I used spybot 1.2 then 1.3 and got the following. I am not sure of some of them, if these should be fixed?... 1) What is the wurldmedia stuff related to? 2) Ezula? With Spybit 1.2 Alexa Related: What's related link (Replace file, nothing done) C:\WINNT\Web\related.htm Avenue A, Inc.: Tracking cookie or cookie of tracking site (File, nothing done) C:\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt BDHelper: Interface (Registry key, nothing done) no description HKEY_CLASSES_ROOT\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000} BDHelper: Typelib (Registry key, nothing done) no description HKEY_CLASSES_ROOT\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000} DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-21-572454927-1110412475-1538417202-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004=W=3 eZula HotText: Typelib ( (AolHook 1.0 Type Library)) (Registry key, nothing done) HKEY_CLASSES_ROOT\Typelib\{DC79C5BB-FF78-4A45-B12E-0D53889CE824} Threat: adware MS Works: Autorun settings (Registry value, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Works Update Detection MS Works: Program file (File, nothing done) C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe WurldMedia: Browser helper object (Registry key, nothing done) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{12D02C08-218F-4A11-BDE1-6611ADB7B81F} Threat: not mentioned WurldMedia: Class (Registry key, nothing done) HKEY_CLASSES_ROOT\CLSID\{12D02C08-218F-4A11-BDE1-6611ADB7B81F} Threat: not mentioned With spybot 1.3 Avenue A, Inc.: Tracking cookie (Internet Explorer: Owner) (Cookie, nothing done) Alexa Related: What's related link (Replace file, nothing done) C:\WINNT\Web\related.htm BDHelper: Typelib (Registry key, nothing done) HKEY_CLASSES_ROOT\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000} BDHelper: Interface (Registry key, nothing done) HKEY_CLASSES_ROOT\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000} DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-21-572454927-1110412475-1538417202-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3 WurldMedia: Interface (IIEHlprObj) (Registry key, nothing done) HKEY_LOCAL_MACHINE\Software\Classes\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000} WurldMedia: Browser helper object (Registry key, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{12D02C08-218F-4A11-BDE1-6611ADB7B81F} WurldMedia: Class ID (Registry key, nothing done) HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{12D02C08-218F-4A11-BDE1-6611ADB7B81F}

Hi JeffinSC: Spybot only finds spyware and adware related items. The items in red are spyware/adware, the items in green are usage tracks. If spybot finds anything in red, delete it. It's up to you if you want to delete the usage tracks. It's the same thing with ad-aware. Anything ad-aware finds is safe to delete. I'd also suggest using spywareblaster, a good up-to-date antivirus and a firewall.

What rhiannon said above it true. Anything in red, kill it. AvenueA, Doubleclick, Fastclick, etc. are all tracking cookies, which means that they send info back to a marketing dept. on your browsing habits. So you help them make money for free. Nice. You have DSO exploit; bear in mind that Spybot will kill it, but due to a flaw in programming their name will still show up every time you scan. Be assured they are gone, however. You can go in and change the individual register settings if you wish, but don not do it if you have never worked with the register before. Alexa comes with Internet Explorer (yes, even M$oft want to get in on the action to make MORE money) so just let Spybot kill it.

so what is the wurldmedia stuff and where does it come from. spybot did not specify the type of threat.

so what is the wurldmedia stuff and where does it come from? According to THIS LINK WurldMedia description: An IE browser helper object that detects visits to known sites and redirects them through a third-party server in order to generate affiliate fees. i_XpUser

after reading the spybot forums at net-integration, it seems the DSO exploits are false positives (false alarms). Removing that alarm will be included in the next release. If your system has the latest MS security maintenance, DSO may be ignored.

How do I know if I have loaded these unkowingly as part of an application that I want to keep?