strange things like adware -spware

fire_mat99fire_mat99
edited June 2004 in Hardware
Hi all computer problem with Windows98 I did adare check found some strange things like adware -spware and other stuff I will post long can someone tell me what to do.And does this have any thing to do with my computer freezes for 5 seconds



Lavasoft Ad-aware Personal Build 6.181
Logfile created on :June 8, 2004 3:14:00 AM
Created with Ad-aware Personal, free for private use.
Using reference-file :01R256 09.02.2004
______________________________________________________

Ad-aware Settings
=========================
Set : Activate in-depth scan (Recommended)
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file


08-06-04 3:14:00 AM - Scan started. (Smart mode)

Listing running processes
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

#:1 [kernel32.dll]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4293876555
Threads : 4
Priority : High
FileSize : 460 KB
FileVersion : 4.10.2222
ProductVersion : 4.10.2222
Copyright : Copyright (C) Microsoft Corp. 1991-1999
CompanyName : Microsoft Corporation
FileDescription : Win32 Kernel core component
InternalName : KERNEL32
OriginalFilename : KERNEL32.DLL
ProductName : Microsoft(R) Windows(R) Operating System
Created on : 01/01/01
Last accessed : 08/06/04 4:00:00 AM
Last modified : 24/04/99 2:22:00 AM

#:2 [msgsrv32.exe]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294937855
Threads : 1
Priority : Normal
FileSize : 11 KB
FileVersion : 4.10.2222
ProductVersion : 4.10.2222
Copyright : Copyright (C) Microsoft Corp. 1992-1998
CompanyName : Microsoft Corporation
FileDescription : Windows 32-bit VxD Message Server
InternalName : MSGSRV32
OriginalFilename : MSGSRV32.EXE
ProductName : Microsoft(R) Windows(R) Operating System
Created on : 01/01/01
Last accessed : 08/06/04 4:00:00 AM
Last modified : 24/04/99 2:22:00 AM

#:3 [mprexe.exe]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294941295
Threads : 1
Priority : Normal
FileSize : 28 KB
FileVersion : 4.10.1998
ProductVersion : 4.10.1998
Copyright : Copyright (C) Microsoft Corp. 1993-1998
CompanyName : Microsoft Corporation
FileDescription : WIN32 Network Interface Service Process
InternalName : MPREXE
OriginalFilename : MPREXE.EXE
ProductName : Microsoft(R) Windows(R) Operating System
Created on : 01/01/01
Last accessed : 08/06/04 4:00:00 AM
Last modified : 24/04/99 2:22:00 AM

#:4 [mmtask.tsk]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294849875
Threads : 1
Priority : Normal
FileSize : 1 KB
FileVersion : 4.03.1998
ProductVersion : 4.03.1998
Copyright : Copyright
CompanyName : Microsoft Corporation
FileDescription : Multimedia background task support module
InternalName : mmtask.tsk
OriginalFilename : mmtask.tsk
ProductName : Microsoft Windows
Created on : 01/01/01
Last accessed : 08/06/04 4:00:00 AM
Last modified : 24/04/99 2:22:00 AM

#:5 [vsmon.exe]
FilePath : C:\WINDOWS\SYSTEM\ZONELABS\
ProcessID : 4294838671
Threads : 16
Priority : Normal
FileSize : 805 KB
FileVersion : 4.5.594.000
ProductVersion : 4.5.594.000
Copyright : Copyright
CompanyName : Zone Labs Inc.
FileDescription : TrueVector Service
InternalName : vsmon
OriginalFilename : vsmon.exe
ProductName : TrueVector Service
Created on : 09/05/04 5:49:06 AM
Last accessed : 08/06/04 4:00:00 AM
Last modified : 01/04/04 1:29:14 PM

#:6 [explorer.exe]
FilePath : C:\WINDOWS\
ProcessID : 4294855779
Threads : 7
Priority : Normal
FileSize : 176 KB
FileVersion : 4.72.3110.1
ProductVersion : 4.72.3110.1
Copyright : Copyright (C) Microsoft Corp. 1981-1997
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
OriginalFilename : EXPLORER.EXE
ProductName : Microsoft(R) Windows NT(R) Operating System
Created on : 24/04/99 2:22:00 AM
Last accessed : 08/06/04 4:00:00 AM
Last modified : 24/04/99 2:22:00 AM

#:7 [taskmon.exe]
FilePath : C:\WINDOWS\
ProcessID : 4294801663
Threads : 1
Priority : Normal
FileSize : 28 KB
FileVersion : 4.10.1998
ProductVersion : 4.10.1998
Copyright : Copyright (C) Microsoft Corp. 1998
CompanyName : Microsoft Corporation
FileDescription : Task Monitor
InternalName : TaskMon
OriginalFilename : TASKMON.EXE
ProductName : Microsoft(R) Windows(R) Operating System
Created on : 01/01/01
Last accessed : 08/06/04 4:00:00 AM
Last modified : 24/04/99 2:22:00 AM

#:8 [spool32.exe]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294655599
Threads : 2
Priority : Normal
FileSize : 44 KB
FileVersion : 4.10.1998
ProductVersion : 4.10.1998
Copyright : Copyright (C) Microsoft Corp. 1994 - 1998
CompanyName : Microsoft Corporation
FileDescription : Spooler Sub System Process
InternalName : spool32
OriginalFilename : spool32.exe
ProductName : Microsoft(R) Windows(R) Operating System
Created on : 01/01/01
Last accessed : 08/06/04 4:00:00 AM
Last modified : 24/04/99 2:22:00 AM

#:9 [wmiexe.exe]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294642559
Threads : 2
Priority : Normal
FileSize : 16 KB
FileVersion : 5.00.1755.1
ProductVersion : 5.00.1755.1
Copyright : Copyright (C) Microsoft Corp. 1981-1998
CompanyName : Microsoft Corporation
FileDescription : WMI service exe housing
InternalName : wmiexe
OriginalFilename : wmiexe.exe
ProductName : Microsoft(R) Windows NT(R) Operating System
Created on : 01/01/01
Last accessed : 08/06/04 4:00:00 AM
Last modified : 24/04/99 2:22:00 AM

#:10 [ddhelp.exe]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294515071
Threads : 2
Priority : Realtime
FileSize : 32 KB
FileVersion : 4.09.00.0900
ProductVersion : 4.09.00.0900
Copyright : Copyright
CompanyName : Microsoft Corporation
FileDescription : Microsoft DirectX Helper
InternalName : DDHelp.exe
OriginalFilename : DDHelp.exe
ProductName : Microsoft
Created on : 22/12/03 12:37:01 AM
Last accessed : 08/06/04 4:00:00 AM
Last modified : 12/12/02 4:14:32 AM

#:11 [internat.exe]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4293000419
Threads : 1
Priority : Normal
FileSize : 39 KB
FileVersion : 4.80.3008.1
ProductVersion : 4.80.3008.1
Copyright : Copyright (C) Microsoft Corp. 1981-1999
CompanyName : Microsoft Corporation
FileDescription : Internat
InternalName : Internat - exe
OriginalFilename : INTERNAT.EXE
ProductName : Microsoft(R) Windows NT(R) Operating System
Created on : 22/12/03 12:29:49 AM
Last accessed : 08/06/04 4:00:00 AM
Last modified : 22/12/03 12:29:50 AM

#:12 [zlclient.exe]
FilePath : C:\PROGRAM FILES\ZONE LABS\ZONEALARM\
ProcessID : 4294488859
Threads : 6
Priority : Normal
FileSize : 677 KB
FileVersion : 4.5.594.000
ProductVersion : 4.5.594.000
Copyright : Copyright
CompanyName : Zone Labs Inc.
FileDescription : Zone Labs Client
InternalName : zlclient
OriginalFilename : zlclient.exe
ProductName : Zone Labs Client
Created on : 09/05/04 5:49:09 AM
Last accessed : 08/06/04 4:00:00 AM
Last modified : 01/04/04 1:30:04 PM

#:13 [pstores.exe]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294573559
Threads : 3
Priority : Normal
FileSize : 79 KB
FileVersion : 5.00.1877.3
ProductVersion : 5.00.1877.3
Copyright : Copyright (C) Microsoft Corp. 1981-1998
CompanyName : Microsoft Corporation
FileDescription : Protected storage server
InternalName : Protected storage server
OriginalFilename : Protected storage server
ProductName : Microsoft(R) Windows NT(R) Operating System
Created on : 01/01/01
Last accessed : 08/06/04 4:00:00 AM
Last modified : 24/04/99 2:22:00 AM

#:14 [ad-aware.exe]
FilePath : C:\PROGRAM FILES\LAVASOFT\AD-AWARE 6\
ProcessID : 4292975107
Threads : 2
Priority : Normal
FileSize : 668 KB
FileVersion : 6.0.1.181
ProductVersion : 6.0.0.0
Copyright : Copyright
CompanyName : Lavasoft Sweden
FileDescription : Ad-aware 6 core application
InternalName : Ad-aware.exe
OriginalFilename : Ad-aware.exe
ProductName : Lavasoft Ad-aware Plus
Created on : 13/02/04 5:03:33 PM
Last accessed : 08/06/04 4:00:00 AM
Last modified : 13/07/03 2:00:20 AM

Memory scan result :
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 0
Objects found so far: 0


Started registry scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Alexa Object recognized!
Type : RegKey
Data :
Rootkey : HKEY_LOCAL_MACHINE
Object : SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}


CoolWebSearch Object recognized!
Type : RegKey
Data :
Rootkey : HKEY_CLASSES_ROOT
Object : toolband.toolbandobj.1


CoolWebSearch Object recognized!
Type : RegKey
Data :
Rootkey : HKEY_CLASSES_ROOT
Object : toolband.toolbandobj


ZeroPopUp Object recognized!
Type : RegKey
Data :
Rootkey : HKEY_CLASSES_ROOT
Object : Interface\{95B92D92-8B7D-4A19-A3F1-43113B4DBCAF}


Registry scan result :
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 4
Objects found so far: 4


Started deep registry scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Deep registry scan result :
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 0
Objects found so far: 4


¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯


Deep scanning and examining files (C
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯


Performing conditional scans..
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

CoolWebSearch Object recognized!
Type : RegKey
Data :
Rootkey : HKEY_CLASSES_ROOT
Object : TYPELIB\{5297e905-1dfb-4a9c-9871-a4f95fd58945}


CoolWebSearch Object recognized!
Type : RegKey
Data :
Rootkey : HKEY_CLASSES_ROOT
Object : Interface\{48E59291-9880-11CF-9754-00AA00C00908}


CoolWebSearch Object recognized!
Type : RegKey
Data :
Rootkey : HKEY_CLASSES_ROOT
Object : Interface\{48E59292-9880-11CF-9754-00AA00C00908}


Conditional scan result:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 3
Objects found so far: 7


3:16:53 AM Scan complete

Summary of this scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Total scanning time :00:02:53:180
Objects scanned :35143
Objects identified :7
Objects ignored :0
New objects :7

Comments

  • kryystkryyst Ontario, Canada
    edited June 2004
    Get rid of all of those 'recognized' programs at the end they are all spyware. Well Alexa technically isn't it's a hidden account that windows uses to snoop on your computer so it needs to go.

    You should after an ad-aware scan come to a screen listing all the offending spyware just check them off and delete them.
  • fire_mat99fire_mat99
    edited June 2004
    Okay what is CoolWebSearch what does it do??

    And does this have any thing to do with my computer freezes for 5 seconds .

    Also what about CoolWebSearch
  • kryystkryyst Ontario, Canada
    edited June 2004
    It's spyware. What it does it hijacks your browser so that if you put in a bad link it routes you to it's own search engine for ad sites. It probably also tracks where you are going and sends back that info to people who want to target you with specifc ads.

    It's probably not responsible though for your freeze ups. That's most likely a virus, or a driver error.
  • fire_mat99fire_mat99
    edited June 2004
    Someone was saying there are different types of CoolWebSearch


    CoolWebSearch Object recognized!
    Type : RegKey
    Data :
    Rootkey : HKEY_CLASSES_ROOT
    Object : Interface\{48E59291-9880-11CF-9754-00AA00C00908}



    CoolWebSearch Object recognized!
    Type : RegKey
    Data :
    Rootkey : HKEY_CLASSES_ROOT
    Object : toolband.toolbandobj




    What is toolband.toolbandobj or toolband.toolbandobj.1

    And what is webshots
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    If you download CWS shredder from the link below, and then run it, it should fix your cool websearch problem. After you do that, run hijackthis and post a log.


    http://209.133.47.12/~merijn/files/CWShredder.exe
    http://209.133.47.12/~merijn/files/HijackThis.exe
  • fire_mat99fire_mat99
    edited June 2004
    There are different CoolWebSearch that do different things they are
    different variants but can't match it the the web site



    http://www.spywareinfo.com/~merijn/cwschronicles.html
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    I don't understand your post.

    CWShredder removes all the CWS infections. If that doesn't work, I can help you remove the problem manually with hijackthis.
  • fire_mat99fire_mat99
    edited June 2004
    CWS.Bootconf
    Symptoms: Massive IE slowdown, illegible URLs ie IE Options, redirections when mistyping URLs, startpage & search page changed on reboot



    CWS.Oslogo
    Symptoms: Massive IE slowdowns

    CWS.Msspi
    Symptoms: Popups with 'enhanced results' when doing searches on Google, Yahoo and Altavista

    Now can't match it to list
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    I have no Idea what you are trying to say. Forgive me if english is not your native language.

    Please just run CWShredder, and then Hijackthis. Post a log after you do.
  • fire_mat99fire_mat99
    edited June 2004
    I think it is toolband.toolbandobj or toolbandobj.1 but not know nothing about what is toolband.toolbandobj or toolbandobj.1 ..

    In the web site it does NOT talk about toolband.toolbandobj or toolbandobj.1 I know its variants but what is the Symptoms.

    And is toolband.toolbandobj or toolbandobj.1 a new variant like CWS.Bootconf or CWS.Oslogo
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    Ok. Please read what I am typing:

    Run Hijackthis. Click Scan. Click Save log. Post the log here. I will tell you what to remove. This should fix the problem. If not, then I'll look harder.

    I know what I'm doing.
    And is toolband.toolbandobj or toolbandobj.1 a new variant like CWS.Bootconf or CWS.Oslogo
    Yes. It doesn't matter if you can find it in the list. If it's a CWS variant, CWShredder will automatically remove it. If you post one more cryptic post, I will not be helping you.
Sign In or Register to comment.