901-8B2A-4CA9-A14A-57BC06D3C61D}
WurldMedia: Class (Registry key, fixed)
HKEY_CLASSES_ROOT\CLSID\{BF331901-8B2A-4CA9-A14A-57BC06D3C61D}
WurldMedia: Global settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\mscrp
WurldMedia: Interface ( (IIEHlprObj)) (Registry key, fixed)
HKEY_CLASSES_ROOT\Interface\{A83E42B1-1AE7-4CE6-B128-AB0F4A126B2C}

 

Hi jslow,

Great, thanks much. Sent you a PM before looking in here.

I can see a lot of entries that affected IE. I'm going to save the list for future reference.


Lonny,

Far from getting in the way, you made it work. That's what makes this Board great. Thank You.

Regards - Charles

 

VX2/f: Library (File, fixing failed)
IPinsight: Executable (File, fixing failed)

Are these still showing up evertime SpyBot scans ?
I assume it had just needed to restart the pc in order to fix.?

" "You should delete the 'sentry.ini' as well and other related files pertaining to IPInsight/sentry variants can be found here:
http://www.doxdesk.com/parasite/IPInsight.html " "" " "

Or parts of it could be somewhat legit
" "ipinsight via verizon
unnecessary, known to phone home but checked, fixed and deleted "

You could post a hijackthis log for us
I love SpyBot But its logs are well not up to par yet.

Lonny

 

Hi jslow,

The link for HijackThis http://www.tomcoyote.org/hjt/ There is a tutorial as well.

There are a number of Boards to post the results besides here as well. Add-Aware has a new section for just this http://www.lavasoftsupport.com/index.php?showforum=44 or at SpywareInfo http://www.spywareinfo.com/yabbse/

Once you get a "clean" log from HJT, keep it as a baseline to compare against for the future. Very easy to spot anything new, benign or not.

Regards - Charles

 

jslow - for what it's worth, Ad-aware did go thru a long period when they didn't do updates. But their newest engine is redesigned and is now faster that Spybot plus they are updating their spyware list regularly.

I think it's well worth while to run both Ad-aware and Spybot. But you'll need to download the latest version then run the update feature.