can't run ad aware or spybot

[rdlaing]

every time i try to run spybot search + destroy or ad aware they crash -- ad aware won't even launch and gives me an error command, and spybot hangs in the middle of the scan and I have to use end task

I have checked for viruses with AVG and with panda online and have also uninstalled and reinstalled these programs.

I'm puzzled.

any help appreciated.

[Gibble]

Have you tried running the scans in Safe Mode? Might help, might not, but it's a place to start.

[kram 2.0]

Try this...

First, run <a href="http://housecall.trendmicro.com">Housecall</a> and see what that finds - it's at pretty effective engine, as I don't have any viri on my computer from the resident TrendMicro Software. Then, make sure you have the latest version of the two software - <b>Adaware SE</b> and <b>Spybot S&D 1.3</b>. Adaware made their change just recently and they should have alerted you of it - Spybot doesn't tell you, so make sure of that. The older versions were Adaware 6 and Spybot 1.2. If so, UPDATE then, don't run it, instead, reboot your computer into SAFE MODE. Run Adaware and Spybot then, and see how thing turn out.


Hope that helps,
kram

[w33tq]

I agree with Gibble... Run the programs in safe-mode... I do that, but i also use Pest Patrol...

[Cricket]

There are several varients of CoolWebSearch that will cause this problem...they disable or corrupt the files so that those spyware scanners won't function. You can try running CoolWebShredder, but I'm not sure if that will fix the problem.

Might also be something to do with MySearchNow (another hijacker).

Can you run Hijack This! and post the log?

:) Cricket

[rdlaing]

thanks for the help everyone. this is a very strange and unexpected problem given how dilligent I am about spyware and virus protection on this machine.

here is the hijack this log that I just ran:

Logfile of HijackThis v1.97.7
Scan saved at 4:30:23 PM, on 8/12/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\POPROXY.EXE
C:\PROGRAM FILES\VERIZONDSL\WINPOET\WINPPPOVERETHERNET.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\NETSCAPE\NETSCAPE 6\NETSCP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\MY DOCUMENTS\WILL\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.rcn.com/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://home.netscape.com/home/winsearch.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.netscape.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.netscape.com/home/winsearch200.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://keyword.netscape.com/keyword/%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 169.254.191.62
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://development.rcn.com/ie5/welcome/
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://dslstart.verizon.net/vzn.dsl/welcome.htm?ver=12705&"); (C:\Program Files\Netscape\Users\User00\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Norton eMail Protect] "C:\Program Files\Norton AntiVirus\POPROXY.EXE"
O4 - HKLM\..\Run: [WinPoET] "C:\Program Files\VerizonDSL\WinPoET\WinPPPoverEthernet.exe"
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [Win32SL] "C:\DMI\BIN\Win32sl.EXE -i -p -r"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Dell Home (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38026.6880439815
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

[glc]

If you are going to use AVG, uninstall that old version of Norton - having two autoprotects can bottle things up.

I don't see anything suspicious in there, but you may have things that are hogging resources and are not getting along with each other - but I don't see where this would prevent stuff from running.

[rdlaing]

Ok, so I was trying to get the machine in Safe Mode to run ad aware and spybot that way -- and I couldn't get it into Safe Mode!

I tried rebooting multiple times holding down control, holding down f8, holding down delete, f5, etc etc and no luck.

now I am worried.

[glc]

To force safe mode, shut it off during the startup - after the splash screen appears - then on restart it will suggest safe mode because it didnt start normally the last time.

[w33tq]

To force safe mode, shut it off during the startup - after the splash screen appears - then on restart it will suggest safe mode because it didnt start normally the last time.
Say "no" to computer cruelty!
hehehe

[rdlaing]

To force safe mode, shut it off during the startup - after the splash screen appears - then on restart it will suggest safe mode because it didnt start normally the last time.

I'll give that a try. any reason why I can't get into safe mode normally (and cruelty-free)?

Also I tried coolwebsearch shredder and it said there was no infection.

back at the comp saturday, will try it then and report how it goes.

and I'll uninstall the old norton version. I did uninstall it before but i guess hijackthis and regedit can clean up any leftovers.

-- rd

[w33tq]

F5 should be it to get in safe mode.. you said you tried that.. I never know when to hit the button.. so i just repeatily hit it as fast as i can during boot up. Maybe you weren't hitting it at the right time

[rdlaing]

thanks w33tq I got into safe mode.

I ran spybot in safe mode and it did the same thing- hangs in the middle of the scan. I noticed that it hangs at the same place -- at c2.lop which I guess is the malware on the ref file it is scanning for?

i was able to install ad aware while in safe mode -- it would get an error on install when I wasn't in safe mode. When I ran the scan, however, it successfully completes the scan and says there is no spyware.

I also realized that norton is disabled but was still showing up on the 'add remove software' list. So I uninstalled it.

I'm going to try to run spybot now after the norton uninstall and see how it goes, and will report.

I also realize there have been some strange instabilities, like netscape browser displaying funny and the task bar disappearing.

[rdlaing]

Ok, so spybot still hangs at c2.lop. I looked up c2.lop online and it doesn't seem like it is affecting things -- the browser is not being redirected, etc.

I am running SpyKiller and it is turning up many other malwares -- 17 and 16 live processes. I didn't realize that adaware and spybot had such a big blindspot.

Now what do I do? SpyKiller wants thirty bucks or it's not going to clean my system...

[w33tq]

Ok, so spybot still hangs at c2.lop. I looked up c2.lop online and it doesn't seem like it is affecting things -- the browser is not being redirected, etc.

I am running SpyKiller and it is turning up many other malwares -- 17 and 16 live processes. I didn't realize that adaware and spybot had such a big blindspot.

Now what do I do? SpyKiller wants thirty bucks or it's not going to clean my system...

you can get Grisoft's AVG for free... It works pretty good.. Don't know if it will get rid of all the malware that SpyKiller found.. http://free.grisoft.com/freeweb.php/doc/2/

I have pest patrol, which works the same way as SpyKiller if you don't have a registered copy...

[rdlaing]

i have avg and it is not showing these on a scan.

thanks for the help everyone.

--rd

[w33tq]

did you get my PM?