15 replies to this topic

[Thelemming]

System is a Dell with 2 Gig Dram memory and 40% of the 120 Gig HD is free. The O/S is XP PRO SP-3 with all the current patches.

I had been running Ad-Aware AE OK, on Sunday was told that a new version was out so I DL and installed it, the installer uninstalled the Ad-Aware that was there and then installed Ad-Aware 8.1 and auto-manager DL the update data files then the system auto restarted. When it can back I got the message "Failed to Connect to Service". I read and checked about the error http://www.lavasofts...s...&hl=connect I scaned with SuperAntiSpyware and the only file that came up was "Adware.tracking cookie" which I let it delete. The I DL Revo. and installed it, then restarted and uninstalled "Ad-Aware" with Revo. restarted again, DL the new version of Ad-Aware and reinstalled that then restarted again, checked for the service nope nott there. Typed the sc command exactly as posted and it errored with bad syntax,'exited' and yep the service still ain't there.

[visitor]

Try the command string from this post:

http://www.lavasofts...mp;#entry107298

sc create AAWService binpath= c:\progra~1\lavasoft\ad-aware\aawser~1.exe displayname= "Lavasoft Ad-Aware"

This didn't work for somebody else having the same problem with the new version, but it's worth a try. It could be the Adware infection which SuperAntiSpyware detected. If creating the service doesn't work, read the instructions in my signature:

1. submit malware to Lavasoft for analysis - this will help in future definitions and software updates

2. post a log in the HijackThis forum. Copy/paste or link to this thread to describe the problem, and somebody there can help you with malware removal.

[Thelemming]

[quote name='visitor' date='Oct 13 2009, 10:08 PM' post='111555']
Try the command string from this post:

http://www.lavasofts...mp;#entry107298


Doing this created a line that after I rebooted would not start, and when I looked into services.msc and tried to manually start, it produced a error 3: can not find path, guess I can just delete it, wonder how can't delete from service.msc!

Edited by Thelemming, 14 October 2009 - 08:08 PM.

[Thelemming]

Used the 'cd' command and had to use the caps to navigate the dir I hoped the 'cs create' might be caps aware but the command still errored with a syntax when I put in all those caps.

[visitor]

I hoped the 'cs create' might be caps aware but the command still errored with a syntax when I put in all those caps.

Just to clarify, the command string begins with "sc create" not "cs"?

I mentioned another user where this did not work - after posting in the HijackThis forum, it appears he's infected with a Vundo variant which can prevent creation of the Ad-Aware service. If you want to explore that option, there's instructions in my signature.

[Thelemming]

The 'cs create' was a mistype was 'sc create'. I read the post over at HijackThis forum, and did all that except the scan with ad-ware as that's the problem (no connect, will not run). Should I just post all I have and tell about why the other was not done? the Hijack log has no mention of the 'Vundo variant'

Edited by Thelemming, 15 October 2009 - 02:33 AM.

[visitor]

I read the post over at HijackThis forum, and did all that except the scan with ad-ware as that's the problem (no connect, will not run). Should I just post all I have and tell about why the other was not done? the Hijack log has no mention of the 'Vundo variant'

Yes, go ahead and post the HijackThis log in that forum and reference this thread. You don't necessarily have the same infection as the other user - the security advisor helping in that case mentioned that Vundo prevents the Ad-Aware service and cannot be cleaned by HijackThis.

[visitor]

Now that you've posted in the HJT forum, I'll close this thread. If the problem persists after you're done there, PM me or another moderator if you need this reopened.

[LS CalamityJane]

Re-opening this topic. The HijackThis log did not show any signs of malware infection.
See my reply to his log here:
http://www.lavasofts...showtopic=27374

[visitor]

sc create AAWService binpath= c:\progra~1\lavasoft\ad-aware\aawser~1.exe displayname= "Lavasoft Ad-Aware"

Doing this created a line that after I rebooted would not start, and when I looked into services.msc and tried to manually start, it produced a error 3: can not find path, guess I can just delete it, wonder how can't delete from service.msc!

If you right-click/properties for the service, does it show the correct pathway?

"C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe"

Check the location of the Lavasoft Ad-Aware installation - if you did a customized installation to a different location, then the create service command needs to reflect the correct pathway.

[Thelemming]

Doing this created a line that after I rebooted would not start, and when I looked into services.msc and tried to manually start, it produced a error 3: can not find path, guess I can just delete it, wonder how can't delete from service.msc!
If you right-click/properties for the service, does it show the correct pathway?

No the path shows as "c:\program~1\lavasoft\ad-aware\aawser~1.exe", and will not let me edit to "C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe". When tried to create a service with the path of "C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe" I got a syntax error.

Check the location of the Lavasoft Ad-Aware installation - if you did a customized installation to a different location, then the create service command needs to reflect the correct pathway.

took the default installation!

Edited by Thelemming, 17 October 2009 - 03:14 AM.

[visitor]

Well you should delete the service since it's not working: sc delete AAWService

Both the syntax error and your point about needing caps for the cd command made me think - maybe the sc command is caps sensitive:

http://support.microsoft.com/kb/251192

binPath=(string)
Path name to the service binary file. There is no default for this parameter. This string must be supplied.

DisplayName=(string)
A string that can be used by user-interface programs to identify the service.

According to this MS link, the proper command would be:

sc create "Lavasoft Ad-Aware Service" binPath= C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe DisplayName= "Lavasoft Ad-Aware Service"

Note, on my system, Ad-Aware installed "Lavasoft Ad-Aware Service" (both the service name and display name are the same). This may be why the original command strings did not work. If the string above works, I'll make a note in the original posts.

[Thelemming]

Well you should delete the service since it's not working: sc delete AAWService

Both the syntax error and your point about needing caps for the cd command made me think - maybe the sc command is caps sensitive:

http://support.microsoft.com/kb/251192
According to this MS link, the proper command would be:

sc create "Lavasoft Ad-Aware Service" binPath= C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe DisplayName= "Lavasoft Ad-Aware Service"

Note, on my system, Ad-Aware installed "Lavasoft Ad-Aware Service" (both the service name and display name are the same). This may be why the original command strings did not work. If the string above works, I'll make a note in the original posts.

Well the delete command was correct. But (atleast on my system) the <sc create AAWService binPath= "C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe" DisplayName= "Lavasoft Ad-Aware Service"> worked; Note quotes around the binpath parameter

found oodag.exe which is a legal item part of my defragment utility for Windows. I marked as ignore guess I should send it to Lavasoft seams that I also marked it years ago maybe the clean uninstall removed that ignore and I did not think about it before.

I have not rebooted yet, wanted to complete the scan first then will post again if the service auto startes after the reboot.

[visitor]

found oodag.exe which is a legal item part of my defragment utility for Windows. I marked as ignore guess I should send it to Lavasoft.

You can submit to Lavasoft in the False Positives forum:

http://www.lavasofts...hp?showforum=93

[Thelemming]

You can submit to Lavasoft in the False Positives forum:

http://www.lavasofts...hp?showforum=93

Thanks go head and close the thread the full scan and reboot all went good; all went as it should ad-aware found nothing, the service started by it self, ad-aware even updated it self.

[visitor]

Glad you finally got it going!