[keenan]

Ad-aware SE Personal build 1.06r1 stalls during "Performing System Scan". This happens in both normal and safe mode. I have tried the command line +procnuke suggestion, done a complete defragmentation, but with the same result. My system is infected with Spy Sheriff and I always delete its process with task mgr after every boot. I have the latest defs SE1R50 13.06.2005. I have saved logs. Can you help please?

[Advertisements]

Hi keenan and welcome,

Please right-click: HERE and go to Save As (in Internet Explorer it's "Save Target As") in order to download smitfraud reg file. Save it to your desktop.

Locate "smitfraud.reg" on your desktop and double-click it. When asked if you want to merge with the registry, click YES. Wait for the "merged successfully" prompt then follow the rest of the instructions below.



Next

Please go to Add/Remove programs and remove the following please

SpySheriff




Next
Next Reboot into SAFE MODE Make sure you can view all Hidden Files/Folders search for and delete the files highlighted in BOLD

C:\Windows\Desktop.html
C:\Program Files\SpySheriff <<< Delete Folder
C:\winstall.exe



Next



Reboot to normal mode, See if you can now run a full scan and post a log for us please

[don77]

Hi keenan and welcome,

Please right-click: HERE and go to Save As (in Internet Explorer it's "Save Target As") in order to download smitfraud reg file. Save it to your desktop.

Locate "smitfraud.reg" on your desktop and double-click it. When asked if you want to merge with the registry, click YES. Wait for the "merged successfully" prompt then follow the rest of the instructions below.



Next

Please go to Add/Remove programs and remove the following please

SpySheriff




Next
Next Reboot into SAFE MODE Make sure you can view all Hidden Files/Folders search for and delete the files highlighted in BOLD

C:\Windows\Desktop.html
C:\Program Files\SpySheriff <<< Delete Folder
C:\winstall.exe



Next



Reboot to normal mode, See if you can now run a full scan and post a log for us please

[keenan]

Unable to run a full Ad-aware scan. Followed don77 instructions as best I could (some things were not quite as the instructions expected - will explain later), and deleted the required file while in Safe Mode. After booting to normal mode I saw no trace of Spy Sheriff, no folder, and no running process, which was encouraging! Then I tried Ad-aware scan again using the settings you require, and as I say, it did not run to completion, and stalled during the operation "Performing conditional scans..."

Re: the instructions, Win 2000 does not have a C:\Windows folder, it's WINNT. where I found Desktop.html and deleted it. Also, could not delete SpySheriff folder because it wasn't there. Deleted winstall.exe as instructed.

Also, at the very beginning, after running smitfraud.reg, I was unable to remove Spy Sheriff use Ctrl Panel Add/Remove because it wasn't listed there. And when I went to its folder and tried to run its uninstal pgm, it said it couldn't because it was active. So I deleted the Spy Sheriff process using task mgr, then ran the uninstal, and it worked.

Lastly I'm posting the Ad-aware log at the point of stalling, below, and will await your advice with much appreciation.
keenan


Ad-Aware SE Build 1.06r1
Logfile Created on:Sunday, June 19, 2005 11:26:32 PM
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R50 13.06.2005
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
Definition File:
=========================
Definitions File Loaded:
Reference Number : SE1R50 13.06.2005
Internal build : 58
File location : C:\Program Files\Lavasoft\Ad-Aware SE Personal\defs.ref
File size : 481146 Bytes
Total size : 1456012 Bytes
Signature data size : 1427935 Bytes
Reference data size : 27565 Bytes
Signatures total : 40456
CSI Fingerprints total : 904
CSI data size : 31134 Bytes
Target categories : 15
Target families : 692


Memory + processor status:
==========================
Number of processors : 1
Processor architecture : Intel Pentium IV
Memory available:66 %
Total physical memory:523760 kb
Available physical memory:343792 kb
Total page file size:832632 kb
Available on page file:650712 kb
Total virtual memory:2097024 kb
Available virtual memory:2044788 kb
OS:Microsoft Windows 2000 Professional Service Pack 4 (Build 2195)

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan within archives
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Obtain command line of scanned processes
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Write-protect system files after repair (Hosts file, etc.)
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects


6-19-2005 11:26:32 PM - Scan started. (Custom mode)

Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]
ModuleName : \SystemRoot\System32\smss.exe
Command Line : n/a
ProcessID : 148
ThreadCreationTime : 6-20-2005 3:21:27 AM
BasePriority : Normal


#:2 [csrss.exe]
ModuleName : \??\C:\WINNT\system32\csrss.exe
Command Line : C:\WINNT\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequest
ProcessID : 172
ThreadCreationTime : 6-20-2005 3:21:31 AM
BasePriority : Normal


#:3 [winlogon.exe]
ModuleName : \??\C:\WINNT\system32\winlogon.exe
Command Line : winlogon.exe
ProcessID : 192
ThreadCreationTime : 6-20-2005 3:21:33 AM
BasePriority : High


#:4 [services.exe]
ModuleName : C:\WINNT\system32\services.exe
Command Line : C:\WINNT\system32\services.exe
ProcessID : 220
ThreadCreationTime : 6-20-2005 3:21:34 AM
BasePriority : Normal
FileVersion : 5.00.2195.6700
ProductVersion : 5.00.2195.6700
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Services and Controller app
InternalName : services.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : services.exe

#:5 [lsass.exe]
ModuleName : C:\WINNT\system32\lsass.exe
Command Line : C:\WINNT\system32\lsass.exe
ProcessID : 232
ThreadCreationTime : 6-20-2005 3:21:34 AM
BasePriority : Normal
FileVersion : 5.00.2195.6902
ProductVersion : 5.00.2195.6902
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Executable and Server DLL (Export Version)
InternalName : lsasrv.dll and lsass.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : lsasrv.dll and lsass.exe

#:6 [svchost.exe]
ModuleName : C:\WINNT\system32\svchost.exe
Command Line : C:\WINNT\system32\svchost -k rpcss
ProcessID : 484
ThreadCreationTime : 6-20-2005 3:21:37 AM
BasePriority : Normal
FileVersion : 5.00.2134.1
ProductVersion : 5.00.2134.1
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : svchost.exe

#:7 [spoolsv.exe]
ModuleName : C:\WINNT\system32\spoolsv.exe
Command Line : C:\WINNT\system32\spoolsv.exe
ProcessID : 512
ThreadCreationTime : 6-20-2005 3:21:37 AM
BasePriority : Normal
FileVersion : 5.00.2195.6659
ProductVersion : 5.00.2195.6659
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolss.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : spoolss.exe

#:8 [avguard.exe]
ModuleName : C:\Program Files\AVPersonal\AVGUARD.EXE
Command Line : "C:\Program Files\AVPersonal\AVGUARD.EXE"
ProcessID : 540
ThreadCreationTime : 6-20-2005 3:21:38 AM
BasePriority : Normal


#:9 [avwupsrv.exe]
ModuleName : C:\Program Files\AVPersonal\AVWUPSRV.EXE
Command Line : "C:\Program Files\AVPersonal\AVWUPSRV.EXE"
ProcessID : 552
ThreadCreationTime : 6-20-2005 3:21:38 AM
BasePriority : Normal


#:10 [svchost.exe]
ModuleName : C:\WINNT\System32\svchost.exe
Command Line : C:\WINNT\System32\svchost.exe -k netsvcs
ProcessID : 568
ThreadCreationTime : 6-20-2005 3:21:38 AM
BasePriority : Normal
FileVersion : 5.00.2134.1
ProductVersion : 5.00.2134.1
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : svchost.exe

#:11 [mdm.exe]
ModuleName : C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
Command Line : "C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"
ProcessID : 608
ThreadCreationTime : 6-20-2005 3:21:38 AM
BasePriority : Normal
FileVersion : 7.10.3077
ProductVersion : 7.10.3077
ProductName : Microsoft® Visual Studio .NET
CompanyName : Microsoft Corporation
FileDescription : Machine Debug Manager
InternalName : mdm.exe
LegalCopyright : Copyright© Microsoft Corporation. All rights reserved.
OriginalFilename : mdm.exe

#:12 [sqlservr.exe]
ModuleName : C:\Program Files\Microsoft SQL Server\MSSQL$NETSDK\Binn\sqlservr.exe
Command Line : "C:\Program Files\Microsoft SQL Server\MSSQL$NETSDK\Binn\sqlservr.exe" -sNETSDK
ProcessID : 660
ThreadCreationTime : 6-20-2005 3:21:39 AM
BasePriority : Normal
FileVersion : 2000.080.0760.00
ProductVersion : 8.00.760
ProductName : Microsoft SQL Server
CompanyName : Microsoft Corporation
FileDescription : SQL Server Windows NT
InternalName : SQLSERVR
LegalCopyright : © 1988-2003 Microsoft Corp. All rights reserved.
LegalTrademarks : Microsoft® is a registered trademark of Microsoft Corporation. Windows™ is a trademark of Microsoft Corporation
OriginalFilename : SQLSERVR.EXE
Comments : NT INTEL X86

#:13 [regsvc.exe]
ModuleName : C:\WINNT\system32\regsvc.exe
Command Line : C:\WINNT\system32\regsvc.exe
ProcessID : 696
ThreadCreationTime : 6-20-2005 3:21:40 AM
BasePriority : Normal
FileVersion : 5.00.2195.6701
ProductVersion : 5.00.2195.6701
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Remote Registry Service
InternalName : regsvc
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : REGSVC.EXE

#:14 [mstask.exe]
ModuleName : C:\WINNT\system32\MSTask.exe
Command Line : C:\WINNT\system32\MSTask.exe
ProcessID : 716
ThreadCreationTime : 6-20-2005 3:21:41 AM
BasePriority : Normal
FileVersion : 4.71.2195.6920
ProductVersion : 4.71.2195.6920
ProductName : Microsoft® Windows® Task Scheduler
CompanyName : Microsoft Corporation
FileDescription : Task Scheduler Engine
InternalName : TaskScheduler
LegalCopyright : Copyright © Microsoft Corp. 1997
OriginalFilename : mstask.exe

#:15 [stisvc.exe]
ModuleName : C:\WINNT\system32\stisvc.exe
Command Line : C:\WINNT\system32\stisvc.exe
ProcessID : 752
ThreadCreationTime : 6-20-2005 3:21:41 AM
BasePriority : Normal
FileVersion : 5.00.2195.6656
ProductVersion : 5.00.2195.6656
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Still Image Devices Monitor
InternalName : STIMON
LegalCopyright : Copyright © Microsoft Corp. 1996-1997
OriginalFilename : STIMON.EXE

#:16 [winmgmt.exe]
ModuleName : C:\WINNT\System32\WBEM\WinMgmt.exe
Command Line : C:\WINNT\System32\WBEM\WinMgmt.exe
ProcessID : 820
ThreadCreationTime : 6-20-2005 3:21:42 AM
BasePriority : Normal
FileVersion : 1.50.1085.0100
ProductVersion : 1.50.1085.0100
ProductName : Windows Management Instrumentation
CompanyName : Microsoft Corporation
FileDescription : Windows Management Instrumentation
InternalName : WINMGMT
LegalCopyright : Copyright © Microsoft Corp. 1995-1999

#:17 [svchost.exe]
ModuleName : C:\WINNT\system32\svchost.exe
Command Line : C:\WINNT\system32\svchost.exe -k wugroup
ProcessID : 872
ThreadCreationTime : 6-20-2005 3:21:43 AM
BasePriority : Normal
FileVersion : 5.00.2134.1
ProductVersion : 5.00.2134.1
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : svchost.exe

#:18 [svchost.exe]
ModuleName : C:\WINNT\System32\svchost.exe
Command Line : C:\WINNT\System32\svchost.exe -k BITSgroup
ProcessID : 896
ThreadCreationTime : 6-20-2005 3:21:43 AM
BasePriority : Normal
FileVersion : 5.00.2134.1
ProductVersion : 5.00.2134.1
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : svchost.exe

#:19 [explorer.exe]
ModuleName : C:\WINNT\Explorer.EXE
Command Line : C:\WINNT\Explorer.EXE
ProcessID : 1112
ThreadCreationTime : 6-20-2005 3:21:50 AM
BasePriority : Normal
FileVersion : 5.00.3700.6690
ProductVersion : 5.00.3700.6690
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : EXPLORER.EXE

#:20 [hpqcmon.exe]
ModuleName : C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
Command Line : "C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe"
ProcessID : 1192
ThreadCreationTime : 6-20-2005 3:21:55 AM
BasePriority : Normal
FileVersion : 1.2.0.66
ProductVersion : 1.2.0.66
ProductName : HpqCmon Application
FileDescription : HpqCmon MFC Application
InternalName : HpqCmon
LegalCopyright : Copyright © 2001
OriginalFilename : HpqCmon.EXE

#:21 [hpgs2wnd.exe]
ModuleName : C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
Command Line : "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe"
ProcessID : 1200
ThreadCreationTime : 6-20-2005 3:21:56 AM
BasePriority : Normal
FileVersion : 2,3,0,0\ 162
ProductVersion : 2,3,0,0\ 162
ProductName : Hewlett-Packard hpgs2wnd
CompanyName : Hewlett-Packard
FileDescription : hpgs2wnd
InternalName : hpgs2wnd
LegalCopyright : Copyright © 2001
OriginalFilename : hpgs2wnd.exe

#:22 [picasamediadetector.exe]
ModuleName : C:\Program Files\Picasa2\PicasaMediaDetector.exe
Command Line : "C:\Program Files\Picasa2\PicasaMediaDetector.exe"
ProcessID : 1220
ThreadCreationTime : 6-20-2005 3:21:56 AM
BasePriority : Normal


#:23 [incd.exe]
ModuleName : C:\Program Files\ahead\InCD\InCD.exe
Command Line : "C:\Program Files\ahead\InCD\InCD.exe"
ProcessID : 1256
ThreadCreationTime : 6-20-2005 3:21:57 AM
BasePriority : Normal
FileVersion : 3.23.1
ProductVersion : 3.23.1
ProductName : InCD
CompanyName : Copyright © ahead software gmbh and its licensors
FileDescription : InCD CD-RW UDF Tools
InternalName : InCD
LegalCopyright : Copyright © ahead software gmbh and its licensors
OriginalFilename : InCD.EXE
Comments : CD-RW UDF Tools

#:24 [winampa.exe]
ModuleName : C:\Program Files\Winamp\winampa.exe
Command Line : "C:\Program Files\Winamp\winampa.exe"
ProcessID : 1276
ThreadCreationTime : 6-20-2005 3:21:57 AM
BasePriority : Normal


#:25 [jusched.exe]
ModuleName : C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
Command Line : "C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe"
ProcessID : 1288
ThreadCreationTime : 6-20-2005 3:21:58 AM
BasePriority : Normal


#:26 [hpgs2wnf.exe]
ModuleName : C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
Command Line : "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe" -Embedding
ProcessID : 1300
ThreadCreationTime : 6-20-2005 3:21:59 AM
BasePriority : Normal
FileVersion : 2, 6, 0, 162
ProductVersion : 2, 6, 0, 162
ProductName : hpgs2wnf Module
FileDescription : hpgs2wnf Module
InternalName : hpgs2wnf
LegalCopyright : Copyright 2001
OriginalFilename : hpgs2wnf.EXE

#:27 [atiptaxx.exe]
ModuleName : C:\WINNT\system32\atiptaxx.exe
Command Line : "C:\WINNT\system32\atiptaxx.exe"
ProcessID : 1308
ThreadCreationTime : 6-20-2005 3:21:59 AM
BasePriority : Normal
FileVersion : 6.13.10.2534
ProductVersion : 6.13.10.2534
ProductName : ATI Desktop Component
CompanyName : ATI Technologies, Inc.
FileDescription : ATI Desktop Control Panel
InternalName : Atiptaxx.exe
LegalCopyright : Copyright © 1998-2001 ATI Technologies Inc.
OriginalFilename : Atiptaxx.exe

#:28 [desk95.exe]
ModuleName : C:\WINNT\system32\desk95.exe
Command Line : "C:\WINNT\system32\desk95.exe"
ProcessID : 1332
ThreadCreationTime : 6-20-2005 3:21:59 AM
BasePriority : Normal
FileVersion : 2.50.00.0023
ProductVersion : 2.50.00.0023
ProductName : ATI Technologies Inc. HydraVision Desktop Manager
CompanyName : ATI Technologies Inc.
FileDescription : Desk95
InternalName : Desk95
LegalCopyright : Copyright © ATI Technologies Inc. 1985-2001
OriginalFilename : Desk95.exe

#:29 [weather.exe]
ModuleName : C:\Program Files\Daily Weather Forecast\weather.exe
Command Line : "C:\Program Files\Daily Weather Forecast\weather.exe"
ProcessID : 1348
ThreadCreationTime : 6-20-2005 3:22:01 AM
BasePriority : Normal


#:30 [realsched.exe]
ModuleName : C:\Program Files\Common Files\Real\Update_OB\realsched.exe
Command Line : "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
ProcessID : 1388
ThreadCreationTime : 6-20-2005 3:22:01 AM
BasePriority : Normal
FileVersion : 0.1.0.3275
ProductVersion : 0.1.0.3275
ProductName : RealPlayer (32-bit)
CompanyName : RealNetworks, Inc.
FileDescription : RealNetworks Scheduler
InternalName : schedapp
LegalCopyright : Copyright © RealNetworks, Inc. 1995-2004
LegalTrademarks : RealAudio™ is a trademark of RealNetworks, Inc.
OriginalFilename : realsched.exe

#:31 [avgnt.exe]
ModuleName : C:\Program Files\AVPersonal\AVGNT.EXE
Command Line : "C:\Program Files\AVPersonal\AVGNT.EXE" /min
ProcessID : 1404
ThreadCreationTime : 6-20-2005 3:22:01 AM
BasePriority : Normal


#:32 [atix10.exe]
ModuleName : C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
Command Line : "C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe"
ProcessID : 1424
ThreadCreationTime : 6-20-2005 3:22:02 AM
BasePriority : Normal
FileVersion : 1.1.0.5
ProductVersion : 1.1.0.5
ProductName : ATIX10
CompanyName : ATI Technologies Inc.
FileDescription : ATI Remote Control
InternalName : ATIX10
LegalCopyright : Copyright © 2001 ATI Technologies Inc.
OriginalFilename : ATIX10.EXE

#:33 [r?gedit.exe]
ModuleName : C:\WINNT\system32\r?gedit.exe
Command Line : "C:\WINNT\system32\r?gedit.exe"
ProcessID : 1464
ThreadCreationTime : 6-20-2005 3:22:02 AM
BasePriority : Normal


#:34 [reader_sl.exe]
ModuleName : C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Command Line : "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe"
ProcessID : 1480
ThreadCreationTime : 6-20-2005 3:22:03 AM
BasePriority : Normal
FileVersion : 7.0.0.0
ProductVersion : 7.0.0.0
ProductName : Adobe Acrobat
CompanyName : Adobe Systems Incorporated
FileDescription : Adobe Acrobat SpeedLauncher
LegalCopyright : Copyright Adobe Systems Incorporated 2004
OriginalFilename : AcroSpeedLaunch.exe

#:35 [sqlmangr.exe]
ModuleName : C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
Command Line : "C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe" /n
ProcessID : 1544
ThreadCreationTime : 6-20-2005 3:22:06 AM
BasePriority : Normal
FileVersion : 2000.080.0760.00
ProductVersion : 8.00.760
ProductName : Microsoft SQL Server
CompanyName : Microsoft Corporation
FileDescription : SQL Server Service Manager
InternalName : SQLMANGR
LegalCopyright : © 1988-2003 Microsoft Corp. All rights reserved.
LegalTrademarks : Microsoft® is a registered trademark of Microsoft Corporation. Windows™ is a trademark of Microsoft Corporation
OriginalFilename : SQLMANGR.exe
Comments : NT INTEL X86

#:36 [rundll32.exe]
ModuleName : C:\WINNT\system32\rundll32.exe
Command Line : C:\WINNT\system32\rundll32.exe C:\PROGRA~1\ATIMUL~1\RemCtrl\x10net.dll,EntryPoint -Embedding
ProcessID : 1556
ThreadCreationTime : 6-20-2005 3:22:06 AM
BasePriority : Normal
FileVersion : 5.00.2134.1
ProductVersion : 5.00.2134.1
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Run a DLL as an App
InternalName : rundll
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : RUNDLL.EXE

#:37 [wuauclt.exe]
ModuleName : C:\WINNT\system32\wuauclt.exe
Command Line : "C:\WINNT\system32\wuauclt.exe"
ProcessID : 1716
ThreadCreationTime : 6-20-2005 3:22:52 AM
BasePriority : Normal
FileVersion : 5.4.3790.20 built by: lab04_n
ProductVersion : 5.4.3790.20
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows Update AutoUpdate Client
InternalName : wuauclt.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : wuauclt.exe

#:38 [ad-aware.exe]
ModuleName : C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
Command Line : "C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe"
ProcessID : 1060
ThreadCreationTime : 6-20-2005 3:24:04 AM
BasePriority : Normal
FileVersion : 6.2.0.236
ProductVersion : SE 106
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft AB Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 0


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Alexa Object Recognized!
Type : Regkey
Data :
TAC Rating : 5
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}

Alexa Object Recognized!
Type : RegValue
Data :
TAC Rating : 5
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
Value : MenuStatusBar

Alexa Object Recognized!
Type : RegValue
Data :
TAC Rating : 5
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
Value : Script

Alexa Object Recognized!
Type : RegValue
Data :
TAC Rating : 5
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
Value : clsid

Alexa Object Recognized!
Type : RegValue
Data :
TAC Rating : 5
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
Value : Icon

Alexa Object Recognized!
Type : RegValue
Data :
TAC Rating : 5
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
Value : HotIcon

Alexa Object Recognized!
Type : RegValue
Data :
TAC Rating : 5
Category : Data Miner
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
Value : ButtonText

ClickSpring Object Recognized!
Type : Regkey
Data :
TAC Rating : 6
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\clickspring

ClickSpring Object Recognized!
Type : RegValue
Data :
TAC Rating : 6
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\clickspring
Value : PID

Alexa Object Recognized!
Type : RegValue
Data :
TAC Rating : 5
Category : Data Miner
Comment : "{c95fe080-8f5d-11d2-a20b-00aa003c157a}"
Rootkey : HKEY_USERS
Object : S-1-5-21-1993962763-436374069-1957994488-500\software\microsoft\internet explorer\extensions\cmdmapping
Value : {c95fe080-8f5d-11d2-a20b-00aa003c157a}

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 10
Objects found so far: 10


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Win32.Swen.A Object Recognized!
Type : Regkey
Data : by Begbie
TAC Rating : 8
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\explorer\KIIIRX

Win32.Swen.A Object Recognized!
Type : RegValue
Data : by Begbie
TAC Rating : 8
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\explorer\KIIIRX
Value : Unfile

Win32.Swen.A Object Recognized!
Type : RegValue
Data : by Begbie
TAC Rating : 8
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\explorer\KIIIRX
Value : CacheBox Outfit

Win32.Swen.A Object Recognized!
Type : RegValue
Data : by Begbie
TAC Rating : 8
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\explorer\KIIIRX
Value : ZipName

Win32.Swen.A Object Recognized!
Type : RegValue
Data : by Begbie
TAC Rating : 8
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\explorer\KIIIRX
Value : Email Address

Win32.Swen.A Object Recognized!
Type : RegValue
Data : by Begbie
TAC Rating : 8
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\explorer\KIIIRX
Value : Server

Win32.Swen.A Object Recognized!
Type : RegValue
Data : by Begbie
TAC Rating : 8
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\explorer\KIIIRX
Value : VicName

Win32.Swen.A Object Recognized!
Type : RegValue
Data : by Begbie
TAC Rating : 8
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\explorer\KIIIRX
Value : Installed

Win32.Swen.A Object Recognized!
Type : RegValue
Data : by Begbie
TAC Rating : 8
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\explorer\KIIIRX
Value : Counter Visited

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 9
Objects found so far: 19

MRU List Object Recognized!
Location: : C:\Documents and Settings\Administrator\Application Data\microsoft\office\recent
Description : list of recently opened documents using microsoft office


MRU List Object Recognized!
Location: : C:\Documents and Settings\Administrator\recent
Description : list of recently opened documents


MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct3d


MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct X


MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw


MRU List Object Recognized!
Location: : S-1-5-21-1993962763-436374069-1957994488-500\software\microsoft\internet explorer
Description : last download directory used in microsoft internet explorer


MRU List Object Recognized!
Location: : S-1-5-21-1993962763-436374069-1957994488-500\software\microsoft\internet explorer\main
Description : last save directory used in microsoft internet explorer


MRU List Object Recognized!
Location: : S-1-5-21-1993962763-436374069-1957994488-500\software\microsoft\mediaplayer\medialibraryui
Description : last selected node in the microsoft windows media player media library


MRU List Object Recognized!
Location: : S-1-5-21-1993962763-436374069-1957994488-500\software\microsoft\mediaplayer\player\recenturllist
Description : list of recently used web addresses in microsoft windows media player


MRU List Object Recognized!
Location: : S-1-5-21-1993962763-436374069-1957994488-500\software\microsoft\mediaplayer\player\settings
Description : last open directory used in jasc paint shop pro


MRU List Object Recognized!
Location: : S-1-5-21-1993962763-436374069-1957994488-500\software\microsoft\mediaplayer\preferences
Description : last playlist index loaded in microsoft windows media player


MRU List Object Recognized!
Location: : S-1-5-21-1993962763-436374069-1957994488-500\software\microsoft\mediaplayer\preferences
Description : last playlist loaded in microsoft windows media player


MRU List Object Recognized!
Location: : S-1-5-21-1993962763-436374069-1957994488-500\software\microsoft\mediaplayer\preferences
Description : last search path used in microsoft windows media player


MRU List Object Recognized!
Location: : S-1-5-21-1993962763-436374069-1957994488-500\software\microsoft\microsoft management console\recent file list
Description : list of recent snap-ins used in the microsoft management console


MRU List Object Recognized!
Location: : S-1-5-21-1993962763-436374069-1957994488-500\software\microsoft\office\9.0\common\open find\microsoft word\settings\save as\file name mru
Description : list of recent documents saved by microsoft word


MRU List Object Recognized!
Location: : S-1-5-21-1993962763-436374069-1957994488-500\software\microsoft\windows\currentversion\applets\regedit
Description : last key accessed using the microsoft registry editor


MRU List Object Recognized!
Location: : S-1-5-21-1993962763-436374069-1957994488-500\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
Description : list of recent programs opened


MRU List Object Recognized!
Location: : S-1-5-21-1993962763-436374069-1957994488-500\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
Description : list of recently saved files, stored according to file extension


MRU List Object Recognized!
Location: : S-1-5-21-1993962763-436374069-1957994488-500\software\microsoft\windows\currentversion\explorer\recentdocs
Description : list of recent documents opened


MRU List Object Recognized!
Location: : S-1-5-21-1993962763-436374069-1957994488-500\software\realnetworks\realplayer\6.0\preferences
Description : list of recent skins in realplayer


MRU List Object Recognized!
Location: : S-1-5-21-1993962763-436374069-1957994488-500\software\realnetworks\realplayer\6.0\preferences
Description : list of recent clips in realplayer


MRU List Object Recognized!
Location: : S-1-5-21-1993962763-436374069-1957994488-500\software\realnetworks\realplayer\6.0\preferences
Description : last login time in realplayer


MRU List Object Recognized!
Location: : S-1-5-21-1993962763-436374069-1957994488-500\software\microsoft\windows media\wmsdk\general
Description : windows media sdk



Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 42



Deep scanning and examining files (C:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 42


Scanning Hosts file......
Hosts file location:"C:\WINNT\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
1 entries scanned.
New critical objects:0
Objects found so far: 42




Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

ClickSpring Object Recognized!
Type : File
Data : wnsintsv.exe
TAC Rating : 6
Category : Malware
Comment :
Object : C:\WINNT\system32\



ClickSpring Object Recognized!
Type : File
Data : crash.txt
TAC Rating : 6
Category : Malware
Comment :
Object : c:\



Win32.Swen.A Object Recognized!
Type : RegData
Data : "%1" /s
TAC Rating : 8
Category : Malware
Comment : Possible virus infection, SCR (configure) file extension compromised
Rootkey : HKEY_CLASSES_ROOT
Object : scrfile\shell\config\command
Value :
Data : "%1" /s
<STOP>

[keenan]

As you suggested, I ran the following command:

"C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe" +procnuke +cskip

and I unchecked "Search for negligible risk entries", and I selected "Perform full system scan".

It hung again at "Performing conditional scans"...

I reran it, double-checking the command and settings, but it hung at the same spot.


/keenan

[keenan]

Hello Andy,

I have the latest Ad-Aware definition files: SE1R51 21.06.2005.

I ran a defrag as instructed in an earlier post.

I have just run a thorough Checkdisk.

I have run the command in normal mode: "C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe" +procnuke +cskip

I have run Ad-Aware in safe mode.

Both above runs stall while "Performing conditional scans"...

I think I would like to follow your advice as follows:
=================================
If you still have a problem, cancel BEFORE the scan reaches the point of stalling -- say after 20 objects are detected. Then click cancel and click on the logfile. Remove any objects you choose and rescan. Again stop the scan before it reaches the point of stalling and remove any additional objects. Then try a full scan without stopping it.
==================================
BUT I don't understand what you mean by "Remove any objects you choose and rescan." I'm guessing, but presumably when I click on logfile I will see a list of objects and be prompted to delete some of them.. is that the case??
So, what I'll do is rerun Ad-Aware and stop just before the place where it stalls and try to apply your suggestions re: deleting objects.
I'll get back to you with my findings.
BTW, I've just now installed what appears to be an excellent firewall called Sygate Personal Firewall. It prompts me with all in/out traffic. Great!

/keenan

[keenan]

Hello Andy..

Success!! I stopped the Ad-Aware scan just before where it stalls, quarantined the critical objects listed, and reran the scan - and it went to completion, reporting no critical objects. I assume I now have a 'clean' machine. For your possible info I'm including Ad-Aware detail on the critical objects it found. I will now follow Geeks To Go instructions on how to prevent future infections. Many, many thanks for helping me clean up (and wise-up)!
/keenan



ArchiveData(auto-quarantine- 2005-06-22 21-28-14.bckp)
Referencefile : SE1R51 21.06.2005
======================================================

ALEXA
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[0]=Regkey : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
obj[1]=RegValue : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} "MenuStatusBar"
obj[2]=RegValue : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} "Script"
obj[3]=RegValue : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} "clsid"
obj[4]=RegValue : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} "Icon"
obj[5]=RegValue : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} "HotIcon"
obj[6]=RegValue : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} "ButtonText"
obj[9]=RegValue : S-1-5-21-1993962763-436374069-1957994488-500\software\microsoft\internet explorer\extensions\cmdmapping "{c95fe080-8f5d-11d2-a20b-00aa003c157a}"

CLICKSPRING
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[7]=Regkey : software\clickspring
obj[8]=RegValue : software\clickspring "PID"

WIN32.SWEN.A
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[10]=Regkey : software\microsoft\windows\currentversion\explorer\KIIIRX
obj[11]=RegValue : software\microsoft\windows\currentversion\explorer\KIIIRX "Unfile"
obj[12]=RegValue : software\microsoft\windows\currentversion\explorer\KIIIRX "CacheBox Outfit"
obj[13]=RegValue : software\microsoft\windows\currentversion\explorer\KIIIRX "ZipName"
obj[14]=RegValue : software\microsoft\windows\currentversion\explorer\KIIIRX "Email Address"
obj[15]=RegValue : software\microsoft\windows\currentversion\explorer\KIIIRX "Server"
obj[16]=RegValue : software\microsoft\windows\currentversion\explorer\KIIIRX "VicName"
obj[17]=RegValue : software\microsoft\windows\currentversion\explorer\KIIIRX "Installed"
obj[18]=RegValue : software\microsoft\windows\currentversion\explorer\KIIIRX "Counter Visited"

[don77]

Thanks for the feed back keenan
Sorry for the mix up on the file locations I suppose i should have asked what OS you were running,

Just to be clear you can run a full scan in Normal mode ? and the log comes back clean ?

Again we appreciate the feed back as it helps us help others

Don

[keenan]

Hello Don and Andy,

Yes. I can do a full Ad-Aware scan in normal mode and the log reports no critical objects. Spy Sheriff is long gone. I believe I have a very clean machine now, thanks to your great assistance and patience. I have also installed a personal firewall from Sygate, and it is terrific and free: http://smb.sygate.com/download_buy.htm

An item a bit off-topic but so very interesting I must ask you folks about it...
I'll assume you've played Solitaire and won and seen the graphic at the end showing all the cards come tumbling and bouncing down, one at a time, until all 52 are done. Well, here's the thing... I've timed how long that graphic takes under two conditions:
1 - when Ad-Aware is not active
2 - when Ad-Aware is active
and the surprising result is that when it's NOT active the graphic takes about 85-90 seconds but only about 45-50 seconds when it IS active.
And by active, I don't mean performing a scan - just simply show its dialog window and waiting for a user click. This is very puzzling!

Can anyone explain why the performance of my machine improves dramatically when Ad-Aware is launched but inactively waiting for user input?

One more question.. why do I have two newbie beanie hats now?

/keenan

[keenan]

Yes indeed Andy, my computer is running very well.

Thanks to the tremendous help you and your colleagues have provided my computer is running the way the x@$&&#x!! furshlugginger thing should run!

I'm also doing my bit to keep it that way by running Ad-Aware just about every day. This is prudent insofar as I'm spending some time P2P'g which I hear can be a source of malware.

So once again, much appreciation for your outstanding assistance - it's reassuring and comforting to know folks like you and your colleagues are ever ready to lend a hand to guide us poor lambs away from the forces of evil.

/keenan

[don77]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.