• Home
• Blog
• Downloads
• Info
• Reviews
• Virus Warnings
• Search Site

I ran a scan of a Windows XP Service Pack 2 system with an up-to-date version of Verizon Internet Security Suite on 2010-10-03. The software, which states it is "Powered by McAfee" reported the following:

During the full scan, McAfee detected one item that requires your attention. View the scan details to fix this issue now.

Results
Items Scanned: 324912
Items Detected: 88
Items Fixed: 87
Items Remaining: 1

Potentially Unwanted Programs Adware-Url.gen

Files Affected
C:\Program Files\Free Offers from Freeze.com\afactory.url
C:\Program Files\Free Offers from Freeze.com\bingocafe.url
C:\Program Files\Free Offers from Freeze.com\gamepipe.url
C:\Program Files\Free Offers from Freeze.com\gifart.url
C:\Program Files\Free Offers from Freeze.com\graflatscreen.url
C:\Program Files\Free Offers from Freeze.com\pcpowerscan.url
C:\Program Files\Free Offers from Freeze.com\spcasino_sep.url

I chose to have Verizon Internet Security Suite quarantine the files. When I checked on what else it had found, I found it reporting it had quarantined an instance of Spy-Agent.bw!zip, which it found in a file, bill.zip, that it found at C:\Documents and Settings\Jeanne\My Documents\Email\Embedded\bill.zip, i.e., it appeared to have quarantined an attachment to an email message. There was no indication that the file had actually led to any infection of the system, just that a zip file containing the malware had been detected. The webpage for that malware contained a link to a McAfee webpage Spy-Agent.bw, which indicated McAfee first discovered that malware on August 20, 2007.

The scan also found a lot of cookies wich the antivirus program deleted, but I consider those fairly innocuous.

[/security/scans] permanent link

When I logged into the ThelmaLou system as the administrator to check it today, I saw the following error message:

When I clicked on OK, I then saw the following:

When I clicked on "click here", I saw the following error signature information:

AppName: hkcmd.exe	 AppVer: 3.0.0.1607	 ModName: oleaut32.dll
ModVer: 5.1.2600.3266	 Offset: 000344f1 

The file C:\DOCUME~1\ADMINI~1.MAY\LOCALS~1\Temp\c0f3_appcompat.txt was associated with the error report.

I checked the system with Bazooka Adware and Spyware Scanner, even though it's malware definitions haven't been updated in almost a year; they are 340 days old now. It didn't find any malware.

I then checked the system with Spybot Search & Destroy. It reported Microsoft.WindowsSecurityCenter_disabled. with registry entry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start (is not)W=2, but nothing else, aside from 2 cookies. I eliminated the two cookies, one for DoubleClick and one for ValueClick.

[/security/scans] permanent link