SuperAntiSpyware Scan

13 years ago

Hi Folks,

Currently I have a Dell Dimension 4700 DT with 2 gig of RAM running Win XP Home edition. Last evening, I ran an Avast scan and a Malwarebytes scan. All came out clean. I typically leave my computer up 7/24 and reboot every 4 or 5 days. Overnight, I discovered this morning, that a number of people had joined my Linkedin account without my inviting them. One notice I received of someone who did not join was from an old Meleuca account I had not used in several years.

So, apparently, these invitations were sent automatically without my positively knowing the source of the addresses. Plus my printer started to run this morning by itself. When I put paper in it processed the paper and wanted more. After two blank sheets, I quit.

So, I ran a SuperAntiSpywear scan and here's the results:

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 04/07/2011 at 11:38 AM

Application Version : 4.50.1002

Core Rules Database Version : 6723

Trace Rules Database Version: 4535

Scan type : Quick Scan

Total Scan Time : 00:22:50

Memory items scanned : 427

Memory threats detected : 0

Registry items scanned : 2740

Registry threats detected : 7

File items scanned : 17116

File threats detected : 12

MyWay Search Assistant Computers

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(4D25F921-B9FE-4682-BF72-8AB8210D6D75)

HKCR\CLSID\(4D25F921-B9FE-4682-BF72-8AB8210D6D75)

HKCR\CLSID\(4D25F921-B9FE-4682-BF72-8AB8210D6D75)

HKCR\CLSID\(4D25F921-B9FE-4682-BF72-8AB8210D6D75)\InprocServer32

HKCR\CLSID\(4D25F921-B9FE-4682-BF72-8AB8210D6D75)\InprocServer32#ThreadingModel

HKCR\CLSID\(4D25F921-B9FE-4682-BF72-8AB8210D6D75)\Programmable

C:\PROGRAM FILES\MYWAYSA\SRCHASDE\1.BIN\DESRCAS.DLL

HKU\S-1-5-21-2567871069-2602521732-2068354608-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\(4D25F921-B9FE-4682-BF72-8AB8210D6D75)

Adware.Tracking Cookie

secure-us.imrworldwide.com [ C:\Documents and Settings\Jennifer\Application Data\Macromedia\Flash Player\#SharedObjects\V72YPDM9 ]

.clickbank.net [ C:\Documents and Settings\Jennifer\Application Data\Mozilla\Firefox\Profiles\aksyo1fh.default\cookies.sqlite ]

.ssl.clickbank.net [ C:\Documents and Settings\Jennifer\Application Data\Mozilla\Firefox\Profiles\aksyo1fh.default\cookies.sqlite ]

.ssl.clickbank.net [ C:\Documents and Settings\Jennifer\Application Data\Mozilla\Firefox\Profiles\aksyo1fh.default\cookies.sqlite ]

.ssl.clickbank.net [ C:\Documents and Settings\Jennifer\Application Data\Mozilla\Firefox\Profiles\aksyo1fh.default\cookies.sqlite ]

.ssl.clickbank.net [ C:\Documents and Settings\Jennifer\Application Data\Mozilla\Firefox\Profiles\aksyo1fh.default\cookies.sqlite ]

.freetrafficbar.com [ C:\Documents and Settings\Jennifer\Application Data\Mozilla\Firefox\Profiles\aksyo1fh.default\cookies.sqlite ]

.freetrafficbar.com [ C:\Documents and Settings\Jennifer\Application Data\Mozilla\Firefox\Profiles\aksyo1fh.default\cookies.sqlite ]

.clickbank.com [ C:\Documents and Settings\Jennifer\Application Data\Mozilla\Firefox\Profiles\aksyo1fh.default\cookies.sqlite ]

www.clickbank.com [ C:\Documents and Settings\Jennifer\Application Data\Mozilla\Firefox\Profiles\aksyo1fh.default\cookies.sqlite ]

.clickbank.com [ C:\Documents and Settings\Jennifer\Application Data\Mozilla\Firefox\Profiles\aksyo1fh.default\cookies.sqlite ]

So, can someone explain to me what this means.

Thanks,

Tom

Sort by:Oldest

Comments (3)

zep516
13 years ago
last modified: 9 years ago
1)MyWay Search Assistant for Dell Computers.
This CLSID or Class id--> 4D25F921-B9FE-4682-BF72-8AB8210D6D75 tells us it's Myway search Assistant for Dell Computers.

First, no big deal on that scan, The My way search assistant comes preinstalled on some Dells. Super AntiSpyware removed it cause it's classified as adware!

"Adware applications, toolbars and browser extensions may serve advertisements even while you are not surfing the Internet."

This application may serve various types of advertising, not limited to pop-up ads.

This stuff below is all the things that Myway Search Assistant installs,

First it installs the process
Process
DESRCAS.DLL

This is the file path and location of the process:
C:\PROGRAM FILES\MYWAYSA\SRCHASDE\1.BIN\DESRCAS.DLL
And these are the registry entries that are made by Myway Search Assistant. Clsid or Class ID.

HKCR\CLSID\(4D25F921-B9FE-4682-BF72-8AB8210D6D75)
HKCR\CLSID\(4D25F921-B9FE-4682-BF72-8AB8210D6D75)
HKCR\CLSID\(4D25F921-B9FE-4682-BF72-8AB8210D6D75)\InprocServer32
HKCR\CLSID\(4D25F921-B9FE-4682-BF72-8AB8210D6D75)\InprocServer32#ThreadingModel
HKCR\CLSID\(4D25F921-B9FE-4682-BF72-8AB8210D6D75)\Programmable
C:\PROGRAM FILES\MYWAYSA\SRCHASDE\1.BIN\DESRCAS.DLL
HKU\S-1-5-21-2567871069-2602521732-2068354608-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\(4D25F921-B9FE-4682-BF72-8AB8210D6D75)

HKCR OR H_Key_Class_Root key. That's the registry key that the CLSID or class Id installed to. All removed now!

Then
adware tracking cookie

Those are a fact of life on the internet get them from everywhere. They also have all been removed.

This scan has nothing to do with the problem you describe!
samtom_gw
Original Author
13 years ago
last modified: 9 years ago
Zep, thanks for the information. So, I'm back to the problem
I initially described.

What could be causing these odd behaviors if there are no known viruses or other malware?
Related Discussions
computer is dialing up to the ISP by itself
Q
Comments (26)
Win32:Refroso, I don't like the looks of this and my abilities end here. It could be a false positive. But with the symptoms you have and some of the information I have found would feel much better if you go to a malware removal forum for more thorough scans and mostly an expert opinion. At this time I am going to supply a link where we send folks for Malware issues. Please follow the instructions at the link provided and post the required logs, it's important you post the logs. You will need to register and create an account there here is link, Please link back to here too so they know I sent you. Let us know what the outcome is.
...See More
trojan system 32
Q
Comments (6)
I now have a related problem. He downloaded the 15 day trial of SuperAntiSpware. I'm sure they will ask HIM for money. He doesn't have credit card & I'm not about to give him my number. What I need to know is after he finish scanning can he delete it & get the totally free one.. I know sometimes bits & pieces are left so U can't get it to work if U install it again. Can I download it.. PAY for it & send it to him as an attachment. Do U think it will install OK if I do that. We have done that before with other programs but not for something already on the computer. I also don't want to mess mine up but my thinking is if I don't run it I'll be OK. Sorry to be such a bother. You & others there have been a lifesaver to us. Dar
...See More
Backing up to a hard drive (when you've had computer infections)
Q
Comments (11)
Dee can - Please DO NOT trigger a Format. It deletes everything on the drive (including Windows). If you reformat your PC's hard drive, it'll be useless to you and won't start again until a new operating system installation is done. It shouldn't be something you need to do. raven - I disagree with your suggestion about the advisability of having a HDD image. Use of same would seem to be well beyond the ability of most people who visit this forum. To avoid problems and inconvenience, my first suggestion is that everything important should be backed up and, correspondingly, unimportant files needn't be backed up. Many users have nothing but unimportant files. A simple emailer and web surfer likely has nothing that needs to be backed up. My second suggestion is to avoid problems by using proper tools and practices. (Many of the tools and practices I've seen recommended in various threads in this forum I don't agree with) My third suggestion - if a problem is encountered that the user doesn't know how to deal with, find a service provider or someone knowledgeable to help you. For "seasoned citizens", younger family members may be useful for this. Write down on a piece of paper (yes, a piece of paper) the programs you use and the obscure websites you like and have bookmarked. Other than important data files (photos, music, correspondence), EVERYTHING ELSE on your PC can be reinstalled, re-downloaded, and otherwise replaced. If your PC is old, struggling, or otherwise deserving of a proper burial, buy a new one. They're cheaper than ever, and old your old PC may not be worth the cost or effort to resuscitate. Good luck to all. With a first rate antivirus program, all that's left for you to do is to know where you go and know what you open. With that and absent being very unlucky, you won't have any problems.
...See More
RegCure Locked up in scan mode
Q
Comments (10)
Thanks, here's some updates done last night and this morning. But first, owbist, what is "WOT"... I'm an old guy and don't read some of the "text messaging" shorthand, or I'm an old guy and just forgot what I used to know WOT to mean. Yes, I'm running 64 bit. I think I will uninstall RegCure. After posting last night I did the necessary back up to an off line HDD, then I tried a restore. While setting that up it was shown that MS had done an update at 10:40 PM, during the time RegCure was scanning - related? Could be. I have changed Windows Update from Automatic to ask for my approval. In any event the restore to last MS Update failed, some program was not available (or busy, forget what the detail was) so I ran a normal shut down and went to bed. This morning the system booted what looked to be normal, so I tried again to do a restore so I could record what the restore change was, it was: Windows Defender Defs KB915597, still only a possible cause, no proof other than time. While in the restore setup I asked for a "scan for affected programs" none were detected. I went forward with the restore and it came up with a driver: TI105238WOE (or 0E) (C:) System. This time the restore completed successfully, DON'T ASK, just be happy. I then went back to update and had the Defender Defs (re)installed. All seems to be fine as I do this typing. I do run Advanced System Care every few days and it does some type of Registry Check, maybe that's enough checking of the Registry. I do think, however, the problem was the running of a windows update (hence Registry changes) at the same time that RegCure was scanning.
...See More
zep516
13 years ago
last modified: 9 years ago
You're welcome! I can't answer the question on the other problem though. The printer issue sounds coincidental though. Disconnect it and the reboot the machine then-Re connect the printer and at least see if the printer problem goes away.

SuperAntiSpyware Scan

Comments (3)

zep516

samtom_gw
Original Author

Related Discussions

zep516

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

SuperAntiSpyware Scan

Comments (3)

zep516

samtom_gwOriginal Author

Related Discussions

zep516

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

samtom_gw
Original Author