Help - Search - Members - Calendar
Full Version: Win32/AdInstaller Application
Lavasoft Support Forums > Archived Topics > Archives: Resolved/Inactive Topics > AAW Anniversary Edition - Resolved/Inactive
arkansasracer
I have a problem reported by NOD32 Antivirus during an Ad-Aware Scan

Ad-Aware definitions: 0149.0032
Ad-Watch Live Real Time Protection OFF
Ad-Aware Anti-Virus engine unticked

During a Full Scan using Ad-Aware AE, the NOD32 Antivirus reports the following threat:

File: c:\windows\temp\fe.tmp
Threat: a variant of Win32/AdInstaller Application
Comment: event occurred on a file modified by the application c:\program files\lavasoft\Ad-Aware\AAWService.exe

I assume this is some sort of incompatibility problem ?

visitor
It sounds like Ad-aware is trying to delete/quarantine the file during scan, and NOD32 is warning you of the change. Not necessarily a conflict - have you tried deleting the .tmp file? Most can be deleted safely. AFAIK, it's not an Ad-aware file - I don't have such a file in my temp folder. I'd be wary though, you might have picked up an infection since your security programs are going off.
arkansasracer
Thanks for your reply

I have isolated the problem as follows:

The NOD32 Alert is triggered when Ad-Aware tries to scan the c:\program files\eset folder (the home of NOD32)
The Ad-Aware scan log shows that Ad-Aware found the Win32/AdInstaller in the NOD32 quarantine file - I was able to confirm this using NOD32
I then deleted the quarantined files from NOD32

After doing this a new Ad-Aware scan worked successfully without any NOD32 Alerts

I am not sure why this has just happened now (its never happened before) - Ad-Aware must have changed something in their scanning program
visitor
QUOTE(arkansasracer @ Aug 21 2009, 02:11 AM) *
I am not sure why this has just happened now (its never happened before) - Ad-Aware must have changed something in their scanning program

Or it may have been a definition update. Ad-aware also picked up items in Malwarebytes quarantine, but the symptom was Malwarebytes would scan clean whereas Ad-aware kept finding the infection:

http://www.lavasoftsupport.com/index.php?showtopic=26639

FYI, rather than delete the quarantined item in NOD32, you can also ignore/allow the item in Ad-aware. That way if NOD32 picks up a false positive, and it's really a necessary file, you can still retrieve it from quarantine. Recently, Ad-aware picked up a false positive and the users could no longer boot up their laptops. Retrieving from quarantine is much easier than finding/replacing a system file wink.gif
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2009 Invision Power Services, Inc.