HI!

My Ad-Aware SE Plus is up to date, and when it hits around 2013 files scanned it stalls, and sits there, and never moves.

What is recommended to get it going again?
I wanted to make sure that all the junk waas clean from my machine after the yukky day my poor computer had:

I have some sort of infection that my spysweeper keeps picking up, My browser can not be hijacked!
This is what is being found 6 -7 times a day.
9:23 PM: The Spy Communication shield has blocked access to: SMART-SECURITY.BIZ
9:23 PM: The Spy Communication shield has blocked access to: HERE4SEARCH.BIZ

and I ran into a nasty website this evening that zapped me with a few spywares and possibly a virus.
This is order that they arrived;
Adware.Purityscan
Adware.MaxSearch
Downloader
WinFixer

My Nortons deleted and/or repaired files and registry. When I run HT there is only 1 thing that looks weird, just at a quick view is this:
O16 - DPF: {00000000-0000-0000-0000-100005000004} - http://code.jcash.biz/l/cbb494d3ae0b3445a3...b791529a_13.exe

That's it till I get my ad-aware going again...
thanks in advance for the help!
Mistress

Most likely the reason your scan is stopping is due to the Ad-Aware and Spysweeper conflict that is currently going on.

Temporarily disable your spysweeper and try your scan again. Let us know if that worked.

Another member here has found another way around the conflict without totally disabling the spysweeper. Here is the link with the instructions if you are interested. http://www.lavasoftsupport.com/index.php?s...ic=2128&hl=

Another cause of the freeze could actually be from the infection you talked about.

Try the temporary disabling first to see if that works, if not, it would be a good idea to post a hjt log in the hjt forum section in this forum.

Hi again!
Thanks for the work-around. That did the trick. Ad-aware now works properely!
So today I spent the whole afternoon cleaning all the crap out of my machine, and wouldn't you know...
the very 1st time opening up my browser ... BAM ... PurityScan again
Ran Nortons AV, adaware and now ewdo, so much for that
I tried to get a log from HT, but when I click save log, the program just closes down without a log.

The thing I don't get is with all the protection that I have, why is it that something gets thru in the 1st place? That shouldn't happen, should it? I keep up to date with updates of all my proggies, I run scans every day, I have a firewall too...
What am I not doing? <sigh>

So I am taking a break while this runs, and I will run a full systen scan with Nortons, over night, again...
I did want to post all the crap that has passed thru in the past 24 hours:

"C:\WINDOWS\Downloaded Program Files\USYP_0001_N85M2606NetInstaller.exe"
=====
winantivirus.com site opens auto

** HKLM\software\microsoft\mssmgr\
** HKLM\software\sysprotect free
2:27 PM: Quarantining All Traces: sysprotect
2:27 PM: Quarantining All Traces: sysprotect
2:27 PM: Quarantining All Traces: trojan agent winlogonhook
=====
--------------
Variant 31: - CWS.Msconfig

When all this is done, again, I will reinstall my HT and try and run a log. I am also going to search mt "C" drive to see if it made a new home for itself LOL!

Hey.. Thanks again!

Hello.
I found the same problem on my machine the last two days. That is, Adaware SE plus scan stopping or freezing in the middle of the scan. I discovered by myself that it is, indeed, a conflict with the latest version of my Spysweeper. I solved the problem by turning off Spysweeper when I run Adaware.

Hi Mistress

hmmm I have never personally come across anyone who could not get their log from hjt due to a shut down. I will have to ask some of my malware removal experts for advice on that one.

Do you have the latest HJT build?

I am assuming you have used hjt before? So you know how it works, correct?

If not, I will go ahead and give you my hjt tutorial with the link to the latest version of HJT. Also it has a link to the right forum section here at Lavasoft forums to post your hjt log.

Start your own thread, stating what problem you are having in the subject line. If you know the name of what you are infected with.

Please be patient, as there are alot of hjt logs that need to be read, and not all of the ppl here who try to help, such as myself are trained in reading hjt logs. And you need someone trained in that, who is a malware removal expert to help you. They will get to your log as soon as they get a chance.

Download HijackThis.exe To your desk top.


Now Click start then my computer, then local disk Which is usually c:/
Now click file > new folder > name it hijackthis or hjt anything you like;)
You should get this.


Now right click on HijackThis.exe which you just downloaded.
It will look like this chose cut
Open the folder right click and chose paste.


After which you should get some thing like this.



Now start hijackthis. Do a system scan and save logfile, the saved the log file
will be in the folder you just created. Open the file click edit then select all click edit again then copy.
Return to the forum and start a new topic here then click edit then paste.

Now the fun begins.
Tutorial written by Little Eagle of Security Central and Revised by SkittlesPC

In regards to how you got infected. This info provided by Tony Klien might be useful to you.
http://www.forums.security-central.us/showthread.php?t=321

Some other good advice in addition to keeping up with the updates and scans is to periodically run a Web-Based anti-virus scan. Such as these two.

Panda ActiveScan
eTrust AntiVirus Web Scanner

I also had the problem of the interaction between SpySweeper and Ad-Aware. Disabling SpySweeper did the trick for me. Thanks for the tip which saved me hours of sleuthing. Let us hope that Lavasoft comes up with a permanent fix.

HLF

HLF,

The problem is not Lavasoft, but in Webroot's latest version of Spysweeper - They were notified quite a while ago, and replied that they are working on it

Spike

Yes and Yes! I uninstalled and reinstalled my HJT and it's now giving a log file. I will post it in a new window.
Now, for the continuing adventures of...
Last night I tried a new program that I have seen around but never had tried it. It's called XoftSpy.
That little program found stuff that not 1 of my other programs found. I ran it over night last night.
This is what it found:
Starting to Quarantine 11 Items
FunWebProducts
IBIS/Hunt Toolbar
Medload
CWS.Homepage
Yazzle Cowabanga
Trojan/CWS Combo
Iopus Starr Pro Key Logger
statcounter cookie
================
I thought that all was well untill I rebooted, and the very 1st website that I hit, one of my programs blocked access to SMART-SECURITY.BIZ and HERE4SEARCH.BIZ over and over, 3-4 times each,
each time.
I then new my day once again was shot
I went into safe mode and ran Spybot S&D, it found a few more items, then the STUFF hit the fan
I clicked "fix".

Almost forgot this..
While I was in safe mode I adjusted Ad-watch.
I rebooted xp in normal mode. ad-watch started going nutz!!!
This is just a piece of the file below. I don't know if what I did in S&D?! Fix something in xp or I made things worse.
I WAS able to boot, so far (fingers xxxed) I am on line and on my IE and NO weird messages,
my desktop looked a bit different from before I did the safe mode, so I know some things corrected
themselves, I feel like I am navigating faster too.
anyway here is a partail log from ad-watch:
OH BTW I unclicked ad-watch as it is still trying to change my machine HELP!
Do I accept this or reject it??? Right now I am rejecting everything!!!!!!! HELP! shoot dernit why did I open it?

7/29/2006 5:10:30 PM> Registry modification detected
7/29/2006 5:10:30 PM>
7/29/2006 5:10:30 PM> Root:HKEY_LOCAL_MACHINE
7/29/2006 5:10:30 PM> Key:Software\Microsoft\Windows\CurrentVersion\Policies\System
7/29/2006 5:10:30 PM> Value:DisableTaskMgr
7/29/2006 5:10:30 PM> Data:
7/29/2006 5:10:30 PM> New Data:0
7/29/2006 5:10:30 PM>
7/29/2006 5:10:42 PM> Registry modification detected
7/29/2006 5:10:42 PM>
7/29/2006 5:10:42 PM> Root:HKEY_CURRENT_USER
7/29/2006 5:10:42 PM> Key:Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
7/29/2006 5:10:42 PM> Value:NoActiveDesktop
7/29/2006 5:10:42 PM> Data:
7/29/2006 5:10:42 PM> New Data:0
7/29/2006 5:10:42 PM>
7/29/2006 5:10:49 PM> Registry modification detected
7/29/2006 5:10:49 PM>
7/29/2006 5:10:49 PM> Root:HKEY_LOCAL_MACHINE
7/29/2006 5:10:49 PM> Key:Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
7/29/2006 5:10:49 PM> Value:NoSetHomePage
7/29/2006 5:10:49 PM> Data:
7/29/2006 5:10:49 PM> New Data:1
7/29/2006 5:10:49 PM>
7/29/2006 5:11:28 PM> Registry modification detected
7/29/2006 5:11:28 PM>
7/29/2006 5:11:28 PM> Root:HKEY_LOCAL_MACHINE
7/29/2006 5:11:28 PM> Key:Software\Microsoft\Windows\CurrentVersion\Run
7/29/2006 5:11:28 PM> Value:SpySweeper
7/29/2006 5:11:28 PM> Data:
7/29/2006 5:11:28 PM> New Data:"C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
7/29/2006 5:11:28 PM>
7/29/2006 5:11:31 PM> Registry modification detected
7/29/2006 5:11:31 PM>
7/29/2006 5:11:31 PM> Root:HKEY_CURRENT_USER
7/29/2006 5:11:31 PM> Key:Software\Microsoft\Windows\CurrentVersion\RunOnce
7/29/2006 5:11:31 PM> Value:The Bat!
7/29/2006 5:11:31 PM> Data:C:\Program Files\The Bat!\thebat.exe
7/29/2006 5:11:31 PM> New Data:
7/29/2006 5:11:31 PM>
7/29/2006 5:11:38 PM> Registry modification detected
7/29/2006 5:11:38 PM>
7/29/2006 5:11:38 PM> Root:HKEY_LOCAL_MACHINE
7/29/2006 5:11:38 PM> Key:Software\Microsoft\Windows\CurrentVersion\Run
7/29/2006 5:11:38 PM> Value:Symantec NetDriver Monitor
7/29/2006 5:11:38 PM> Data:C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
7/29/2006 5:11:38 PM> New Data:
7/29/2006 5:11:38 PM>
7/29/2006 5:11:44 PM> Registry modification detected

AND IT CONTINUES!

I will post my HJT in a new window. Thanks again all!

You are welcome!

About XoftSpy. I am not sure I would personally want that on my computer. At one time it was on the Rogue/Suspect Anti-Spyware list from Spyware Warrior.

http://www.spywarewarrior.com/rogue_anti-spyware.htm

It has since been removed from the list (De-Listed) since they cleared up the main issues that put them on the list in the first place. At one point they were changing names alot, as well from what I understood.

Now hearing your experience makes me wonder even more about them and their product, altho your problems could have been caused by the infection that is apparent that you already had before downloading XoftSpy, altho it seems suspicious to me that it might have added to your problems. I don't know. But it has caused me to research it and check it out. You can never learn too much when it comes to protecting your computer.

Thanks SkittlesPC, I will 4 sure do more digging. I think I found it on a well know site.
At this point I dont remember.
I wanted to let you know 2 things...so far, noone has looked at the HJT log that I posted, along with the ad-watch log,
that is STILL going to make my hair greyer than I already am. LOL It is asking me to accept or block the changes that I
made in S&D, and I don't know what to do! HELP!!!
And the other thing is that I am STILL am getting this:
9:05 AM: The Spy Communication shield has blocked access to: SMART-SECURITY.BIZ
9:05 AM: The Spy Communication shield has blocked access to: HERE4SEARCH.BIZ
9:05 AM: The Spy Communication shield has blocked access to: HERE4SEARCH.BIZ
9:05 AM: The Spy Communication shield has blocked access to: SMART-SECURITY.BIZ
For the life of my I don't know where it came from or how to remove it!
thanks! again! LOL

OKOK - - Here ya go! PC World's Review
If it's good enough there it's good enough 4 me
The must have changed their attitudes!

About your HJT log.

Not everyone who posts here are Malware Removal Experts. I am studying to become one, but so far I am not yet qualified to read hjt logs and give advice.

They are a bit backlogged here, so it might take a little while before they can get to it. I am sure someone will get to it as soon as they get a chance.

Hi. SkittlesPC asked me to stop by and take and see if I could help with your Ad-Watch question. Sorry I didn't make it yesterday.


Ad-Watch isn't trying to change your machine. Rather, you have asked Ad-Watch to monitor registry changes. That is what Ad-Watch is doing, telling you that a software wants to make a change to the registry.

So, what do you do when getting such a prompt? It depends on what is happening at the time. Let's take a look at one of the log entries:

7/29/2006 5:10:30 PM> Registry modification detected
7/29/2006 5:10:30 PM>
7/29/2006 5:10:30 PM> Root:HKEY_LOCAL_MACHINE
7/29/2006 5:10:30 PM> Key:Software\Microsoft\Windows\CurrentVersion\Policies\System
7/29/2006 5:10:30 PM> Value:DisableTaskMgr
7/29/2006 5:10:30 PM> Data:
7/29/2006 5:10:30 PM> New Data:0

Ad watch detected a registry change.
The location was shown.
The change was to disable task manager
I believe the "new data 0" means that you denied the change.
Good job!

Personally, I have Ad-Watch set to block all options listed and have Ad-Watch set to "Active" (but NOT automatic). That way, if something is making a change to the registry or startup list, it darn well better be a software I'm installing or updating and then I'll allow the changes. (Yes, sometimes it involves a few clicks.) If I'm not installing or updating, I'll be taking a very close look at what is being requested and would most likely be denying the change.

Does that help?

BTW, now that you can run Ad-Aware SE Plus again, why not post an updated full system scan for review and we'll take a look.