Spybot S&D > MySoft result

Hey there,

Updated my Spybot today and at the end of scan it said it found something called MySoft. It tried to remove it, but said it could not remove it all and would try at next boot. This, if we believe Spybot, failed too.

Curious, I did a search online for MySoft and was directed to something called W32.Zori.B

Symantec (for example) has some info about this - dated April 4 at -

http://securityresponse.symantec.com...32.zori.b.html

Made sure I had the most recent definitions to Ad-Aware, AVG 7 and a-squared and ran them - they found no reference to either MySoft or W32.Zori.B, while neither Symantec nor Grisoft (AVG) have individual removal tools for this listed.

Then I went into Safe Mode and checked the Registry at the points noted by the Symantec info and found nothing.

So....has anyone else had this show up and have they found it lurking in their computer? And, if so, where? Or is this a false positive? This has only come up in Spybot since the update today.

Hmmmm...

Assuming your running XP make sure system restore is disabled when you run your AV.
ctrl+alt+del and see what's running in taskmanager. See if you can stop the process there, then run your AV again.
Download and run HiJackThis here: http://www.spywareinfo.com/~merijn/downloads.html
check what is under the 04 entries. There will be reg entries that are recreating the virus.

Spybots been a bit of a let down for a while now in anti spyware try downloading the ms anti spyware progy and running that

Adaware also seems to fair better than spybot to get rid of those unwanted pesky annoyances.

http://www.lavasoftusa.com
Ad Aware

http://www.microsoft.com/athome/secu...e/default.mspx
MS Anti Spy

AVG Free does not stop viruses from invading, it seems to only tell you after infection and I have found it not to be able to delete, quarantine or acces many viruses.

Go somewhere like http://housecall.trendmicro.com and do an online full scan, both spyware and virus to see just what has invaded your sys and hopefully clean it off.

Quote:

---

Originally Posted by shamus

Assuming your running XP make sure system restore is disabled when you run your AV.
ctrl+alt+del and see what's running in taskmanager. See if you can stop the process there, then run your AV again.
Download and run HiJackThis......
check what is under the 04 entries. There will be reg entries that are recreating the virus.

---

Sorry, I should have mentioned that after ensuring I had the most recent reference files to the mentioned scanners, I turned off System Restore, deleted my Prefetch and *then* went to safe Mode to do the scans and check regedit. As noted, nothing found by anything.

My AVG had a Priority Update today (11 April) which I installed, again turned off System Restore and went into Safe Mode - same result.

Spybot syill shows MySoft as a problem, with a + mark opening up the note -

Redirected Host
sitefinder.verisign.com =127.0.0.1

I'll take some time and see what HiJackThis has to say and maybe do an online scan, too - just to see what comes of that.

I am usually very circumspect about what comes into my machine and rarely open (even expected) attachments - and never without an AV scan first, but if its new I guess the various programs may not have caught up yet. Still, like I say, at least in a cursory glance, it's markers don't seem to be there.

Hmmm.

http://www.tasklist.org/task_winexplor_exe_5334.html
This site lists it as a Homepage Hijacker.

Are you sure youve run all three free spyware cleaners?

Also try Panda Online Scan: http://www.pandasoftware.com/activescan

I've got my homepage locked, so I've not seen a try there.

I got an updated reference file from Ad-Aware today and ran that - it doesn't see it. In fact, so far, only Spybot makes any reference to it at all. I've not got MS AntiSpyware at the moment, but I'm not entirely sure that additional software that may/may not be able see it (but not remove it) is of any real value.

Trend Micro's online scan found zip, too.

I guess I'll go with HiJackThis and see what it says. Can't help wondering if this is a false positive....

And unless I'm incredibly dense (no comments please) I don't think I'm seeing anything that surprises me here. Not dead keen about the references to Messenger, but I believe I've turned that off via Steve Gibson's software...

Logfile of HijackThis v1.99.1
Scan saved at 10:45:49 AM, on 11/04/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\KlipFolio\KlipFolio.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\D-Link AirPlus Xtreme G\AirPlus.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Grisoft\AVG Free\avgcc.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Documents and Settings\Barry\Desktop\HijackThis v1.99.1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lite.rogers.yahoo.com/p/1.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Barry's IE6
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = 127.0.0.1
O1 - Hosts: 193.86.103.19 guru.grisoft.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {BBE59AF5-EE22-4A3A-AB26-3F774D1B4216} - C:\PROGRA~1\FOLDER~1\FOLDER~1.DLL
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [KlipFolio] "C:\Program Files\KlipFolio\KlipFolio.exe" /BOOT
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunOnce: [MRUBlaster] C:\Program Files\MRU-Blaster\indexcleaner.exe -CACHE
O4 - HKCU\..\Run: [TClockEx] C:\Program Files\TClockEx\TCLOCKEX.EXE
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: D-Link AirPlus Xtreme G Configuration Utility.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &WordWeb... - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: Send to Sunrise - C:\Program Files\Sunrise\sts\sts.html
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?link...38&clcid=0x409
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

So, thoughts and ideas? Thanks!

Nothing jumps out at me either. On the Symantec page you posted it does mention uninstalling and reinstalling NAV.Have you tried that? Seeing how this thing attaches itself to exe files that would make sense. The fact that it starts deleting files 9 days after infection would worry me...

Yeah, I'm not dead keen on that possibility, either.

I don't actually run Symantec - that's just one of the obvious places a Google offered me. I use AVG. For what it's worth, I've posted to their Forum and am waiting a response.

I don't know whether uninstalling / reinstalling AVG would have the same effect. I don't get that connection at any rate. OK, I am dense....

Again, I haven't experienced the bmp image nor any of the registry changes that the Symantec noted, so... strange, n'est pas?

Very. If you have a cd burner there's a great download @ http://nyquil-kid.dyndns.org/ you can boot from the cd and it will search for viruses. Another thought would be to try Stinger from McAfee - http://vil.nai.com/vil/stinger/

I'll give a thought to nyquil should nothing else pan out - while I note the Stinger webpage dates it to the beginning of March - about a month behind the variant's date according to the Symantec info - and no note of it in the included list.

Rats!

Rats is right. You could give this a shot -http://www.microsoft.com/security/ma...e/default.mspx

Double rats!

Downloaded, run and - no malicious software was found.....

ooookay. Give this a shot -http://www.microsoft.com/downloads/d...displaylang=en

update the definitions then run it.

Downloaded but haven't done anything about it yet.

Meanwhile, a bit of a surprise from elsewhere - I happened to post a query on the Maxthon browser forum about this (I had just updated that this weekend too and just *wondered*) and, as it happens, there are others - and it happened to some on an earlier version of Maxthon last month, using TrojanHunter as their spyware scanner.

Seems TrojanHunter blamed something in Maxthon, while the recent one is less-specific but as reported by Spybot only.

So, could be false positives after all - and some tidying up needed in Maxthon. One can hope.

http://forum.maxthon.com/forum/index...st=0&p=122760&

I won't simply rely on these reports but will keep myself open to other potential sources, but it is moderately comforting to note others are suffering too and we may know the (benign) source.

Schadenfreude modified.

Guys, I don't think Mysoft is a spyware or worm. The reason Spyware can't delete it comes from the possibility of the host file being read-only or locked by Spybot or maybe you are running some kind of host file maintaining software or maybe you got your host file from somewhere.

I got my host file from http://someonewhocares.org/hosts and I have locked it from Spybot so it's read-only. It has an entry that is like

127.0.0.1 sitefinder.Verisign.com # Verisign has joined the game
127.0.0.1 sitefinder-idn.Verisign.com # of trying to hijack mistyped
# URLs to their site.

so what it is trying to do is block the site sitefinder.Verisign.com by pointing the site to the local computer i.e. your computer (127.0.0.1) and since it won't find the page sitefinder.Verisign.com in your computer, it will show an invalid page. You should try it in your browser and see what comes up.

At first, I thought the same as you people until I checked where spybot pointed it and as it is in the host file, it is simply blocking it.

I believe spybot finds it because the word "Verisign" is in the entry.

That's my opinion and I strongly believe it.

Like I mentioned previously, there have been other reported sitings of this problem at the Maxthon site, so one suspects a little untidiness within it causing a Spybot false positive. Having said that, it isn't being reported by everyone, so something has gone wacky...

The Spybot find does indeed refer to sitefinder.verisign.com and its inability to fix the problem. And like you Binay, I had previously incorporated someonewhocares hosts file into my own, so that re-route is blocked. My concern was that I was finding info via a google that linked mysoft to the W32.Zori.B virus. If this is indeed the case, then my concern was not so much the re-direct (as blocked above) but rather the fact that the virus' intent was to begin to delete files on its own.

But with SpywareBlaster running and a series of scans by AVG, Ad-Aware, a squared and now, MS AntiSpyware - and they all finding no reference to mysoft or the virus - one is hopeful that it is simply a little bit of sloppiness in Maxthon and that Spybot is recording the false positive.

Though I guess I'll find out by mid-week next week as 9 days will have passed since mysoft was reported and the virus is meant to kick in deleting stuff....

I too got the spybot message about MySoft, did a Google and top hit was maxthon. I have Maxthon, so I'm adding this post to help confirm the theory.
Thanks! :thumbs:

Greetings from the UK - I'm the 'newbie!' :heart:

I also have just run an SBSD scan which shows 'MySoft' as: ' redirected host desktop.kazaa.com'

Never seen this before - nothing in registry - Adaware shows nothing - MS AntiSpyware shows nothing

I am running WinPatrol (hosts file locked)- this shows nothing - nothing in HJT or task manager!

iamnotageek.com identifies it as a homepage hijacker - but my homepage has not been hijacked!!

My 'hatches' are well and truly 'battoned' also courtesy of Steve Gibson so.... :confused:

What on earth is going on?? Damn annoying all this time spent trying to track down what could quite possibly be a FP from SpyBot. Seems to me the Internet needs a jolly good spring clean - but....where to start?...and how?...any volunteers?! :eek2:

Would appreciate any thoughts on this! Enough to drive you to :drink:

By the way...forgot to mention I use Firefox and (very rarely) IE, not Maxathon :)

Although mysoft can come as part of a trojan and all sort of other illegitimate ways it doesn't always. Every spyware removal company has different rules for what they consider to be spyware and of course they mess up once in a while. What spybot detects is actually an array of programs under the title mysoft that usually appear as a taskbar in ie. The reason a lot of programs don't detect it is that the program general requests your permission to install. It usually comes as a trick though, as in if you recently installed the new msn plus update (and the timing would be right) if you read the whole disclaimer they told you they were going to install some stuff you really didn't want. Provided you have the non viral version mysoft is harmless it can be removed but because it mods the host file it's not so easy to do you have to replace the host file or find an actual removal tool. The proper way to get rid of it is to uninstall the program it rode in on if you can find it.

Hope that helps someone .... Cheers

after checking the mysoft homepage i figure this software is most likely used for search spyware. After running spybot and getting the alert I moved the directory, rebooted, and ran spybot again. I recieved no more allerts. I did get a warning message that some software may not work anymore so i am waiting to see what programs use it.

I have recently added Ewido to my anti-spyware arsenal.

http://www.ewido.net/en/

It is free. The TSR perventative component of it, reputed to be quite good, is a 30 day demo, though. The scanner component continues to be free.

The TSR component seems to add quite a burden to older systems.

The scanner is slow, very slow, and thorough -- removes quite a broad range of spyware, malware, trojans, etc.

Nothing is perfect, though. Keep using all the other stuff as well.

I use Spyremover and XP, MySoft rides in on all updates of all spyware removal
software,Today I reloaded a older version of the product and there sitting was 6
registry exploits from Microsoft which was quickly deleted,I even re booted my router
to try and remove this item it is,was only showing redirected files from 127.0.0.1
Having tried and paid for Maxthon and written back to disk Maxthon 1.24 edition
i do not think this MySoft infection has anything to do with them I think its the Microsoft Malicious Software Tool

The Problem TOTAL is Spybot that is included in spyremover it just pings the system
and gets the wrong results,removed 2 of the latest XPs files put a old version of spyremover on ....great everthing worked well,updated it and yes it was back,deleted it cleaned the disk, put the old version back on and its gone so the awnser is dont update your spyware removal software and stay away from spybot and adware