New Ad-Aware Signature File 129-28.10.2001

Printable View

Show 40 post(s) from this thread on one page

October 28th, 2001, 11:59 AM
Renovator

New Ad-Aware Signature File 129-28.10.2001

Yet another Reference File, update 129-28.10.2001.

This recent update covers the new Gator version, VX2.dll and some Alexa components.

Available at LavaSoft.USA

And our mirror , of course.
October 28th, 2001, 01:02 PM
Cowboy622

Thanks guy. Glad someone is on top of things and helps the rest of us to maintain current protections.

------------------
You miss 100% of the shots you never take !
October 28th, 2001, 02:44 PM
ylen13

thanks for the info.
October 28th, 2001, 03:03 PM
Ridgerunr

Yeah,,thanks Renovator...
Just updated IPE and was wondering about a new reflist...Will go get it now... https://discussions.virtualdr.com/

------------------
God Bless America!!
October 28th, 2001, 05:00 PM
^dAvEy^

just ran the refupdate,...
then ran ad-aware...
located 5 little buggers!

thanks for the heads-up, Renovator

------------------
^dAvEy^

[This message has been edited by ^dAvEy^ (edited 10-28-2001).]
October 28th, 2001, 06:25 PM
AAPlus

Hello, All

Hold up on the installing of the new

reflist there is a problem that they

are working on as soon as they find

the problem i will post it for all

to see

Good Luck
October 28th, 2001, 06:31 PM
ylen13

can u be a little more specific on the problem .Should those of as that install new update not run adaware untill they find the problem?
October 28th, 2001, 07:01 PM
AAPlus

Hello, All

Here is what i found out so far

It appears that the new reflist

reports all BHOs as targets
October 28th, 2001, 07:06 PM
AAPlus

Hey, ylen13

if you have it installed do

not run it lit's see what VOP has

to say
October 28th, 2001, 07:09 PM
ylen13

Quote:

Originally posted by AAPlus:
Hey, ylen13

if you have it installed do

not run it lit's see what VOP has

to say

okay not gona run till i get the word that it's safe to run.
October 28th, 2001, 07:20 PM
AAPlus

Hello, All

If you have BHOcaptor or BHOcop it

will lit you know the properties if

it is an innocent BHO Simply add it

to the ignore list

now if you do not have them then get

some info here
http://hotfiles.zdnet.com/cgi-bin/te...e=77432&b=help

Good Luck

[This message has been edited by AAPlus (edited 10-28-2001).]
October 28th, 2001, 07:32 PM
discogail

AA'......How did you discover that there was a problem with the new reflist?
VOP is unavailable for me.
I already deleted the keys..lost "Show Related Links" plugin in IE. Restoring the backup I made does not restore it.
October 28th, 2001, 07:41 PM
AAPlus

Hey,discogail

at one of my favorite sites

at Becky Users Forums
http://www.morelerbe.com/cgi-bin/ubb-cgi/ultimatebb.cgi

I hope this will help you
October 28th, 2001, 07:43 PM
Welshjim

Those of you who ran RefUpdate to get the new reflist.sig will have created a backup of the 10/17 version at the same time, reflist.bak. You can name the 10/17 reflist back to reflist.sig (and the 10/28 version to something else) and go back to the 10/17 version while you wait to hear what to do about the 10/28 reflist.

------------------
Jim
October 28th, 2001, 07:49 PM
AAPlus

Hey, Welshjim

Thanks for the info

good work
October 28th, 2001, 07:52 PM
discogail

Hey, Welshjim.........is a backup supposed to be automatically created?
Don't have one myself.....?!
The 10-17 reflist is still available at Lavasoft...at the 2 mirror sites.
Too late for me, though.

[This message has been edited by discogail (edited 10-28-2001).]
October 28th, 2001, 07:59 PM
Welshjim

discogail--I think the backup is created only if you use Refupdate.exe (rather than downloading and installing the new reflist manually) and configure Refupdate to create the backup.
Here is the first part of the instructions for Refupdate.
"Before using this utility the first time, please
open the options-menu, and specify the destination directory
in which the files will be downloaded.
This should be the same folder, Ad-aware is using for the referencefile.
By default this will be Ad-aware installation directory.
Note:It is recommended to check the backup option too."

------------------
Jim
October 28th, 2001, 08:18 PM
^dAvEy^

Quote:

Originally posted by Welshjim:
Those of you who ran RefUpdate to get the new reflist.sig will have created a backup of the 10/17 version at the same time, reflist.bak. You can name the 10/17 reflist back to reflist.sig (and the 10/28 version to something else) and go back to the 10/17 version while you wait to hear what to do about the 10/28 reflist.

ahaha! - the penny just dropped over here...
been trying to open .sig and .bak thinking that was necessary in order to follow these directions...
finally, I just looked at the dates of the 2 files...then it all came together... https://discussions.virtualdr.com/

maybe what you're sugesting we do is par for the course for some, but to me it seams pretty heads-up, Welshjim...

------------------
^dAvEy^
October 28th, 2001, 08:33 PM
Welshjim

^dAvEy^ and AAPlus--Always good to hear that a suggestion was helpful. Thanks for posting back!!
Now I hope to hear from one of you (hint to Renovator) when we can use the new reflist!!
------------------
Jim

[This message has been edited by Welshjim (edited 10-28-2001).]
October 28th, 2001, 08:41 PM
^dAvEy^

so, this is what I did, Welshjim...
how's this sound...

reflist.sig 10/28 file renamed...
reflist10-28.sig

reflist.bak 10/17 file renamed...
reflist.sig

opened notepad and created (and left empty) a file named...
reflist.bak

------------------
^dAvEy^

[This message has been edited by ^dAvEy^ (edited 10-28-2001).]
October 28th, 2001, 08:44 PM
discogail

From my travels :

It appears that the new reflist reports all BHOs as targets

Backing it up and restoring it doesn't work . You can export the reg key to a .reg file and merge it back in later if you need to. The Lavasoft people do know about this. There's an enormous thread at grc.spyware newsgroup about this too.
October 28th, 2001, 08:47 PM
AAPlus

Hey, welshjim

Your suggestion was more then

helpful & i say again

Thanks
October 28th, 2001, 09:16 PM
imadreamer2

What is BHO?

------------------
Specs IE 5.5 sp2, win98 first edition, AVG 6.0, Sygate 4.1, Adaware 5.62, 366mghtz pent 2, 3.4 gig Maxtor HD, 188 mb ram, mother board unknown, What else do i need to know?
October 28th, 2001, 09:17 PM
npmcl

Once again GoBack proves its worth!
October 28th, 2001, 09:23 PM
discogail

BHO is short for Browser Helper Objects..usually add-ins or plugins for IE or Netscape..like the Alexa plugin here...or Yahoo Companion..etc.
Many are helpful...and not harmful....and some are spyware.

[This message has been edited by discogail (edited 10-28-2001).]
October 28th, 2001, 09:36 PM
imadreamer2

Thank you. I dont know all the terminology but am learning thanks to forums like this one. Before i read not to run ad aware with the new signature file, I did, didn't find any spyware, so I guess I didn't do any damage.

------------------
Specs IE 5.5 sp2, win98 first edition, AVG 6.0, Sygate 4.1, Adaware 5.62, 366mghtz pent 2, 3.4 gig Maxtor HD, 188 mb ram, mother board unknown, What else do i need to know?
October 28th, 2001, 10:42 PM
Renovator

Until I hear the official word...

I have the link on this page , pointing back to the reflist of 10/17/01.

In case anyone wanted the old version to go back to.

I had posted the keys effected, earlier in Mowerguns Alexa thread.
October 28th, 2001, 11:05 PM
Welshjim

^dAvEy^--You do not need the reflist.bak file that you created. When a new reflist is available, and you use RefUpdate to install it, the replaced reflist.sig will become reflist.bak and the new reflist will become reflist.sig, all automatically.

------------------
Jim
October 29th, 2001, 12:38 AM
^dAvEy^

cheers, JIm dude http://grc.com/shifty.gif

------------------
^dAvEy^
October 29th, 2001, 04:01 AM
Alwill

Jim,

Just adding my thanks for your very helpful hint. I changed extension of the 17/10 .bak file to .sig as you suggested and the 28/10 .sig to .old.
October 29th, 2001, 08:50 AM
discogail

From my travels..

the new reflist is targeting every single reference to Browser Helper Object. There's been reports of it targeting Adobe Acrobat's plug in for IE , Bugnosis, DLExpert, and IDecide... even restoring from backups didn't reinstall the deleted component.

the referencefile released yesterday
(129-28-10-01) wrongly identificated any BHO as spyware.
..... the wrong file has been uploaded.It was originally not meant as release version.
The working file (128-29-10-01) has been released recently , which does not show this behaviour.
......(I do not see this "working file" posted at Lavasoft...still the "unintended" one)
AdAware forums are back online
http://www.voiceofthepublic.org/cgi-.../ikonboard.cgi

[This message has been edited by discogail (edited 10-29-2001).]
October 29th, 2001, 10:57 AM
Renovator

https://discussions.virtualdr.com/ The working file 128-29.10.2001 is downloading from the LavasoftUSA site, the text on the page, may not reflect that yet.

The text and the file is also updated at NiceFiles .
October 29th, 2001, 11:38 AM
AAPlus

Hello, Guys

Good work with this problem

i know all your hard work will

help someone

Thanks
October 29th, 2001, 03:28 PM
Alwill

Especially Welshjim's tip which was pasted in the Tech Support Guy Security forum without acknowledgement as to the author.
October 29th, 2001, 03:50 PM
Welshjim

I just used RefUpdate.exe to get the latest (10/29) reflist. Then ran AA and am happy to report no spyware found.
I had ditched the 10/28 reflist before ever using it.
Thanks to everyone for keeping me informed of this fast moving situation!!
Alwill--What is the URL for the Tech Support Guy Security forum?

------------------
Jim
October 29th, 2001, 04:50 PM
Mowergun

After watching this thread, I assume since I ran Ad-Aware with the original update that I have deleted the registry keys for all BHO's. I can't find a back-up of the deletions. I,m not worried about any of the BHO's that I may have lost except the adobe reader. The question I have is, can a reinstallation of adobe reader fix that, or would it be better to scanreg /restore?

Later this same day
I went ahead and did a scan reg restore. Then I looked through the Ad-Aware log files and found the one that logged the deletion of alexa. It appears that this key is the only one that it deleted:HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
I ran regedit and checked, and the key is back after doing the scanreg /restore.
I then ran Ad-Aware again with the newest new signature file, and it found nothing.

Mowergun

------------------
Now I'm lost, so goldurn lost, not even god can find me.

[This message has been edited by Mowergun (edited 10-29-2001).]
October 29th, 2001, 04:56 PM
Alwill

Jim,

This link wil take you to the actual thread.
October 29th, 2001, 06:50 PM
Welshjim

Alwill--Thanks!! Until I got your URL I had gone all around that Board and couldn't find the thread.

------------------
Jim
October 29th, 2001, 07:24 PM
^dAvEy^

Quote:

Quotes originally posted by Mowergun:
After watching this thread, I assume since I ran Ad-Aware with the original update that I have deleted the registry keys for all BHO's...

I too ran the original oct 28 update and, logically, I assumed to have done the same

Quote:

I may have lost...the adobe reader...

my Adobe Acrobat 4.0 Reader appears to be intact

Quote:

I looked through the Ad-Aware log files and found the one that logged the deletion of alexa. It appears that this key is the only one that it deleted:HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}

I haven't yet located any reference to alexa on this pc...
I've checked the Ad-Aware log for my first run after updating reflist with first oct 28 update, and...
ran a search (with "Find" from the start menu) in MyComputer for "alexa" (no quote marks)(no mention of alexa there either)...
II went into regedit and the key Mowergun refers to (see quote above) apears to be intact

sorry if these questions have already been fielded...
i'm getting a bit confused in a few areas about this...

is there an updated update yet (since the first 28oct01 release)?
what exactly would I be looking for, since I'd run the first 28oct01 reflist update?
what exactly is best for me to do to have rest assured that I'm back on track and have not screwed u some stuff on this pc?

a couple minor questions would be...
why have I not revealed anything on the pc (including adaware log) re alexa?
why does my adobe reader seam to be unaffected?

TIA for any info that might be able to help put me at ease...

------------------
^dAvEy^

[This message has been edited by ^dAvEy^ (edited 10-29-2001).]
October 29th, 2001, 07:56 PM
Welshjim

^dAvEy^--Yes, there is a new reflist dated 10/29/01. If you use refupdate.exe it will do the downloading and installation for you. However, in this one case, do not have it back up the old reflist.

------------------
Jim

Show 40 post(s) from this thread on one page