budro Posted April 2, 2010 ID:226034 Share Posted April 2, 2010 Can anyone attach a copy of the file "C:\WINDOWS\Web\Wallpaper\welcome\AWhelper.dll", so we can review this again?ThanksWe will remove detection temporary and re-add again if needed (after review).I tried and your system says I am "not allowed to upload this type of file".I am trying again on this post. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 2, 2010 Staff ID:226036 Share Posted April 2, 2010 Hi,You need to zip it first Link to post Share on other sites More sharing options...
budro Posted April 2, 2010 ID:226043 Share Posted April 2, 2010 Did you receive it? Link to post Share on other sites More sharing options...
budro Posted April 2, 2010 ID:226046 Share Posted April 2, 2010 Sorry I've unzipped before but, never zipped. I don't think I even have the application. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 2, 2010 Staff ID:226049 Share Posted April 2, 2010 To zip a file, rightclick the file and select "send to " > Compressed (zipped) folder.This will create a new file in that directory with the name AWhelper.zipIt's that what you have to attach here. Link to post Share on other sites More sharing options...
Amethyst Posted April 2, 2010 ID:226061 Share Posted April 2, 2010 @ miekiemoes,I'll attach mine.I searched my registry last night for awhelper entries, and there are several of them. It made me think that this item actually did come preinstalled on the computer. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 2, 2010 Staff ID:226065 Share Posted April 2, 2010 Ok thanks. Detection has been removed in a meanwhile. It will be re-added if needed (if it's a "critical" adware component). If harmless, then no need to re-add detection.In either way, if you already deleted it, there's nothing to worry about as this wont break anything. After all, some other scanners have been detecting this files for months. Link to post Share on other sites More sharing options...
budro Posted April 2, 2010 ID:226069 Share Posted April 2, 2010 Sorry, I had connection problems, then got logged out.Anyways thanks for the zip lesson and here is the zipped file to compare with Amethyst's.AWhelper.zip Link to post Share on other sites More sharing options...
Amethyst Posted April 2, 2010 ID:226072 Share Posted April 2, 2010 Thanks, miekiemoes. Link to post Share on other sites More sharing options...
budro Posted April 2, 2010 ID:226074 Share Posted April 2, 2010 Oh, in case this means anything, I have run MB full scan a couple time since reporting here and AWhelper.dll is still detected as MW but, those registry entries it caught then (listed in my previous post) have not been reported since. ??? Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 2, 2010 Staff ID:226091 Share Posted April 2, 2010 It shouldn't be detected anymore though, but you need to update first Link to post Share on other sites More sharing options...
Amethyst Posted April 2, 2010 ID:226109 Share Posted April 2, 2010 DB 3946 is still detecting this for me as well. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 2, 2010 Staff ID:226115 Share Posted April 2, 2010 Can you post a developers scan log please?1. Click the Start Menu.2. Click Run.3. Type in "mbam.exe /developer", without the quotes.4. Run the same type of scan you did before and save the logfile and post it.Never mind, it should be fixed in next update. It wasn't in this one yet. Link to post Share on other sites More sharing options...
budro Posted April 2, 2010 ID:226120 Share Posted April 2, 2010 Per your advice, I downloaded the latest DB and ran a full scan. AWhelper.dll and two system restore files were found to be Adware.WebHancer infected. Link to post Share on other sites More sharing options...
budro Posted April 2, 2010 ID:226122 Share Posted April 2, 2010 Sorry jumped before reading your last post. I'll try another DL. Link to post Share on other sites More sharing options...
budro Posted April 2, 2010 ID:226143 Share Posted April 2, 2010 No change:Malwarebytes' Anti-Malware 1.45www.malwarebytes.orgDatabase version: 3947Windows 5.1.2600 Service Pack 3Internet Explorer 7.0.5730.134/2/2010 12:25:01 PMmbam-log-2010-04-02 (12-25-01).txtScan type: Full scan (C:\|D:\|)Objects scanned: 187325Time elapsed: 30 minute(s), 27 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 3Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP444\A0092157.dll (AdWare.WebHancer) -> No action taken.C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP445\A0093043.dll (AdWare.WebHancer) -> No action taken.C:\WINDOWS\Web\Wallpaper\welcome\AWhelper.dll (AdWare.WebHancer) -> No action taken. Link to post Share on other sites More sharing options...
budro Posted April 2, 2010 ID:226148 Share Posted April 2, 2010 I don't mean to beat this horse to death but, I have a couple dozen System Restore points going back to Feb. and yet MB is only picking up, what I presume to be the offending AWhelper.dll file, in two of them. Is MB basing it's finding on attributes instead of file content? Sorry, just a curious thought here. p.s. Was DB ver. 3947 suppose to fix the false positive? Link to post Share on other sites More sharing options...
Amethyst Posted April 2, 2010 ID:226150 Share Posted April 2, 2010 I'm getting a detection as well for 3947. I'm just navigating to awhelper.dll and I get the detection popup from MWB. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 2, 2010 Staff ID:226151 Share Posted April 2, 2010 Yes, I know. 3947 didn't include this fix yet - but included some critical malware detections instead, please be patient. Link to post Share on other sites More sharing options...
Blue452 Posted April 2, 2010 Author ID:226174 Share Posted April 2, 2010 To those of you who have quarantined the related registry entries, can I clarify this: You have rebooted your systems since and your computers are fine? Is that correct?In answer to Amethyst's post #25, I currently have these items in quarantine as shown below and upon reboot/shutdown, my computer is fine. We always turn off the computer when not in use and so far, no problems.Registry Keys Infected:HKEY_CLASSES_ROOT\TypeLib\{661e32fd-a5f0-49bc-96cc-d872fe10a7dc} (AdWare.WebHancer) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Interface\{3296405e-e08f-4442-801e-3dcd2c6aa82c} (AdWare.WebHancer) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{bf0118d4-63ff-4138-9327-f3028fb1a578} (AdWare.WebHancer) -> Quarantined and deleted successfully.Files Infected:C:\WINDOWS\Web\Wallpaper\welcome\AWhelper.dll (AdWare.WebHancer) -> Quarantined and deleted successfully.HP ComputerXP, SP3IE8 Link to post Share on other sites More sharing options...
Amethyst Posted April 3, 2010 ID:226402 Share Posted April 3, 2010 Thanks for your feedback, Blue452. It looks like with DB 3948, this is no longer being detected as malware. Thank you, Miekiemoes. Link to post Share on other sites More sharing options...
budro Posted April 3, 2010 ID:226541 Share Posted April 3, 2010 I sure hope my posts made sense and I haven't offended anyone. I don't want to be a pain but, A question w/o an answer makes me lose sleep. lol Anyway here goes again; Can one rely on the dates Windows Explorer displays? I just want to know if a file can be modified or one added on the Windows file system without the dates reflecting that operation? I know it sounds like a MS question but, I have asked before on other forums and have not received a definitive answer.Thanks for allowing me to post here.Also, I ran MB scan this a.m. with DB 3949 and all's quiet on the southeastern front. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 3, 2010 Staff ID:226543 Share Posted April 3, 2010 I just want to know if a file can be modified or one added on the Windows file system without the dates reflecting that operation?yes, that happens frequently Link to post Share on other sites More sharing options...
budro Posted April 3, 2010 ID:226631 Share Posted April 3, 2010 Thank you for your response Mieke, that's not encouraging. Link to post Share on other sites More sharing options...
Blue452 Posted April 3, 2010 Author ID:226640 Share Posted April 3, 2010 My question: Since the latest database is currently no longer flagging these files and I have these files in quarantine, would you recommend that I restore them or just leave them in quarantine for now? I'm not sure what to do.Thank you.Registry Keys Infected:HKEY_CLASSES_ROOT\TypeLib\{661e32fd-a5f0-49bc-96cc-d872fe10a7dc} (AdWare.WebHancer) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Interface\{3296405e-e08f-4442-801e-3dcd2c6aa82c} (AdWare.WebHancer) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{bf0118d4-63ff-4138-9327-f3028fb1a578} (AdWare.WebHancer) -> Quarantined and deleted successfully.Files Infected:C:\WINDOWS\Web\Wallpaper\welcome\AWhelper.dll (AdWare.WebHancer) -> Quarantined and deleted successfully. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now