ad-aware

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by GEEKWANNAB, Jun 2, 2004.

  1. GEEKWANNAB

    GEEKWANNAB Private First Class

    I was trying to install ad-aware, but can't the wise installation wizard initialization window opens and then closes itself a few seconds later. I talked to chaslang and he suggested that I install and run CCLEANER. I'M ready to run that (CCLEANER) but i'm unsure of the selections that should be checked under the windows tab on the left side window of CCLEANER. Some of the selections under the windows tab are unchecked such as:

    autocomplete form history

    delete index.dat files

    advanced cache delete

    menu order cache

    window siz/location cache

    user assist history

    IIS log files

    can anyone tell me if I should leave these selections unchecked and ru CCLEANER OR should I check all or some of them and than run CCLEANER?

    I'm running win 95 with OSR2 a pentium 2, 233 MHZ, 64 RAM

    ALSO chaslang suggested I might have registry problem should I downlod and run REGISTRY MECHANIC?
     
    GEEKWANNAB, Jun 2, 2004
    #1
  2. Ciz

    Ciz Corporal

    well, I, personally, do not rank reg mechanic, not the bes user friendly program (loss of file extensions for those that "FIX ALL" (in my expirience)

    also
    (www.lavasoft.de)

    doesnt appear that win95 is compatible with ad-aware...
     
    Ciz, Jun 2, 2004
    #2
  3. GEEKWANNAB

    GEEKWANNAB Private First Class

    OK Thanks CIZ , that explains the install problem.
     
    GEEKWANNAB, Jun 2, 2004
    #3
  4. GEEKWANNAB

    GEEKWANNAB Private First Class

    should I go to software forum to get help with crap cleaner program
     
    GEEKWANNAB, Jun 2, 2004
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Well that's strange that their site states Win98 and above. I do have it running on an old Win95 system but it is build 4.00.950C. And it does work okay.

    Geekwannab, that's why it never occurred to me that it is a Win compatibility issue.
     
    chaslang, Jun 2, 2004
    #5
  6. GEEKWANNAB

    GEEKWANNAB Private First Class

    hey chas, well at least I have spy bot protection . can you give me some help with crap cleaner?
     
    GEEKWANNAB, Jun 2, 2004
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You can basically keep all the defaults and just run it. However, before doing that go to Options (on the top right) and bring up the Options window, you can select things you would like to keep in the Cookies tab. For example, sites that you go to and you want to keep cookies from like www.majorgeeks.com etc. You highlite them in the left column and click the arrow to move them to the right column to keep.

    As far as the other settings on the Main window, it's up to you to decide if you want to keep certain data. For example, suppose you prefer not to delete your History information under Internet Explorer, then just uncheck it. Its really not a problem to have it clean all the defaults. You really do not need them and don't forget it only cleans when you tell it to do so.
     
    chaslang, Jun 3, 2004
    #7
  8. GEEKWANNAB

    GEEKWANNAB Private First Class

    THANKS AGAIN chaslang,

    I went into options and had already figured that stuff out. I was really interested in the issues scan part of the cleaner. Mainly if I could screw something up if I just go in and fix all the issues it listed. ( again there were alot of them).

    by the way I ran hijaak this and am about to post a log.

    Thanks for all your help. This site ROCKS!
    GB.
     
    GEEKWANNAB, Jun 3, 2004
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    With the Issues scan part, you have to be careful and know what you are doing. Anytime you do anything related to editing the registry, you should make a backup first. For some items you find here it may be an easy choice to fix them if you know you have removed that software from your system (that is assuming you recognize which application the issue is relating to).
     
    chaslang, Jun 3, 2004
    #9
  10. GEEKWANNAB

    GEEKWANNAB Private First Class

    Glad I asked , I was able to fix about 50 items left behind by uninstalled software. there are about 15 invalid file extensions. SHOULD I leave those alone?

    NOW I am having a problem with hijaak this. I saved the log BUT when I try to open it, it trys to open the saved log with netscape communicator. WHICH of course doesen't work. I went into configure in hijaak but it doesen't give me the option to open the saved log with another app such as wordpad. SO I can't copy and paste it to post.
     
    GEEKWANNAB, Jun 3, 2004
    #10
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Don't bother with the invalid extensions for now! I'm a little curious abot the last statement with Hijaak This logs. When you run Hijaak This and save the log, it automatically opens notepad to display the file after saving. The file is saved as a .log file not a .txt file. Sounds like a file association may have gotten messed up somewhere. Or you never associated .LOG with notepad.
     
    chaslang, Jun 4, 2004
    #11
  12. GEEKWANNAB

    GEEKWANNAB Private First Class

    hello chaslang
    that must be it because it (hijaak) didn't open anything when I saved a log. it came in as a zip file when I DOWNLOADED IT AND WAS UNZIPPED AND INSTALLED BY WINZIP. The executable program (hijaak) is in a folder called UNzipped in the C: directory. Should the executable program for hijaak be in program files?? if so how do I get it there? 4 ME nothing is easy.
     
    GEEKWANNAB, Jun 4, 2004
    #12
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    No you do not need to put it in Program files, but it is good to put it in its on directory and not a temp directory. It saves logs you want to be able to get to them easily and do not want any cleaning utilities to delete them because of being in temp folders. Make a folder anywhere you like that is a non-temp.
    You could make a c:\spystuff directory for example and put HijaakThis.exe, CWShredder.exe, and other utils like this there. If you really feel the need to, you can add a shortcut to them on your desktop but that is not really necessary.

    You should make a file association to from .log to notepad if you want to open the .log file with notepad automatically. For some reason, your current file association must be to Netscape.
     
    chaslang, Jun 4, 2004
    #13
  14. GEEKWANNAB

    GEEKWANNAB Private First Class

    ok that worked nicely, after moving it to it's own folder it started using notepad instead of netscape. ok here it is.

    Logfile of HijackThis v1.97.7
    Scan saved at 1:10:23 AM, on 06/05/2004
    Platform: Windows 95 B (Win9x 4.00.1212)
    MSIE: Internet Explorer v5.00 (5.00.2919.6304)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\TELEPATH.101\tpexe.exe
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\WINDOWS\SYSTEM\tapiexe.exe
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\MYSPYKILLERS\HIJACKTHIS.EXE

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Gateway 2000
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    F1 - win.ini: run=hpfsched
    O2 - BHO: (no name) - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD.DLL
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
    O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [VsStatEXE] C:\Program Files\Network Associates\McAfee VirusScan\VSSTAT.EXE /SHOWWARNING
    O4 - HKLM\..\Run: [McAfeeWebScanX] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\WebScanX.exe
    O4 - HKLM\..\Run: [Webcelerator] C:\Program Files\Acceleration Software\Webcelerator\webcel.exe runstart
    O4 - HKLM\..\Run: [ddeproc] C:\Program Files\Acceleration Software\Webcelerator\ddeproc.exe
    O4 - HKLM\..\RunServices: [Vshwin32EXE] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
    O4 - HKLM\..\RunServices: [telepath] TELEPATH.101\tpexe.exe
    O4 - Startup: RealDownload.lnk = C:\Program Files\Real\RealDownload\REALDOWNLOAD.EXE
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O9 - Extra button: AOL Instant Messenger (SM) (HKLM)
    O10 - Unknown file in Winsock LSP: c:\windows\system\asiclayer.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system\asiclayer.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system\asiclayer.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system\asiclayer.dll
    O13 - WWW. Prefix: http://
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: Yahoo! Pyramids - http://download.games.yahoo.com/games/clients/y/pyt0_x.cab
    O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://us.games2.yimg.com/download.games.yahoo.com/games/play/client/exentctl_0_0_0_1.ocx
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} (iWon Progressive Counter) - http://download.iwon.com/ct/pm3/iwonpm_8_1,0,2,5.cab
    O16 - DPF: {4EE301F2-2A6A-4BE0-9FBD-97CDAA40E3E4} - http://i1img.com/images/nocache/copilot/i1initialsetup1.0.0.5.cab
    O16 - DPF: {0000000A-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/d/4/4/d446e8a9-3a86-4b59-bb19-f5bd11b40367/wmavax.CAB
     
    GEEKWANNAB, Jun 5, 2004
    #14
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Hi Geek,

    Two items stand out. The first one you can just have Hijaak This fix:
    O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} (iWon Progressive Counter) - http://download.iwon.com/ct/pm3/iwonpm_8_1,0,2,5.cab


    The second one has to do with these lines:
    O10 - Unknown file in Winsock LSP: c:\windows\system\asiclayer.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system\asiclayer.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system\asiclayer.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system\asiclayer.dll

    PestPatrol consider this to be from EAcceleration and classifies this as adware. See:
    http://www.pestpatrol.com/PestInfo/e/eacceleration.asp

    But you appear to using this. See these line:
    O4 - HKLM\..\Run: [Webcelerator] C:\Program Files\Acceleration Software\Webcelerator\webcel.exe runstart
    O4 - HKLM\..\Run: [ddeproc] C:\Program Files\Acceleration Software\Webcelerator\ddeproc.exe

    I'm not sure what to do with this Webcelerator stuff yet. Do not touch it yet. Perhaps someone else would have some ideas if this is bad program to be intercepting your data. Spyware and Hijackers can use the LSPs (Layered Service Provider) to see all traffic being transported over your internet connection. So we need to know if Webcelerator is consider good or bad.
     
    chaslang, Jun 5, 2004
    #15
  16. GEEKWANNAB

    GEEKWANNAB Private First Class

    HEY what's tweekin, I figured those 4 unknowns were trouble . The webcelerator, I downloaded that because it claimed to speed up surfing. But if it's spyware I can remove it, it's on the add/remove programs list in program files and I don't think it made much difference in the speed pages load up (downloaded it a while ago).

    so the safest way to remove the unknowns is to dowload PestPatrol?

    SHould I make a backup when using hijack to fix things?
     
    GEEKWANNAB, Jun 5, 2004
    #16
  17. GEEKWANNAB

    GEEKWANNAB Private First Class

    Checkout who makes webcelerator

    From this explosive beginning, eAcceleration began to develop programs that accelerate the speed of computing. d-Time was the world's first CD-ROM accelerator, Superfassst! - a Best of Comdex nominee in 1996, and Webcelerator has been installed in over 10,000,000 computers world-wide.' -- http://www.eacceleration.com
     
    GEEKWANNAB, Jun 5, 2004
    #17
  18. GEEKWANNAB

    GEEKWANNAB Private First Class

    DUH ignore my lastpost. I went through regedit and checked for the entries listed on PestPatrol page for removal of Eacceleration and none were present.
     
    GEEKWANNAB, Jun 5, 2004
    #18
  19. windytoe

    windytoe Private E-2

    This is a little late for this post, but I have had installation problems with Win95 also. I have read other boards, and there is apparently an install file that does work on Win95, although I do not have it and I don't know anyone who does (It is not the one Lavasoft currently provides). At one point I did manage to install the 181 build myself, and rue the day I took it off. Also, once you get it installed, you will need three new dll's-

    msvcrt.dll, ws2_32.dll, and ws2help.dll

    You can get these at dll-files.com. You will need to copy these into the ad-aware folder. ALso, if you don't have winsock2 installed, you will need to pick that up from the Microsoft website. That will solve your problems, for the most part. Assuming you can find the install file that works. I don't know of any way to tell it from the one that won't work.

    Personally, I am just going to upgrade my laptop.

    Good luck.
     
    windytoe, Jun 29, 2004
    #19

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds