Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

Infected By Adware??

Mar 21, 2005 9:48AM PST

I have Windows 98 and run Spybot S&D, but recently have also used Ad-Aware SE, CWShredder and Spysweeper.

Since installing these, I started to get freezing and problems shutting down, so one by one, I removed them.

The problem rarely happens any longer.

I have AVG, Zonealarm and Spybot S&D 1.3. Neither AVG or Spybot have detected anything.

I ran an anti-virus check with Symantec and on completion showed the following;


No viruses were detected in memory.

Your computer is infected with at least one known virus or Trojan horse.

c:\Program Files\Media Access\MediaAccess.exe is infected with Adware.WinTaskAd

c:\WINDOWS\Downloaded Program Files\WUInst.dll is infected with Adware.Savenow

c:\WINDOWS\Downloaded Program Files\MediaAccX.dll is infected with Adware.WinAd


Should I be concerned and if I need to get rid of them, how do I do it? In simple terms please.

Discussion is locked

- Collapse -
Get Adaware!
Mar 21, 2005 11:11AM PST

You have adware installed on your computer. You need Adaware in addition to the Spybot. It will find things that Spybot does not.
Download, install, UPDATE, run the scan.
I delete all that it finds without problems.
Best of Luck

- Collapse -
Infected By Adware?? -- Yes
Mar 21, 2005 11:44AM PST

WinTaskAd can be removed with XoftSpy

SaveNow will be listed in Add/Remove Programs either as SaveNow or WhenUShop, and is removable from there.

WinAd can be removed with SpyhunterS.exe (XoftSpy may also remove WinAd)

WinPatrol 9.0 Free can usually warn you when junkware is about to infect your computer and give you the option to block it.

- Collapse -
You should know...
Mar 21, 2005 2:12PM PST

that it's possible to remove almost any spyware/trojan manually. There are plenty of forums that can tell you how to do this, step by step. All you have to do is copy the name/file path of the bug and then paste it in google. It's not always easy, but it can be done. "Hijack This!" can be a great help, but be very careful what you delete. Check the various forums carefully. You'll find a few for "Hijack This!"

The "freezing up" of your system could be due to lack of RAM. The more programs you run, the more likely it will happen...especially on an older machine. How much RAM do you have now? And what's your CPU's clock-speed?

You should keep all your Antivirus and Spyware Removal Tools as up to date as possible. Update at least once a week. Whenever you update Spybot S&D, be sure to click "Immunize" afterward. It should say something like "All known bad products are already blocked." If it doesn't, click on "immunize" above the little medicine bottle, and then "check again".

Also, in Spybot S&D, some malware files are listed as exclusions (no one really knows why)...which means that Spybot will skip them whenever you run a scan. Here's what you should do: Make sure that Spybot is set to "Advanced Mode". Then go to "settings" and then go to "ignore products". Scroll through the list and uncheck anything you find with a checkmark next to it.

Download Zone Alarm from www.download.com (the freeware is fine for now; no need to upgrade to "Pro"). This will help you to keep things from getting in and out of your computer. If, for example, some unknown program called "buttbusters.exe" tries to access the internet, you can block it by clicking "Deny" and "Remember this setting". However, watch what you block. (You can also block/unblock things in the "program control" list.) If you're unsure of what a process is, you can just check the name in Google.

I hope this helps you. If you have any more questions and/or problems, please let me know.

- Collapse -
This is what I tried.
Mar 27, 2005 4:55AM PST

Thanks for all of your advice, appreciated.

Stan,
I D/Loaded Adaware Se, but it didn't remove them.

.
Caktus,
I D/Loaded XoftSpy, it found a number of things, but unless I am mistaken, it required me to make a purchase before it would remove anything.

SaveNow/WhenUShop is not listed as that in Add/Remove.

I haven't tried Spyhunters yet......should I?


.

culture_of_one,
I have ZoneAlarm in operation. Should I have it set at a higher security, if so how do I do that without causing other problems?

What's a file path-CPU's clock-speed? OK,don't laugh!!

I went into Spybot Adavanced and did as you suggested, two checkmarks removed.
Also your advice on Immunize, now get that box regarding blocking.

The freezing up occurred when I was closing down the pages that were open to swith the computer off.

For years it would just close down when I clicked the 'shutdown' button, but usually these days it switches off, but a note on the screen now tells me, it is safe to shut off my computer, or words similar. Why the change?

I haven't been to visit 'Hijack This', to be honest, I am wary of what advice I receive and act on and the other being that I don't want to mess anything else up in trying. I trust the advice on here, as I believe the moderators would be quick to pick up on anything otherwise, but I (and many like me) are in the laps of the gods so to speak.

Having run another Symantec check since this was done, I now find I have more infiltrations and neither Spybot or Adaware SE picked up on them.

c:\Program Files\Media Access\MediaAccess.exe is infected with Adware.WinTaskAd

c:\WINDOWS\Downloaded Program Files\WUInst.dll is infected with Adware.Savenow

c:\WINDOWS\Downloaded Program Files\MediaAccX.dll is infected with Adware.WinAd

c:\WINDOWS\TEMP\ccu\cscore.dll is infected with Spyware.CometCursor

c:\WINDOWS\TEMP\ccu\csip.dll is infected with Spyware.CometCursor

c:\WINDOWS\TEMP\ccu\skinui.dll is infected with Spyware.CometCursor


My AVG has these in it's vaults and I'd like to remove them if possible.

Trojan Horse Dialer.15.AN
c:\WINDOWS\TemporaryInternetFiles\content.IE5\OHQNWHER\sysWebTelecomInt[1].cab

Trojan Horse Dialer.17.Y
c:\WINDOWS\DownloadedProgramFiles\Conflict.5\ActiveSecurity.ocx

They mean nothing to me, but any information regarding them and how to remove them would be appreciated.

Regards,

Wolvspa.

- Collapse -
Okay...
Mar 27, 2005 10:54PM PST

I can't understand why Adaware and Spybot wouldn't detect and/or remove the problems you've mentioned. The only things that come to mind are 1) they've been compromised somehow (i.e. the bugs have disabled them in some way) or 2) your AV program is giving you false positives (i.e. seeing things that aren't there). For now, I'd go to the "Downloaded Program Files" and "Temp" folders, open them, "select all" and delete whatever's there. (*Not the folders, just the contents.) That should get rid of a few problems you've mentioned. Also, try setting everything in Zone Alarm to "high", or as high as possible (the freeware doesn't have all the features)...and go to "Program Control" and switch all the programs there to "Ask". Click around a bit and you'll find everything you need--don't worry too much! Wink

Your CPU's "clockspeed" just means how fast it is. (333Mhz, 600Mhz, 1Ghz, etc.)

Whenever you hear "filepath", just think "C:Windows/Temp/...", etc. (i.e. where the file is located...kind of like a trail of computer bread crumbs)

BTW, anyone who would laugh at you for asking intelligent questions is a fool pretending to be otherwise. We all have things to learn! Wink