11 replies to this topic

[Dr. John]

I've been using Ad-Aware free versions for a few years now, and installed the Anniversary Edition when it came out. All has been well until today. Today (11/15) I downloaded updated definitions and after that process completed I tried to restart Ad-Aware. I got the splash screen (the one that says "Loading ...") and there it stuck. I have since tried three or four more times (after rebooting the computer each time) always with the same result.

This is an old system - Pentium IIIE 933 MHz, 384 MB SDRAM, Windows XP Professional SP2, Internet Explorer 7. Avast! 4.8 antivirus, Windows Defender, Windows firewall, Internet connection by dialup (nominal 56K, actual 45.2). System HDD 9.5 GB with about 2.2 GB free; data HDD 60 GB with almost 17 GB free. Those are separate physical drives.

I have just created a HiJackThis log, in case that is of interest. There are a couple of things in that log I wonder about, but don't have the expertise to analyze myself.

What to do?

Thanks,

Dr. John

[visitor]

I assume you updated via the Anniversary Edition GUI Web Update? If so, that updates both the software and definitions. If you weren't already up to the final version 8.0.8 released in Sept 21, it could be the newer version. To isolate whether it's software or definitions, you can try this:

- download definitions only from http://download.lava...public/core.zip - right now, there's been a problem with updating, so the definitions there are from Monday November 9. Hopefully you'll see this within ~12 hrs when they may fix it and replace it with today's new definitions.

- extract the core.aawdef file and replace the current definitions located at
C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs

- right-click the tray icon and exit Ad-Aware. Restart to see if the new definitions will load (0149.0089 dated 11/9/2009).

If Ad-Aware starts OK, then it was probably a faulty definition file. If Ad-Aware fails to start, it was probably a faulty program update. Since the updates are fairly large, there's a chance the file was corrupted since you have dial-up internet which is more susceptible to connection hiccups. Usually it's best on dial-up to download at night when there's less internet traffic.

If this doesn't work, then it's possible you have an infection which is causing Ad-Aware from starting. If you think so, then follow the instructions in my signature to post your HijackThis log in the HJT forum.

[Dr. John]

I assume you updated via the Anniversary Edition GUI Web Update? If so, that updates both the software and definitions. If you weren't already up to the final version 8.0.8 released in Sept 21, it could be the newer version.

Yes, I updated via the GUI Web Update from the Anniversary Edition main screen.

All the modules in C:\Program Files\Lavasoft\Ad-Aware\ are version 8.0.0.0 dated 01/18/2009. Does that mean the program update has not been functioning all this time?

To isolate whether it's software or definitions, you can try this:

- download definitions only from http://download.lava...public/core.zip - right now, there's been a problem with updating, so the definitions there are from Monday November 9. Hopefully you'll see this within ~12 hrs when they may fix it and replace it with today's new definitions.

- extract the core.aawdef file and replace the current definitions located at
C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs

- right-click the tray icon and exit Ad-Aware. Restart to see if the new definitions will load (0149.0089 dated 11/9/2009).

The core.aawdef file I already have is dated 11/15/2009, 45.9 MB (it's in the Defs folder, and also in the Update folder). The most recent defs increment in my system is build-149.93.aawdef, not 149.89, and also dated 11/15/2009.

I further looked into the log files and found in the update.log repeated entries of "unable to download metafile [SendRequestConnectionFailed]" - including several such entries in the update log for last night. I also found the Service log entries for the failed attempts to start Ad-Aware. They all contained the same two lines: "could not initialize SDK manager" and "could not initialize SDK controller".

Downloading a new copy of core.aawdef will take about two hours over my dialup connection

How to download a program update??

If Ad-Aware starts OK, then it was probably a faulty definition file. If Ad-Aware fails to start, it was probably a faulty program update. Since the updates are fairly large, there's a chance the file was corrupted since you have dial-up internet which is more susceptible to connection hiccups. Usually it's best on dial-up to download at night when there's less internet traffic.

If this doesn't work, then it's possible you have an infection which is causing Ad-Aware from starting. If you think so, then follow the instructions in my signature to post your HijackThis log in the HJT forum.

I am, of course, wondering why my program has not updated!

I do in fact make all major updates in the evening - but given the time zone difference (I am in California, 9 hours from Sweden I think) I wonder if it really matters?

My computer has become infuriatingly slow during the last several weeks. Should I post a HJT log anyway?

Thanks,

Dr. John

[visitor]

All the modules in C:\Program Files\Lavasoft\Ad-Aware\ are version 8.0.0.0 dated 01/18/2009. Does that mean the program update has not been functioning all this time? How to download a program update?

No, there was a discussion here recently about how the Ad-Aware file properties don't reflect the correct version number. To check which version is loaded, you have to click the "About" button on the GUI.

You're currently using Anniversary Edition, the last version was 8.0.8 released in Sept. In October, they released version 8.1 which requires an uninstall of AE and install of the new 8.1. You can download it from here, but it's 75 mb, so it would take 4-5 hrs, so I don't recommend it since definition updates still work with the old AE (which is what I still use).

The most recent defs increment in my system is build-149.93.aawdef, not 149.89, and also dated 11/15/2009.

Regarding the core.aawdef file, I was suggesting replacing your newer definitions with the older ones to see if it would work. However, Lavasoft has fixed the problem, so today's definitions are now online.

I do in fact make all major updates in the evening - but given the time zone difference (I am in California, 9 hours from Sweden I think) I wonder if it really matters?

I'm also in CA. It does make a difference since you have to consider the loads on local servers in your area. Results from my speed tests are always better after business hours. Also, even though Lavasoft is in Sweden, a majority of their traffic is from the USA.

My computer has become infuriatingly slow during the last several weeks. Should I post a HJT log anyway?

Yes, I think you're system might be infected:

1. you have dial-up, which is more susceptible than having a cable connection with a router. After getting cable and installing a router, my malware problems have virtually disappeared unless I click on a bad link or visit a malicious web page. With dial-up and no router, your computer is open to "port scans" where malware is looking for computers to infect.

2. Malware often prevents execution of popular security programs such as Ad-Aware.

3. Unexplained PC slowness is a good indication you have unwanted applications running in the background.

Read the instructions in my signature:

- post a log in the HijackThis forum. Copy/paste or link to this thread to describe the problem, and somebody there can help you with malware removal.

- submit malware to Lavasoft for analysis - this will help in future definitions and software updates

[Dr. John]

No, there was a discussion here recently about how the Ad-Aware file properties don't reflect the correct version number. To check which version is loaded, you have to click the "About" button on the GUI.

Well, that is moot because I can't get to the GUI until this problem is fixed!

You're currently using Anniversary Edition, the last version was 8.0.8 released in Sept. In October, they released version 8.1 which requires an uninstall of AE and install of the new 8.1. You can download it from here, but it's 75 mb, so it would take 4-5 hrs, so I don't recommend it since definition updates still work with the old AE (which is what I still use).
Regarding the core.aawdef file, I was suggesting replacing your newer definitions with the older ones to see if it would work. However, Lavasoft has fixed the problem, so today's definitions are now online.
I'm also in CA. It does make a difference since you have to consider the loads on local servers in your area. Results from my speed tests are always better after business hours. Also, even though Lavasoft is in Sweden, a majority of their traffic is from the USA.
Yes, I think you're system might be infected:

1. you have dial-up, which is more susceptible than having a cable connection with a router. After getting cable and installing a router, my malware problems have virtually disappeared unless I click on a bad link or visit a malicious web page. With dial-up and no router, your computer is open to "port scans" where malware is looking for computers to infect.

Cable, DSL, etc., are not available where I live. If you want faster than dialup, it is full satellite or nothing - and that's too expensive for my circumstances.

2. Malware often prevents execution of popular security programs such as Ad-Aware.

3. Unexplained PC slowness is a good indication you have unwanted applications running in the background.

Read the instructions in my signature:

I can't scan with Ad-Aware because it won't load ... I could scan with Spybot S&D and/or asquared - but would have to make a 60 MB update to the latter first I have until very recently scanned regularly with Ad-Aware and the others too, and never found anything more sinister than a few tracking cookies. I also scan daily with Windows Defender, always have the latest Avast! antivirus active, and have the Windows Firewall activated.

I do have or can make scans with ATF-Cleaner, the Microsoft malware removal tool, OTL and/or SecurityCheck if those would be useful.

Is the Doug Knox "SysRestorePoint" method preferable to creating a new restore point in the normal way? Anyway I will use it for the sake of argument

- post a log in the HijackThis forum. Copy/paste or link to this thread to describe the problem, and somebody there can help you with malware removal.

How to link to this thread? Sorry to be so dense, I don't spend much time on BBs.

I am, on the other hand, quite familiar with HJT - have been using it for years.

- submit malware to Lavasoft for analysis - this will help in future definitions and software updates

First we have to find it

Thanks,

Dr. John

[visitor]

To check which version is loaded, you have to click the "About" button on the GUI.
Well, that is moot because I can't get to the GUI until this problem is fixed!

Doh! The version number problem was reported to Lavasoft, but not sure if/when they'll fix it.

Cable, DSL, etc., are not available where I live.

On the plus side, it sounds like you live in a beautiful, rural area of CA

Scan with whatever you have available - just to cleanup as much as possible before posting in the HJT forum. System restore and registry backup are "just in case" something happens during cleanup. I've heard of Doug Knox apps, but not familiar if it's better or worse than Windows' System Restore. For registry backups, I export from regedit, but since they recommend ERUNT here, it's probably better. It's up to you if you want to take the time to download, but at least backup the registry through regedit.

How to link to this thread?

When you start a new thread in the HijackThis Forum, just copy/paste
Original thread: http://www.lavasofts...showtopic=27795 followed by your HJT log (copy the text into your post, don't attach the log itself).

[Dr. John]

Doh! The version number problem was reported to Lavasoft, but not sure if/when they'll fix it.

OK, whenever ... but in the meantime I still can't run Ad-Aware. Furthermore, every time I restart the computer I get a notice first that it is closing the Ad-Aware tray application (which however is not visible in the tray) and then that the Ad-Aware tray app is not responding, so I have to "End now" in order to shut the computer down.

On the plus side, it sounds like you live in a beautiful, rural area of CA

Yes, in fact I do, 1/4 mile outside a very small town of about 300 households.

Scan with whatever you have available - just to cleanup as much as possible before posting in the HJT forum. System restore and registry backup are "just in case" something happens during cleanup. I've heard of Doug Knox apps, but not familiar if it's better or worse than Windows' System Restore. For registry backups, I export from regedit, but since they recommend ERUNT here, it's probably better. It's up to you if you want to take the time to download, but at least backup the registry through regedit.

AFAIK ERUNT does more than you can do with regedit.

When you start a new thread in the HijackThis Forum, just copy/paste
Original thread: http://www.lavasofts...showtopic=27795 followed by your HJT log (copy the text into your post, don't attach the log itself).

I think you mean, don't post the log as an attachment, but copy/paste it into the body of the message.

In the meantime, as noted above, I still can't run or update Ad-Aware. Help!

BTW my Windows system is now fully updated with SP3, IE 8, and all updates thereto.

Thanks,

Dr. John

Edited by Dr. John, 01 December 2009 - 03:49 AM.

[visitor]

I think you mean, don't post the log as an attachment, but copy/paste it into the body of the message.

Yes, that's it. Go ahead and post in the HijackThis forum to see if malware is what's slowing down your system and interfering with Ad-Aware.

[Dr. John]

Yes, that's it. Go ahead and post in the HijackThis forum to see if malware is what's slowing down your system and interfering with Ad-Aware.

In the meantime I lost patience, uninstalled the Anniversary Edition and installed Ad-Aware Free 8.1 which I had already downloaded about a month ago. That is now working, though the installation process was, er, interesting (see below) and the "loading" is interminably slow. With your permission I will still post a HJT log.

As mentioned, I had downloaded the install file (73+ MB) a while ago. After uninstalling AE I double-clicked the install file for version 8.1. Windows displays a window asking "Do you want to execute this file?" or words to that effect. It correctly identified the publisher as Lavasoft. I clicked "Yes" which started the install wizard. The wizard presently reported the install file as corrupt, cannot install, please download another copy. I closed the install wizard and again double-clicked the install file. This time the Windows "Do you want to execute this file?" window said "Unknown publisher" but I clicked "Yes" again and this time the install wizard found the install package was OK and proceeded to install Ad-Aware Free 8.1. It then spent more than an hour updating, downloading altogether more than 21 MB of update files, before rebooting the computer and trying to launch Ad-Aware. That launch "hung" at the "Loading ..." splash screen stage, for half an hour or so, until I manually rebooted the computer (which was acting very sluggish). Things were even slower at this startup, but eventually (after perhaps 10 minutes) the Ad-Aware tray icon finally appeared. There were also two Ad-Aware icons on the desktop and one in the quick launch bar. I thought the slowness might be due to lack of space on the C:\ drive, so I cleared off a few hundred MB of unnecessary Windows update download files. I then opened Ad-Aware by right-clicking on the tray icon and selecting "Open Ad-Aware" from the menu. The "Loading ..." splash screen appeared for several minutes, but finally the Ad-Aware application opened and I was able to scan the system. It found nothing except one tracking cookie, which I duly allowed it to delete.

FWIW the C:\ drive on this system is small (9.3 GB, this was a former network workstation to which I have added a second, 60 GB HDD for data) and contains only the Windows O/S and the Program Files. At present there is about 1.2 GB free space on that drive (I plan to replace it with a larger drive as soon as I can get my hands on one).

Thanks,

Dr. John

[visitor]

I'm glad the installation of 8.1 was successful - it's good you uninstalled AE first. Note that version 8.1 does have a problem with slow launch - Lavasoft has been notified, so hopefully they'll fix it.

Now that you scanned with the updated version, you should post in HJT to see if a Volunteer Security Advisor sees anything else lurking on your system.

[Dr. John]

I'm glad the installation of 8.1 was successful - it's good you uninstalled AE first. Note that version 8.1 does have a problem with slow launch - Lavasoft has been notified, so hopefully they'll fix it.

It takes about 90 seconds to launch. I can live with that for the time being.

Now that you scanned with the updated version, you should post in HJT to see if a Volunteer Security Advisor sees anything else lurking on your system.

I have gone ahead and done that. Since I now have Ad-Aware Free 8.1 installed, I suppose we can consider this thread closed on this forum.

Thanks for all the help!

Dr. John

[visitor]

OK, good luck with the HJT results. I'll close this now - if you need to, reopen a new thread in the 8.1 users forum.