Spy Sweeper - Potentially Rootkit Masked Registry

Question

Downloaded Spy Sweeper 5.8.1 (build 55) and first scan displays 'potentially rootkit-masked registry'. Chose Quarantine, says it Quarantined, but looking in Quarantined list it isn't there. Next scan shows same problem (16 registry traces listed) Reply from Webroot says to download updates, unplug internet connection, restart, run two Full Scans and the problem will be fixed.....nope it doesn't. Even tried unplugged from internet, Safe Mode Spy Sweeper scan and it shows 11 traces of same problem. Quarantine in Safe Mode doesn't clean either.   PC running OK, maybe a little slower. Thanks for any help. LLRodd    Norton Internet Security Virus scan is clean.    HijackThis log below.   Logfile of Trend Micro HijackThis v2.0.2Scan saved at 2:34:48 PM, on 9/4/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16705)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Common Files\Symantec Shared\ccProxy.exeC:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exeC:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxpers.exeC:\Program Files\Analog Devices\Core\smax4pnp.exeC:\Program Files\CyberLink\PowerDVD\DVDLauncher.exeC:\WINDOWS\System32\DLA\DLACTRLW.EXEC:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Java\jre1.6.0_01\bin\jusched.exeC:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exeC:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXEC:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXEC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEC:\Program Files\Webroot\Spy Sweeper\SSU.EXEC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://weather.unisys.com/radar/rad_se_loop.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.comO2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLLO2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dllO2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dllO2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dllO3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dllO3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dllO3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [igfxtray] 'C:\WINDOWS\system32\igfxtray.exe'O4 - HKLM\..\Run: [igfxhkcmd] 'C:\WINDOWS\system32\hkcmd.exe'O4 - HKLM\..\Run: [igfxpers] 'C:\WINDOWS\system32\igfxpers.exe'O4 - HKLM\..\Run: [SoundMAXPnP] 'C:\Program Files\Analog Devices\Core\smax4pnp.exe'O4 - HKLM\..\Run: [DVDLauncher] 'C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe'O4 - HKLM\..\Run: [DLA] 'C:\WINDOWS\System32\DLA\DLACTRLW.EXE'O4 - HKLM\..\Run: [ISUSPM Startup] 'C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe' -startupO4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -startO4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe'O4 - HKLM\..\Run: [Symantec PIF AlertEng] 'C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe' /a /m 'C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll'O4 - HKLM\..\Run: [SpySweeper] 'C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe' /startintrayO8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htmO8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htmO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyPoker\PartyPokerNet\RunPF.exeO9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyPoker\PartyPokerNet\RunPF.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cabO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dllO16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cabO16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsi.cabO16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsr.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151096602640O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1182880822187O16 - DPF: {A1B8A30B-8AAA-4A3E-8869-1DA509E8A011} (Crystal ActiveX Report Viewer Control 10.0) - https://www.peryourhealth.com/crystalreportviewers10/ActiveXControls/ActiveXViewer.cabO16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cabO16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://homesphere.webex.com/client/v_mywebex-t20/support/ieatgpc.cabO17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = JMHB.localO17 - HKLM\Software\..\Telephony: DomainName = JMHB.localO17 - HKLM\System\CCS\Services\Tcpip\..\{C968500B-6A7E-4249-9484-86A5215D0B3B}: NameServer = 192.168.1.28,205.152.37.23O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = JMHB.localO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exeO23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeO23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exeO23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exeO23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXEO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exeO23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeO23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe --End of file - 10497 bytes

LLRodd · Answer

Spy Sweeper scan from above entry detail below for 16 traces. Each line starts with the time stamp, wrapped here. Note all are in the Webroot folder.

10:57 AM:   HKU\S-1-5-21-1177238915-1390067357-839522115-1109\Software\Webroot\SpySweeper\IEH || ™šŸœŸ“˜Ÿ’÷øÄÍßÜÊÙÎ÷æÂÈÙÄØÄÍß÷âÅßÎÙÅÎß‹îÓÛÇÄÙÎÙ÷æÊÂÅøßÊÙß‹ûÊÌÎ (ID = 0)
10:57 AM:   HKU\S-1-5-21-1177238915-1390067357-839522115-1109\Software\Webroot\SpySweeper\IEH || ™šŸœŸ“˜Ÿ’÷øÄÍßÜÊÙÎ÷æÂÈÙÄØÄÍß÷âÅßÎÙÅÎß‹îÓÛÇÄÙÎÙ÷øÎÊÙÈÃèÞØßÄÆÂÑÎøÎÊÙÈÃ (ID = 0)
10:57 AM:   HKU\S-1-5-21-1177238915-1390067357-839522115-1109\Software\Webroot\SpySweeper\IEH || ™šŸœŸ“˜Ÿ’÷øÄÍßÜÊÙÎ÷æÂÈÙÄØÄÍß÷âÅßÎÙÅÎß‹îÓÛÇÄÙÎÙ÷øÎÊÙÈÃøÎÊÙÈÃêØØÂØßÊÅß (ID = 0)
10:57 AM:   HKU\S-1-5-21-1177238915-1390067357-839522115-1109\Software\Webroot\SpySweeper\IEH || ™šŸœŸ“˜Ÿ’÷øÄÍßÜÊÙÎ÷æÂÈÙÄØÄÍß÷âÅßÎÙÅÎß‹îÓÛÇÄÙÎÙ÷æÊÂÅøÎÊÙÈÃ‹ûÊÌÎ (ID = 0)
10:57 AM:   HKU\S-1-5-21-1177238915-1390067357-839522115-1109\Software\Webroot\SpySweeper\IEH || ™šŸœŸ“˜Ÿ’÷øÄÍßÜÊÙÎ÷æÂÈÙÄØÄÍß÷âÅßÎÙÅÎß‹îÓÛÇÄÙÎÙ÷æÊÂÅøÎÊÙÈÃ‹éÊÙ (ID = 0)
10:57 AM:   HKU\S-1-5-21-1177238915-1390067357-839522115-1109\Software\Webroot\SpySweeper\IEH || ™šŸœŸ“˜Ÿ’÷øÄÍßÜÊÙÎ÷æÂÈÙÄØÄÍß÷âÅßÎÙÅÎß‹îÓÛÇÄÙÎÙ÷æÊÂÅçÄÈÊÇ‹ûÊÌÎ (ID = 0)
10:57 AM:   HKU\S-1-5-21-1177238915-1390067357-839522115-1109\Software\Webroot\SpySweeper\IEH || ™šŸœŸ“˜Ÿ’÷øÄÍßÜÊÙÎ÷æÂÈÙÄØÄÍß÷âÅßÎÙÅÎß‹îÓÛÇÄÙÎÙ÷øÎÊÙÈÃþùç (ID = 0)
10:57 AM:   HKLM\SOFTWARE\Webroot\SpySweeper\IEH || ™šŸœŸ“˜ž›÷øÄÍßÜÊÙÎ÷æÂÈÙÄØÄÍß÷âÅßÎÙÅÎß‹îÓÛÇÄÙÎÙ÷øÎÊÙÈÃèÞØßÄÆÂÑÎøÎÊÙÈÃ (ID = 0)
10:57 AM:   HKLM\SOFTWARE\Webroot\SpySweeper\IEH || ™šŸœŸ“˜ž›÷øÄÍßÜÊÙÎ÷æÂÈÙÄØÄÍß÷âÅßÎÙÅÎß‹îÓÛÇÄÙÎÙ÷øÎÊÙÈÃøÎÊÙÈÃêØØÂØßÊÅß (ID = 0)
10:57 AM:   HKLM\SOFTWARE\Webroot\SpySweeper\IEH || ™šŸœŸ“˜ž›÷øÄÍßÜÊÙÎ÷æÂÈÙÄØÄÍß÷âÅßÎÙÅÎß‹îÓÛÇÄÙÎÙ÷æÊÂÅøÎÊÙÈÃ‹éÊÙ (ID = 0)
10:57 AM:   HKLM\SOFTWARE\Webroot\SpySweeper\IEH || ™šŸœŸ“˜ž›÷øÄÍßÜÊÙÎ÷æÂÈÙÄØÄÍß÷âÅßÎÙÅÎß‹îÓÛÇÄÙÎÙ÷æÊÂÅøßÊÙß‹ûÊÌÎ (ID = 0)
10:57 AM:   HKLM\SOFTWARE\Webroot\SpySweeper\IEH || ™šŸœŸ“˜ž›÷øÄÍßÜÊÙÎ÷æÂÈÙÄØÄÍß÷âÅßÎÙÅÎß‹îÓÛÇÄÙÎÙ÷æÊÂÅ (ID = 0)
10:57 AM:   HKLM\SOFTWARE\Webroot\SpySweeper\IEH || ™šŸœŸ“˜ž›÷øÄÍßÜÊÙÎ÷æÂÈÙÄØÄÍß÷âÅßÎÙÅÎß‹îÓÛÇÄÙÎÙ÷æÊÂÅøÎÊÙÈÃ‹ûÊÌÎ (ID = 0)
10:57 AM:   HKLM\SOFTWARE\Webroot\SpySweeper\IEH || ™šŸœŸ“˜ž›÷øÄÍßÜÊÙÎ÷æÂÈÙÄØÄÍß÷âÅßÎÙÅÎß‹îÓÛÇÄÙÎÙ÷æÊÂÅçÄÈÊÇ‹ûÊÌÎ (ID = 0)
10:57 AM:   HKLM\SOFTWARE\Webroot\SpySweeper\IEH || ™šŸœŸ“˜ž›÷øÄÍßÜÊÙÎ÷æÂÈÙÄØÄÍß÷âÅßÎÙÅÎß‹îÓÛÇÄÙÎÙ÷æÊÂÅïÎÍÊÞÇßôøÎÊÙÈÃôþùç (ID = 0)
10:57 AM:   HKLM\SOFTWARE\Webroot\SpySweeper\IEH || ™šŸœŸ“˜ž›÷øÄÍßÜÊÙÎ÷æÂÈÙÄØÄÍß÷âÅßÎÙÅÎß‹îÓÛÇÄÙÎÙ÷æÊÂÅïÎÍÊÞÇßôûÊÌÎôþùç (ID = 0)

LLRodd · Answer

F-Secure Blacklight scan indicates,   Scan Complete No Hidden Items Found   Is Spy Sweeper showing a false positive?   Thanks

LLRodd · Answer

F-Secure Blacklight Scan Log for above

09/08/08 10:26:20 [Info]: BlackLight Engine 1.0.70 initialized
09/08/08 10:26:20 [Info]: OS: 5.1 build 2600 (Service Pack 2)
09/08/08 10:26:20 [Note]: 7019 4
09/08/08 10:26:20 [Note]: 7005 0
09/08/08 10:26:26 [Note]: 7006 0
09/08/08 10:26:26 [Note]: 7011 2996
09/08/08 10:26:26 [Note]: 7035 0
09/08/08 10:26:27 [Note]: 7026 0
09/08/08 10:26:27 [Note]: 7026 0
09/08/08 10:26:31 [Note]: FSRAW library version 1.7.1024
09/08/08 10:31:35 [Note]: 2000 1012
09/08/08 10:58:07 [Note]: 7007 0

2nd log ( I started up F-secure, but closed the program)

09/08/08 11:08:21 [Info]: BlackLight Engine 1.0.70 initialized
09/08/08 11:08:21 [Info]: OS: 5.1 build 2600 (Service Pack 2)
09/08/08 11:08:21 [Note]: 7019 4
09/08/08 11:08:21 [Note]: 7005 0
09/08/08 11:08:21 [Error]: 6027 5
09/08/08 11:08:22 [Error]: 6002 0
09/08/08 11:08:28 [Note]: 7007 0

Thanks,

Virus & Spyware

Was this post helpful?