New HijackThis Entry Database to help users find malware

SpywareShooter

I am currently in the process of making a database full of HijackThis entries which general users like you can use to "decode" your own HijackThis logs. I know that to beginners the log looks like a bunch of jibberish. With this database, you will be able to search for an entry (or part of an entry) and it will tell you whether that entry is malicious, what it does or what it is part of, and the file name associated with the entry - the most important part.

Keep in mind that this is still under construction, and I am hoping to have it done by the end of August. Progress on it is moving much faster than I expected, and at this rate should be done in a few weeks.

You can view and search the database here:
http://spywareshooter.com/search/search.php

Or the quick URL:
http://spywareshooter.com/entrylist.html

I will be updating this daily, so if you don't see an entry listed check back in a few days and it may be there.

To people seeing me browse threads: If I browse your help request thread but do not respond it means that I am looking for new entries to add to the database. I understand that this is a busy time of year, and that some threads are going unanswered, but this is my main priority right now. Once it is completed users will be able to diagnose their own logs, and help requests will be answered much faster.

SpywareShooter

IMPORTANT!
It seems that the database cannot recognize the . character. When searching for a filename please replace any periods/dots with a blank space and you should find the file if it is located in the database.

If you have any questions about the database please email me at spywareshooter@yahoo.com

SpywareShooter

Today I launched the P2P Executable File Database, which contains a list of malicious executable files (.exe, .scr, .pif) which can be found on P2P (Peer to Peer) networks. Since P2P is a common source of many worms, this tool should be useful to any of you people who frequently use P2P. Right now I only have a few files listed, but as time goes on, more will be added. Once I get enough data collected I am going to put up a search feature for it like the one for HijackThis.

Note: With the release of this database, I am not promoting the illegal use of P2P networks.

This database can be viewed at http://spywareshooter.com/p2p/

shortking9886

Question: If I have found files on that list in my hijackthis log should I definitely check them and click fix? I am what you would call an amatuer and don't want to mess up my computer any more so I would like to double check. Thanks

SpywareShooter

After you enter the file and it brings you to the page with links with that file in its text, click the link to the page with the name of the entry. Look under the "Status" section, and it will say if it is malicious or not. If it is, then it is safe to remove/delete.

shortking9886

Alright, thanks, I'll let you know how it goes, what about the ones that aren't in your database? Is it safe to assume they're not the problem files?

shortking9886

Good news, I got rid of 2 things that were in the database as bad and you guys may or may not be miracle workers as I can now change my homepage whereas before I could not. Thanks a million!

SpywareShooter

If a file is not in the database it means that either nobody has posted a log containing that file in it, or I just have not had the time to add it yet. You shouldnt' assume that these are safe.

shortking9886

Alright, well your database found 2 problem files and everything appears to be shipshape so far so it looks like the problem was taken care of, thanks a lot

jagerbombmeister

Since I downloaded the Spyware Shooter program I am getting the following entries in my Spybot S&D reports. Spybot says it can't fix these problems since they are being used or running. Is this due to the Spyware Shooter Program or should I be seeking means to remove these entries. CW Shredder isn't finding anything.

CoolWWWSearch.Leftovers: Trusted Site (Registry change, fixing failed)
HKEY_USERS\S-1-5-21-1730351596-2489707599-712968197-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\greatplugin.com\*!=W=4

CoolWWWSearch.Mupdate: Trusted Site (Registry change, fixing failed)
HKEY_USERS\S-1-5-21-1730351596-2489707599-712968197-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\masspass.com\*!=W=4

CoolWWWSearch.Toolband: Trusted Site (Registry change, fixing failed)
HKEY_USERS\S-1-5-21-1730351596-2489707599-712968197-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\isprime.com\*!=W=4

SpywareShooter

Please read my article here: http://www.spywareshooter.com/spybot.html

jagerbombmeister

SpywareShooter wrote:

Please read my article here: http://www.spywareshooter.com/spybot.html

jagerbombmeister

Hey thanks for helping with that.
I have another question.
Crunchie just turned me on to ccleaner. If I scan for issues, are some of the registry items that it detects to repair related to your program in anyway? If so how can I go about using the program without taking out protections from your program?

SpywareShooter

Where are those registry entries located?

jagerbombmeister

I think I may be answering my own question now.
I removed Spyware Shooter, ran the ccleaner program till the registry was clean. Then I downloaded Spyware Shooter again checked for issues and it only came up with 2, labeled as Unused File Extensions.
They are both in HKCU\Software\Windows\Current Version\Explorer\FileExts\
.1 & .TMP.

complete

I think I have found code listed in my HJT log that I need to remove. But: #1 I am not 100% sure and #2. I don't know if just deleting the file will be good enough.