Can anyone tell me what this adware does...I can't get rid of it.
Printable View
Can anyone tell me what this adware does...I can't get rid of it.
Where did you see that it was adware? All I'm coming up with is links to a DOS game, and database applications??? :confused:
Oh, and welcome to AO.
The Norton anti-virus scan found it and a message says it was an adware...It said do I want to delete it...press delete...then it says can't delete.
Thanks for the welcome.
Hmm... that's interesting...Norton detects Adaware? I didn't know that...Do a Google for it, exactly as you typed it...see if anything results you come up with relates to any applications you may have. A couple links I found said it was a program to access a database.....
It's possible that some type of malware uses it....
Try booting in safe mode, then run you virus scan. See if it allows you to delete it then. Maybe someone else will have a line on it.
Groovicus,Quote:
Hmm... that's interesting...Norton detects Adaware?
I'm not sure when Norton Started detecting adaware but the do With Nav 20004.
Maybe we are seing a false possitive?
Perhaps Nav is trying to be the jack of all trades and master of none?
The thought of a false positive was in the back of my mind, but you never know these days. That's why I wanted him to Google first and see if he had any of the apps listed.
Well, might be that or if it says it can't delete you could also try running the task manager because it probably won't delete because it's in use. So I would goto the task manager and look for TRI.exe if end task then run Norton AV. Otherwise it would be as jinxy says.
Thanks for the help. In my task manager the TRI.exe shows up three times...I unchecked them all and restarted in safe mode...used the anti-virus scanner...tried to delete it and it still wouldn't delete...restarted in normal mode and checked the task manager, now there's a fourth TRI.exe that's checked on...the other three are still checked off. I checked on Google but with no luck...Norton says it's an Adware:Statblaster...I went to symantec and it says the same thing but nothing that tells you how to get rid of it.
What task manager would that be. I have never seen the task manager you could check anything in.Quote:
In my task manager the TRI.exe shows up three times...I unchecked them all and restarted in safe mode...
End process, maybe.
I'm sorry...I meant msconfig - start up.
Do yourself and us a favor.... go get a copy of Hijackthis and post your log. It would help us see what is going on...
Here is a tutorial that will show you how to use it (it's pretty easy)
If its supposedly "statblaster". Read here:
And see if any of these files also happen to be on your computer.Code:http://www.pestpatrol.com/PestInfo/s/statblaster.asp
1) NAV 2004 and SAV Corp Ver 9 now have a spyware detection component. SAV corp is passive in that it has no realtime protection against spyware. It will only turn up during scans. I assume 2004 behaves the same way because I was told it is the same code.
2) Go out and download Ad-Aware or SpyBot. Either of these programs will clean your machine. There is no need for a HijackThis dump because you already know what the problem is.
--TH13
In most cases, that would be true. But according to Symantec, it is sometimes bundled with other adware applications.Quote:
There is no need for a HijackThis dump because you already know what the problem is.
My interptetation of that is to mean that there is something else calling it to run.Quote:
This Adware does not provide an uninstaller. The adware with which it could be bundled would most likely contain the run keys and uninstallers, if any.
Since DemonPreyer hasn't mentioned any other adware issues, it would be easy to assume nothing else was going on. With an HJT log dump, it would be easy to see if there was anything else that may cause an issue. That way any help we give is as accurate as it can possibly be, and that is why we are here, right? :D
Logfile of HijackThis v1.97.7
Scan saved at 7:25:29 PM, on 5/21/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Norton Personal Firewall\NISUM.EXE
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
c:\Program Files\Norton Personal Firewall\ccPxySvc.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hphmon05.exe
c:\Program Files\Norton AntiVirus\SAVScan.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\LTMSG.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\documents and settings\owner\local settings\temp\TRl.exe
C:\documents and settings\owner\local settings\temp\TRl.exe
C:\WINDOWS\System32\rundll32.exe
C:\Documents and Settings\Owner\My Documents\Highjack\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\SearchBar.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.citi.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.drudgereport.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [Dsi] C:\WINDOWS\System32\dp-him.exe
O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [TRl] C:\documents and settings\owner\local settings\temp\TRl.exe
O4 - HKLM\..\Run: [TRl.exe] C:\documents and settings\owner\local settings\temp\TRl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra 'Tools' menuitem: MaxSpeed (HKLM)
O9 - Extra button: Research (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O10 - Broken Internet access because of LSP provider 'spsublsp.dll' missing
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/229711d9...p/RdxIE601.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...8095.576712963
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/SassCln.CAB
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents...r/imloader.cab
I just saw your post... I'm looking it over right now, so if you will be patient, I'll get back to you as soon as I can. :D
Ok, you got a couple of things going on, but all in all, it looks very good.
First, it looks like you have a CWS infection.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\SearchBar.htm
Download and run http://www.spywareinfo.com/~merijn/files/CWShredder.exe
from its own folder. Click Fix and then Next, let it fix everything it asks about.
While you are at it, browse into your tmp file and check the properties. Make sure it's nothing you want, or if you are not sure, post the details here also. If you are absolutely sure it's not something you want, then use HJT to fix the two 04 entries that contain TRL.exe.
Reboot in safe mode, browse into your temp directory, and delete the TRL.exe's there also. Reboot again, and post another log.
EDIT AGAIN: Please post the properties of those files anyway...it might be a new variant on something interesting ;)
EDIT2: Everything in it's proper order annihilator_god. I don't want to cause confusion and really mess things up, especially when he's in pretty good shape.
O4 - HKLM\..\Run: [TRl] C:\documents and settings\owner\local settings\temp\TRl.exe
O4 - HKLM\..\Run: [TRl.exe] C:\documents and settings\owner\local settings\temp\TRl.exe
Here's a problem... in your registry, these 2 lines startup two instances of the tri.exe program.
what you can do is open up regedit and navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run
and delete the two lines that startup tri.exe
Oh, before doing this, you might want to make a backup of the registry... there must be a tutorial for that somewhere on this site.
Then open my computer and navigate to:
C:\documents and settings\owner\local settings\temp\ and delete tri.exe
You could also do a search of files on your computer called tri.exe and delete any copies of the program. Be careful though, some installed software might require this program to be installed (like how kazaa needs their spyware to be installed)
D'oh!!! it's not tri.exe it's TRL.exe
So substute TRL for TRI in all of my above commands
Hope this helps
Thanks to groovicus and the others...problem fixed.