Hi and Happy Thanksgiving everyone!

My computer was freezing during the scan, and so I read these posts. I did a scan on the web, as recommended by Calamady Jane. The scan found three spy programs by using the panda program. Am I supposed to buy their software to clean it in addition to Adaware, or will adaware clean if for me? Adaware did NOT find it, but here is the log. Calamady Jane said to post the log "here" but I'm not really sure where "here" is.


Incident Status Location

Spyware:Cookie/WebtrendsLive Not disinfected C:\WINDOWS\Temp\Cookies\kathe@statse.webtrendslive[1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Kathe\Cookies\kathe@com[1].txt
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Kathe\Cookies\kathe@www.burstbeacon[1].txt

Hi Agent 99,

Those three items are all cookies - harmless text files. Some cookies track your movement around a particular site - some track your movement around the web (tracking cookies).

You should do a regular clean-up of your system, as recommended bu LS CalamityJane:

A point to remember - some sites will not function without their cookie(s) being on your system - such as Internet Banking, for example, so that they can recognise you as a returning customer.

If you want greater control over those pesky tracking cookies (intrusive and annoying) look at my post in this thread for a download link and screen-shots of a small utility called CookieWall by analogX: Create a rule to allow cookies, Allow certain cookies

Regards,

Spike

Thanks so much! However, my computer still freezes during the scan. I purchased the pro version a long time ago, and have never once been able to run a scan on my computer.

Does the program allow you to stop the scan in the middle and at least get rid of the programs etc that it found during the first part of the scan? It's been very frustrating for me! My computer runs very slowly, and I know it probably has some spyware or something on it that is slowing it down...

Any additional help you can give me for solving the freezing problem is much appreciated!

Hi Agent 99,

Sorry to hear about your problems.

Try following the suggestions for the "Freezing Issue" in this thread: Unable to complete scan

Let us know how you get on,

Regards,

Spike

Thanks Spike,

I did a Cleanmgr
I did a disk defragmentation
I did a Check or Scan Disk
I did a start /run "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Aware.exe" /full +procnuke +immortal

(I have the pro/paid version)

As far as: * If you still have problems , cancel before the scan reaches the point of stalling -- for example, after 20 objects are detected. Click Cancel on your log file. Remove any objects you want and rescan. Again, stop the scan before it reaches the point of stalling and remove any additional objects. Then try a full scan without stopping it. This should work for you now.

am I supposed to babysit the machine while it does the scan? this takes hours, as far as I know! How do I know when it is going to stall? I don't really know that much about computers.

I bought the pro version because I thought it would correct the problem I was having with the free version, but it didn't.

How do I find out what the actual problem is because I'd really like to get it working.

By the way, I also uninstalled spybot to see if that would help, and it still doesn't work.

On more thing Spike,

Here is my log file from my last attempt. Perhaps you can see what it hanging it up?

d-Aware SE Build 1.06r1
Logfile Created on:Friday, November 24, 2006 7:48:44 PM
Using definitions file:Se1R134 20.11.2006
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
Ad-Aware SE Settings
===========================
Set : Search for low-risk threats
Set : Safe mode (always request confirmation)

Extended Ad-Aware SE Settings
===========================
Set : Ignore spanned files when scanning cab archives
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Block pop-ups aggressively
Set : Automatically select problematic objects in results lists
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Show splash screen
Set : Backup current definitions file before updating
Set : Play sound at scan completion if scan locates critical objects


11-24-06 7:48:44 PM - Scan started. (Full System Scan)

Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [KERNEL32.DLL]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4291773653
Threads : 9
Priority : High
FileVersion : 4.10.2222
ProductVersion : 4.10.2222
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Win32 Kernel core component
InternalName : KERNEL32
LegalCopyright : Copyright © Microsoft Corp. 1991-1999
OriginalFilename : KERNEL32.DLL

#:2 [MSGSRV32.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294934585
Threads : 1
Priority : Normal
FileVersion : 4.10.2222
ProductVersion : 4.10.2222
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows 32-bit VxD Message Server
InternalName : MSGSRV32
LegalCopyright : Copyright © Microsoft Corp. 1992-1998
OriginalFilename : MSGSRV32.EXE

#:3 [MPREXE.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294965161
Threads : 2
Priority : Normal
FileVersion : 4.10.1998
ProductVersion : 4.10.1998
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : WIN32 Network Interface Service Process
InternalName : MPREXE
LegalCopyright : Copyright © Microsoft Corp. 1993-1998
OriginalFilename : MPREXE.EXE

#:4 [MCSHLD9X.EXE]
FilePath : C:\PROGRAM FILES\MCAFEE.COM\VSO\
ProcessID : 4294958345
Threads : 5
Priority : Normal
FileVersion : 10, 0, 0, 20
ProductVersion : 10, 0, 0, 0
ProductName : McAfee VirusScan
CompanyName : McAfee, Inc.
FileDescription : McShield for Windows 9x
InternalName : McShld9x
LegalCopyright : Copyright © 2005 McAfee, Inc. All Rights Reserved.
OriginalFilename : McShld9x.exe
Comments : McShield for Windows 9x

#:5 [SPOOL32.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294880069
Threads : 2
Priority : Normal
FileVersion : 4.10.1998
ProductVersion : 4.10.1998
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler Sub System Process
InternalName : spool32
LegalCopyright : Copyright © Microsoft Corp. 1994 - 1998
OriginalFilename : spool32.exe

#:6 [mmtask.tsk]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294869045
Threads : 1
Priority : Normal
FileVersion : 4.03.1998
ProductVersion : 4.03.1998
ProductName : Microsoft Windows
CompanyName : Microsoft Corporation
FileDescription : Multimedia background task support module
InternalName : mmtask.tsk
LegalCopyright : Copyright © Microsoft Corp. 1991-1998
OriginalFilename : mmtask.tsk

#:7 [OASCLNT.EXE]
FilePath : C:\PROGRAM FILES\MCAFEE.COM\VSO\
ProcessID : 4294892965
Threads : 1
Priority : Normal
FileVersion : 10, 0, 0, 24
ProductVersion : 10, 0, 0, 0
ProductName : McAfee VirusScan
CompanyName : McAfee, Inc.
FileDescription : McAfee VirusScan OAS Client
InternalName : OasClnt
LegalCopyright : Copyright © 2005 McAfee, Inc. All Rights Reserved.
OriginalFilename : OasClnt.exe
Comments : McAfee VirusScan OAS Client

#:8 [EXPLORER.EXE]
FilePath : C:\WINDOWS\
ProcessID : 4294813881
Threads : 15
Priority : Normal
FileVersion : 4.72.3110.1
ProductVersion : 4.72.3110.1
ProductName : Microsoft® Windows NT® Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
LegalCopyright : Copyright © Microsoft Corp. 1981-1997
OriginalFilename : EXPLORER.EXE

#:9 [MCVSSHLD.EXE]
FilePath : C:\PROGRAM FILES\MCAFEE.COM\VSO\
ProcessID : 4294814129
Threads : 1
Priority : Normal
FileVersion : 10, 0, 0, 22
ProductVersion : 10, 0, 0, 0
ProductName : McAfee VirusScan
CompanyName : McAfee, Inc.
FileDescription : McAfee VirusScan ActiveShield Resource
InternalName : McVsShld
LegalCopyright : Copyright © 2005 McAfee, Inc. All Rights Reserved.
OriginalFilename : McVsShld.exe
Comments : McAfee VirusScan ActiveShield Resource

#:10 [MCVSESCN.EXE]
FilePath : C:\PROGRAM FILES\MCAFEE.COM\VSO\
ProcessID : 4294821217
Threads : 1
Priority : Normal
FileVersion : 10, 0, 0, 20
ProductVersion : 10, 0, 0, 0
ProductName : McAfee VirusScan
CompanyName : McAfee, Inc.
FileDescription : McAfee VirusScan E-mail Scan Module
InternalName : mcvsescn
LegalCopyright : Copyright © 2005 McAfee, Inc. All Rights Reserved.
OriginalFilename : mcvsescn.EXE
Comments : McAfee VirusScan E-mail Scan Module

#:11 [RPCSS.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294706801
Threads : 5
Priority : Normal
FileVersion : 4.71.3328
ProductVersion : 4.71.3328
ProductName : Microsoft® Windows NT™ Operating System
CompanyName : Microsoft Corporation
FileDescription : Distributed COM Services
InternalName : rpcss.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1998
OriginalFilename : rpcss.exe

#:12 [MCAGENT.EXE]
FilePath : C:\PROGRAM FILES\MCAFEE.COM\AGENT\
ProcessID : 4294648025
Threads : 1
Priority : Normal
FileVersion : 6, 0, 0, 16
ProductVersion : 6, 0, 0, 0
ProductName : McAfee SecurityCenter
CompanyName : McAfee, Inc
FileDescription : McAfee SecurityCenter Agent
InternalName : mcagent
LegalCopyright : Copyright © 2005 McAfee, Inc.
OriginalFilename : mcagent.exe

#:13 [USBMONIT.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294678897
Threads : 1
Priority : Normal
FileVersion : 2, 2, 0, 0
ProductVersion : 2, 2, 0, 0
ProductName : Gene USB Monitor
CompanyName : General
FileDescription : Gene USB Monitor
InternalName : USBMonitor
LegalCopyright : Copyright © 2000-2004
OriginalFilename : USBMonit.exe

#:14 [MCTSKSHD.EXE]
FilePath : C:\PROGRAM FILES\MCAFEE.COM\AGENT\
ProcessID : 4294694981
Threads : 1
Priority : Normal
FileVersion : 6, 0, 0, 13
ProductVersion : 6, 0, 0, 0
ProductName : McAfee SecurityCenter
CompanyName : McAfee, Inc
FileDescription : McAfee Task Scheduler
InternalName : McTskshd
LegalCopyright : Copyright © 2005 McAfee, Inc.
OriginalFilename : McTskshd.exe

#:15 [MPFTRAY.EXE]
FilePath : C:\PROGRAM FILES\MCAFEE.COM\PERSONAL FIREWALL\
ProcessID : 4294587501
Threads : 7
Priority : Normal
FileVersion : 7.1.0.113
ProductVersion : 7.1.0.113
ProductName : McAfee Personal Firewall (MPF)
CompanyName : McAfee Security
FileDescription : McAfee Personal Firewall Tray Monitor
InternalName : MpfTray
LegalCopyright : Copyright © 2005 McAfee, Inc. All Rights Reserved.
OriginalFilename : MPFTRAY.EXE
Comments : Tray Icon for McAfee Personal Firewall

#:16 [MPFAGENT.EXE]
FilePath : C:\PROGRAM FILES\MCAFEE.COM\PERSONAL FIREWALL\
ProcessID : 4294526137
Threads : 2
Priority : Normal
FileVersion : 7.1.0.113
ProductVersion : 7.1.0.113
ProductName : McAfee Personal Firewall (MPF)
CompanyName : McAfee Security
FileDescription : McAfee Personal Firewall Agent Interface
InternalName : MpfAgent
LegalCopyright : Copyright © 2005 McAfee, Inc. All Rights Reserved.
OriginalFilename : MPFAGENT.EXE
Comments : McAfee Personal Firewall Security Center Module

#:17 [AD-AWARE.EXE]
FilePath : C:\PROGRAM FILES\LAVASOFT\AD-AWARE SE PROFESSIONAL\
ProcessID : 4294507561
Threads : 3
Priority : Normal
FileVersion : 6.2.0.238
ProductVersion : SE 106
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft AB Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 0


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hi-Wire Object Recognized!
Type : Regkey
Data :
TAC Rating : 4
Category : Misc
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\code store database\distribution units\{28f00b0f-dc4e-11d3-abec-005004a44eeb}

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 1
Objects found so far: 1


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 1


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


Tracking Cookie Object Recognized!
Type : IECache Entry
Data : kathe@overture[1].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:7
Value : Cookie:kathe@overture.com/
Expires : 3-31-16 1:45:30 PM
LastSync : Hits:7
UseCount : 0
Hits : 7

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : kathe@questionmarket[1].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:8
Value : Cookie:kathe@questionmarket.com/
Expires : 6-26-07 7:12:58 AM
LastSync : Hits:8
UseCount : 0
Hits : 8

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : paul@doubleclick[1].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:7
Value : Cookie:paul@doubleclick.net/
Expires : 11-22-09 10:47:34 AM
LastSync : Hits:7
UseCount : 0
Hits : 7

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : kathe@centrport[1].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:19
Value : Cookie:kathe@centrport.net/
Expires : 12-31-29 4:00:00 PM
LastSync : Hits:19
UseCount : 0
Hits : 19

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : paul@atdmt[2].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:3
Value : Cookie:paul@atdmt.com/
Expires : 11-21-11 4:00:00 PM
LastSync : Hits:3
UseCount : 0
Hits : 3

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : paul@questionmarket[1].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:11
Value : Cookie:paul@questionmarket.com/
Expires : 1-15-08 11:22:02 AM
LastSync : Hits:11
UseCount : 0
Hits : 11

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : paul@overture[1].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:1
Value : Cookie:paul@overture.com/
Expires : 10-19-16 5:42:08 PM
LastSync : Hits:1
UseCount : 0
Hits : 1

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : kathe@ads.addynamix[2].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:3
Value : Cookie:kathe@ads.addynamix.com/
Expires : 3-7-06 2:29:28 PM
LastSync : Hits:3
UseCount : 0
Hits : 3

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : paul@ads.pointroll[2].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:6
Value : Cookie:paul@ads.pointroll.com/
Expires : 12-31-09 4:00:00 PM
LastSync : Hits:6
UseCount : 0
Hits : 6

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : paul@citi.bridgetrack[1].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:7
Value : Cookie:paul@citi.bridgetrack.com/
Expires : 10-16-07 8:00:00 PM
LastSync : Hits:7
UseCount : 0
Hits : 7

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : kathe@edge.ru4[2].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:8
Value : Cookie:kathe@edge.ru4.com/
Expires : 7-19-35 10:02:06 AM
LastSync : Hits:8
UseCount : 0
Hits : 8

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : kathe@realmedia[2].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:19
Value : Cookie:kathe@realmedia.com/
Expires : 12-31-20 3:59:58 PM
LastSync : Hits:19
UseCount : 0
Hits : 19

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : kathe@serving-sys[2].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:4
Value : Cookie:kathe@serving-sys.com/
Expires : 12-31-37 2:00:00 PM
LastSync : Hits:4
UseCount : 0
Hits : 4

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : kathe@2o7[3].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:236
Value : Cookie:kathe@2o7.net/
Expires : 8-3-11 8:16:08 PM
LastSync : Hits:236
UseCount : 0
Hits : 236

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : kathe@citi.bridgetrack[1].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:13
Value : Cookie:kathe@citi.bridgetrack.com/
Expires : 3-29-07 9:00:00 PM
LastSync : Hits:13
UseCount : 0
Hits : 13

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : kathe@trafficmp[1].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:1
Value : Cookie:kathe@trafficmp.com/
Expires : 5-5-07 2:54:52 PM
LastSync : Hits:1
UseCount : 0
Hits : 1

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : paul@2o7[2].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:51
Value : Cookie:paul@2o7.net/
Expires : 11-22-11 10:47:52 AM
LastSync : Hits:51
UseCount : 0
Hits : 51

Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 17
Objects found so far: 18



Deep scanning and examining files (c:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : paul@atdmt[2].txt
TAC Rating : 3
Category : Data Miner
Comment :
Value : c:\windows\Cookies\paul@atdmt[2].txt

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : paul@ads.pointroll[2].txt
TAC Rating : 3
Category : Data Miner
Comment :
Value : c:\windows\Cookies\paul@ads.pointroll[2].txt

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : paul@doubleclick[1].txt
TAC Rating : 3
Category : Data Miner
Comment :
Value : c:\windows\Cookies\paul@doubleclick[1].txt

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : paul@2o7[2].txt
TAC Rating : 3
Category : Data Miner
Comment :
Value : c:\windows\Cookies\paul@2o7[2].txt

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : paul@questionmarket[1].txt
TAC Rating : 3
Category : Data Miner
Comment :
Value : c:\windows\Cookies\paul@questionmarket[1].txt

Disk Scan Result for c:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 23


Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
<STOP>

Hi Agent 99, My scans take about 15 to 20 mins (and yes, I have a lot of files )

Try cancelling the scan after each 5 or 10 objects are found - unless it really does take hours..

Not an expert log reader - all that I (a novice) can see is:

"Hi-Wire Object Recognized!
Type : Regkey
Data :
TAC Rating : 4
Category : Misc
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\code store database\distribution units\{28f00b0f-dc4e-11d3-abec-005004a44eeb}"

I am a General Volunteer Advisor, so I don't know how dangerous that is. Has a TAC rating of 4 ( on a scale of 1-10), but it may be the cause of you problems.

I would suggest 2 or 3 of the online scanners (different programs pick up different items). See this excellent list from miekiemoes - (note the fine -print under some of the online-scanners - the freeware versions will pick up infections, but not all will clean them).

http://users.telenet.be/bluepatchy/miekiemoes/Links.html

Advise if anything is detected/cleaned,

Regards,

Spike

The detected CLSID for HiWire is identified as adware so may not be detected by the antivirus software in miekiemoes great list. I suggest you first scan with Ad-Aware SE in safe mode, removing all that is found.

1. If the computer is running, shut down Windows, and then turn off the power.
2. Wait 30 seconds, and then turn the computer on.
3. Start tapping the F8 key. The Windows Advanced Options Menu will appear. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
4. Ensure that the Safe Mode option is selected.
5. Press Enter. The computer then begins to start in Safe Mode.
6. Login on your usual account.

If you need further assistance with Safe Mode, see Symantec

Once you restart in normal mode, consider running ATF Cleaner:

Download ATF Cleaner by Atribune from http://www.atribune.org/public-beta/ATF-Cleaner.exe . Save it to your Desktop.

To run ATF Cleaner

1. Double-click ATF-Cleaner.exe to run the program.
2. Click Select All found at the bottom of the list.
3. Click the Empty Selected button.
4. Click Exit on the Main menu to close the program.

Following that, scan with Ad-Aware SE again and see how you make out.