New Ad-Aware Signature File 129-28.10.2001

From my travels..

the new reflist is targeting every single reference to Browser Helper Object. There's been reports of it targeting Adobe Acrobat's plug in for IE , Bugnosis, DLExpert, and IDecide... even restoring from backups didn't reinstall the deleted component.

the referencefile released yesterday
(129-28-10-01) wrongly identificated any BHO as spyware.
..... the wrong file has been uploaded.It was originally not meant as release version.
The working file (128-29-10-01) has been released recently , which does not show this behaviour.
......(I do not see this "working file" posted at Lavasoft...still the "unintended" one)
AdAware forums are back online
http://www.voiceofthepublic.org/cgi-.../ikonboard.cgi




[This message has been edited by discogail (edited 10-29-2001).]

https://discussions.virtualdr.com/ The working file 128-29.10.2001 is downloading from the LavasoftUSA site, the text on the page, may not reflect that yet.

The text and the file is also updated at NiceFiles .

Hello, Guys

Good work with this problem

i know all your hard work will

help someone

Thanks

Especially Welshjim's tip which was pasted in the Tech Support Guy Security forum without acknowledgement as to the author.

I just used RefUpdate.exe to get the latest (10/29) reflist. Then ran AA and am happy to report no spyware found.
I had ditched the 10/28 reflist before ever using it.
Thanks to everyone for keeping me informed of this fast moving situation!!
Alwill--What is the URL for the Tech Support Guy Security forum?

------------------
Jim

After watching this thread, I assume since I ran Ad-Aware with the original update that I have deleted the registry keys for all BHO's. I can't find a back-up of the deletions. I,m not worried about any of the BHO's that I may have lost except the adobe reader. The question I have is, can a reinstallation of adobe reader fix that, or would it be better to scanreg /restore?

Later this same day
I went ahead and did a scan reg restore. Then I looked through the Ad-Aware log files and found the one that logged the deletion of alexa. It appears that this key is the only one that it deleted:HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
I ran regedit and checked, and the key is back after doing the scanreg /restore.
I then ran Ad-Aware again with the newest new signature file, and it found nothing.

Mowergun

------------------
Now I'm lost, so goldurn lost, not even god can find me.

[This message has been edited by Mowergun (edited 10-29-2001).]

Jim,

This link wil take you to the actual thread.

Alwill--Thanks!! Until I got your URL I had gone all around that Board and couldn't find the thread.

------------------
Jim

Quote:

---

Quotes originally posted by Mowergun:
After watching this thread, I assume since I ran Ad-Aware with the original update that I have deleted the registry keys for all BHO's...

---

I too ran the original oct 28 update and, logically, I assumed to have done the same

Quote:

---

I may have lost...the adobe reader...

---

my Adobe Acrobat 4.0 Reader appears to be intact

Quote:

---

I looked through the Ad-Aware log files and found the one that logged the deletion of alexa. It appears that this key is the only one that it deleted:HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}

---

I haven't yet located any reference to alexa on this pc...
I've checked the Ad-Aware log for my first run after updating reflist with first oct 28 update, and...
ran a search (with "Find" from the start menu) in MyComputer for "alexa" (no quote marks)(no mention of alexa there either)...
II went into regedit and the key Mowergun refers to (see quote above) apears to be intact

sorry if these questions have already been fielded...
i'm getting a bit confused in a few areas about this...

is there an updated update yet (since the first 28oct01 release)?
what exactly would I be looking for, since I'd run the first 28oct01 reflist update?
what exactly is best for me to do to have rest assured that I'm back on track and have not screwed u some stuff on this pc?

a couple minor questions would be...
why have I not revealed anything on the pc (including adaware log) re alexa?
why does my adobe reader seam to be unaffected?

TIA for any info that might be able to help put me at ease...

------------------
^dAvEy^

[This message has been edited by ^dAvEy^ (edited 10-29-2001).]

^dAvEy^--Yes, there is a new reflist dated 10/29/01. If you use refupdate.exe it will do the downloading and installation for you. However, in this one case, do not have it back up the old reflist.

------------------
Jim

davey, the link I posted this morning...about 6 posts above yours does have the correct updated update... it will show as 128-29.10.2001 in your GUI. I'm pointing you to that one, because I put it there.

I also believe the main server is updated. Along with the other official mirror.

Now, I am not sure about the answer to Adobe Acrobat. The reason is, that mine has not had an entry there in quite a while. I don't know that it ever did.

Remember that the Adobe Browser plug-in is different from the stand alone reader.

But my Adobe plug-in has acted screwy in the past, so maybe this key has been a problem child for me, prior to yesterday. I'll monitor a reinstall after a bit, and see what shakes out.

EDIT: I have Adobe Acrobat 4.0, and just revisited a page known for .pdf cacheing headaches... and a large pdf worked fine, via the Browser Plug-In , with no entry in the BHO key. My key remains the same as posted in the MowerGun thread.

Again... the key is there... but without a value... it's blank.



[This message has been edited by Renovator (edited 10-29-2001).]

^dAvEy,

I wouldn't lose any sleep about Alexa. I don't recall which Board it was on now but there was a thread a little over a week ago about Alexa with a post which explained a means of getting rid of it. The method was to delete the registry key which Mowergun found in his travels.

I did delete the key (but not before exporting a copy) and I have experienced no problems in using any programs or Windows features. I am running IE 5.01 SP2 and I have noticed that I do not have a 'Show Related Links' item in my IE Tool menu; whether there was one prior to my deleting the reg. key I don't know as I never noticed it.
BTW just in case you may have missed it, there is another thread running on this Board on Adaware and Alexa and it can be found here

EDIT Have noticed a few references to
Adobe Acrobat Reader; Version 5.0 is available

[This message has been edited by Alwill (edited 10-29-2001).]

Hello, Welshjim

First i like to say that at know time

was i trying to make it seem like i

had done the work that you posted now

if that is what Alwill is trying to say

he is WRONG i in noway was trying to do

that it's just that i was trying to stop

someone from having this problem if i

forgot to put your name on what i posted

I Appologize to you or anyone hwo thinks

i did this so i could look like a big guy

Is WRONG it was not like Alwill is trying

to make it seem at all

i was trying to get this out before anyone had a problem

once again i Appologize, Welshjim

and Alwill next time you should find out

what is going on before you jump on my back

that's my wife's job

AAPlus--Thanks for posting. No problems. What do they say about the sincerest form of flattery? https://discussions.virtualdr.com/

------------------
Jim

Quote:

---

Originally posted by Welshjim:
^dAvEy^--Yes, there is a new reflist dated 10/29/01. If you use refupdate.exe it will do the downloading and installation for you. However, in this one case, do not have it back up the old reflist.

---

I've refupdated to 10/29/01 regfile (making it the current .sig file), Welshjim dude...

the file renaming, extension changes, and the new reflist.bak file I made Sunday makes the 10/17/01 update my current reflist.bak file automatically!

I guess I'll just send that reflist10-28.sig update file off to the Smithrite (Vancouver lingo for dumpster)... https://discussions.virtualdr.com/

thanks yet again, Jim!

Quote:

---

Renovator said...
Remember that the Adobe Browser plug-in is different from the stand alone reader

---

ah...not something I know much about, but it still makes sense that it is the plug-in in question, and not necessarily the program itself...

Quote:

---

no entry in the BHO key. My key remains the same as posted in the MowerGun thread...
Again... the key is there... but without a value... it's blank.

---

does that mean you negotiated through to ...

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}

and the info under Data and beside (default) reads (value not set) ?...
is that correct, Renovator?...
if you don't mind, please tell me what that might mean, and...
how it's different from delting/removing the "key"?...

after reading about the nature of alexa's activity, I'm keen to rid of it and all reference to it all together...

considering it is the registry I'd be messn with, I'm looking to be sure exactly what's to be done re removing/deleting the keys and subs as refered to in your second posting in THIS thread, Renovator...
<btw, what's GUI stand for?>...

think I'll hold off on doing the upgrade to Adobe Acrobat Reader; Version 5.0, Alwill...
<who knows what they got bundled into this version!>...^ http://www.lurkhere.com/icon/spineyes.gif ^

I'd prefer seeing if I can get all working just fine while removing all traces of alexa, etc. critters...

(thanks for that latest heads up, Alwill!)...

and thanks, all, for your attention to date, and TIA for any help you might offer walking me through through the reg procedure(s) you might have used to get rid of alexa, etc (preferably including the menu item)...

------------------
^dAvEy^

[This message has been edited by ^dAvEy^ (edited 10-30-2001).]