Spybot S&D > MySoft result

[binay]

Guys, I don't think Mysoft is a spyware or worm. The reason Spyware can't delete it comes from the possibility of the host file being read-only or locked by Spybot or maybe you are running some kind of host file maintaining software or maybe you got your host file from somewhere.

I got my host file from http://someonewhocares.org/hosts and I have locked it from Spybot so it's read-only. It has an entry that is like

127.0.0.1 sitefinder.Verisign.com # Verisign has joined the game
127.0.0.1 sitefinder-idn.Verisign.com # of trying to hijack mistyped
# URLs to their site.

so what it is trying to do is block the site sitefinder.Verisign.com by pointing the site to the local computer i.e. your computer (127.0.0.1) and since it won't find the page sitefinder.Verisign.com in your computer, it will show an invalid page. You should try it in your browser and see what comes up.

At first, I thought the same as you people until I checked where spybot pointed it and as it is in the host file, it is simply blocking it.

I believe spybot finds it because the word "Verisign" is in the entry.

That's my opinion and I strongly believe it.

[bazcook]

Like I mentioned previously, there have been other reported sitings of this problem at the Maxthon site, so one suspects a little untidiness within it causing a Spybot false positive. Having said that, it isn't being reported by everyone, so something has gone wacky...

The Spybot find does indeed refer to sitefinder.verisign.com and its inability to fix the problem. And like you Binay, I had previously incorporated someonewhocares hosts file into my own, so that re-route is blocked. My concern was that I was finding info via a google that linked mysoft to the W32.Zori.B virus. If this is indeed the case, then my concern was not so much the re-direct (as blocked above) but rather the fact that the virus' intent was to begin to delete files on its own.

But with SpywareBlaster running and a series of scans by AVG, Ad-Aware, a squared and now, MS AntiSpyware - and they all finding no reference to mysoft or the virus - one is hopeful that it is simply a little bit of sloppiness in Maxthon and that Spybot is recording the false positive.

Though I guess I'll find out by mid-week next week as 9 days will have passed since mysoft was reported and the virus is meant to kick in deleting stuff....

[spacelunatic]

I too got the spybot message about MySoft, did a Google and top hit was maxthon. I have Maxthon, so I'm adding this post to help confirm the theory.
Thanks!

[WrinklyTech]

Greetings from the UK - I'm the 'newbie!'

I also have just run an SBSD scan which shows 'MySoft' as: ' redirected host desktop.kazaa.com'

Never seen this before - nothing in registry - Adaware shows nothing - MS AntiSpyware shows nothing

I am running WinPatrol (hosts file locked)- this shows nothing - nothing in HJT or task manager!

iamnotageek.com identifies it as a homepage hijacker - but my homepage has not been hijacked!!

My 'hatches' are well and truly 'battoned' also courtesy of Steve Gibson so....

What on earth is going on?? Damn annoying all this time spent trying to track down what could quite possibly be a FP from SpyBot. Seems to me the Internet needs a jolly good spring clean - but....where to start?...and how?...any volunteers?!

Would appreciate any thoughts on this! Enough to drive you to

[WrinklyTech]

By the way...forgot to mention I use Firefox and (very rarely) IE, not Maxathon

[Jare37]

Although mysoft can come as part of a trojan and all sort of other illegitimate ways it doesn't always. Every spyware removal company has different rules for what they consider to be spyware and of course they mess up once in a while. What spybot detects is actually an array of programs under the title mysoft that usually appear as a taskbar in ie. The reason a lot of programs don't detect it is that the program general requests your permission to install. It usually comes as a trick though, as in if you recently installed the new msn plus update (and the timing would be right) if you read the whole disclaimer they told you they were going to install some stuff you really didn't want. Provided you have the non viral version mysoft is harmless it can be removed but because it mods the host file it's not so easy to do you have to replace the host file or find an actual removal tool. The proper way to get rid of it is to uninstall the program it rode in on if you can find it.

Hope that helps someone .... Cheers

[hydroman]

after checking the mysoft homepage i figure this software is most likely used for search spyware. After running spybot and getting the alert I moved the directory, rebooted, and ran spybot again. I recieved no more allerts. I did get a warning message that some software may not work anymore so i am waiting to see what programs use it.

[houseisland]

I have recently added Ewido to my anti-spyware arsenal.

http://www.ewido.net/en/

It is free. The TSR perventative component of it, reputed to be quite good, is a 30 day demo, though. The scanner component continues to be free.

The TSR component seems to add quite a burden to older systems.

The scanner is slow, very slow, and thorough -- removes quite a broad range of spyware, malware, trojans, etc.

Nothing is perfect, though. Keep using all the other stuff as well.

[Reddragon]

I use Spyremover and XP, MySoft rides in on all updates of all spyware removal
software,Today I reloaded a older version of the product and there sitting was 6
registry exploits from Microsoft which was quickly deleted,I even re booted my router
to try and remove this item it is,was only showing redirected files from 127.0.0.1
Having tried and paid for Maxthon and written back to disk Maxthon 1.24 edition
i do not think this MySoft infection has anything to do with them I think its the Microsoft Malicious Software Tool

[Reddragon]

The Problem TOTAL is Spybot that is included in spyremover it just pings the system
and gets the wrong results,removed 2 of the latest XPs files put a old version of spyremover on ....great everthing worked well,updated it and yes it was back,deleted it cleaned the disk, put the old version back on and its gone so the awnser is dont update your spyware removal software and stay away from spybot and adware