Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

« previous next »
Pages: [1] 2  All   Go Down

Author Topic: This is an undesirable program.  (Read 5863 times)

0 Members and 1 Guest are viewing this topic.

Jp

  • Guest
This is an undesirable program.
« on: March 11, 2007, 07:41:26 PM »
Hey Hows it goin !  ::)

Have any idea why I am getting this, when analyzing my start up conf.  ?

Does it mean ? what it says ?  

Name: AolSoftware
Filename: aolsoftware.exe
Command: C:\Windows\aolsoftware.exe
Description: Added by the W32/Tilebot-CL worm and IRC backdoor. This infection should not be confused with the legitimate AOL file which can be found here.
File Location: %WinDir%
Startup Type: This startup entry is installed as a Windows NT, 2000, 2003, or XP service.
Service Name: aolsoftware
Service Display Name: AolSoftware
HijackThis Category: O23 Entry  
Note: %Windir% refers to the Windows installation folder. By default, this is C:\Windows for Windows 95/98/ME/XP or C:\Winnt for Windows NT/2000.
Removal Instructions:  How to remove a Trojan, Virus, Worm, or other Malware  



This is an undesirable program.

This file has been identified as a program that is undesirable to have running on your computer.
 This consists of programs that are misleading, harmful, or undesirable.

If the description states that it is a piece of malware, you should immediately run an
antivirus and antispyware program.


MY OS: Microsoft Windows XP
Home Edition
Version 2002
AOL is my IS ?  :-?

Jp
Logged

patio

  • Moderator


    • Genius
  • Maud' Dib
    • Thanked: 1769
    • Yes
  • Experience: Beginner
  • OS: Windows 7
Re: This is an undesirable program.
« Reply #1 on: March 11, 2007, 08:32:17 PM »
Sounds accurate.
Logged
" Anyone who goes to a psychiatrist should have his head examined. "

Jp

  • Guest
Re: This is an undesirable program.
« Reply #2 on: March 11, 2007, 08:35:49 PM »
patio,

Can you give me an idea, why it is called AOL software ?


I mean do you know what this is ? is it part of my AOL Internet access ?
What's it all about, why would AOL do this ?

Jp
Logged

CBMatt

  • Mod & Malware Specialist


    • Prodigy

  • Sad and lonely...and loving every minute of it.
    • Thanked: 167
    • Yes
  • Experience: Experienced
  • OS: Windows 7
Re: This is an undesirable program.
« Reply #3 on: March 11, 2007, 09:43:26 PM »
It's called that because a lot of people who make malware try to disguise it as legitimate programs.  Just because it's called AOLSoftware, that doesn't mean it was put on your computer by AOL.  AOL does add an AOLSoftware.exe, but usually somewhere in the Common Files folder.  You should only have to worry if you find it in your C:\Windows folder.
Logged
Quote
An undefined problem has an infinite number of solutions.
由obert A. Humphrey

Jp

  • Guest
Re: This is an undesirable program.
« Reply #4 on: March 11, 2007, 09:59:13 PM »
CBMatt,

Thanks, mind if I try to get a little more info ?,. . .

Appreciate it if you would take a look at this;

Startup Item                  Command                  
AOLSoftware           C:\Program Files\Com

                      Location
         HKLM\Software\Microsoft\Windows\CurrentVer...

Can you tell me what location is this ?

Why has this not been detected by the Prevx 1 Console installed of my system?

What is it therefore, i.e., what mischief is it up to ??  >:( !!



Jp
Logged

CBMatt

  • Mod & Malware Specialist


    • Prodigy

  • Sad and lonely...and loving every minute of it.
    • Thanked: 167
    • Yes
  • Experience: Experienced
  • OS: Windows 7
Re: This is an undesirable program.
« Reply #5 on: March 11, 2007, 11:57:02 PM »
I'm sure it's not exactly the same on all computers, but according to HijackThis, my aolsoftware.exe is located in the C:\Program Files\Common Files\AOL\1150582181\ee folder.  Yours should be in a similar folder.  If not, simply do a system-wide search for the file.  When you find it, go to VirusTotal, click on Browse (near the top of the page), select the file, and click on Send.  This will scan the file for you and should hopefully put your worries to rest.

Prevx1 probably isn't detecting the file because the one you have is legitimate and not malware.

That HKLM location is referring to the file's registry entry, which is HKEY_LOCAL_MACHINE\Software\Microsoft\CurrentVersion\Run\HostManager.

Keep in mind that there are TWO versions of AOLSoftware.exe.  One is a trojan (look here).  One is a normal AOL file (look here) that is used for pre-loading AOL so that when you go to open the program, it will open faster.

I understand your concern, but it is most likely nothing to worry about.  However, if you're still worried, you can remove the file.  It's not essential to make AOL work; it simply makes it load faster.
Logged
Quote
An undefined problem has an infinite number of solutions.
由obert A. Humphrey

rockerest



    Hopeful
    • Yes
  • Experience: Experienced
  • OS: Windows 7
Re: This is an undesirable program.
« Reply #6 on: March 12, 2007, 01:00:41 AM »
Quote
Command: C:\Windows\aolsoftware.exe

We already know it's in his C:\Windows\ directory.  Download Anti-virus / Anti-Spyware software and run it.  That should get rid of it.

-Rock
Logged
In general, the PEBKAC.  Whether it's now or was three weeks ago, the PEBKAC.
Unsafe browsing and general computer / internet illiteracy IS the users problem.  Don't have sex if you don't know how to use a condom.
Also, there are 10 types of people in the world, those who understand binary, and those who don't.

Jp

  • Guest
Re: This is an undesirable program.
« Reply #7 on: March 12, 2007, 07:30:56 PM »
CBMatt,

So far this is the information found on this file;


Name    
AOLSOFTWARE.EXEC-1D415B...  
                
In Folder                        Size        TYpe         Date Modified
C:\WINDOWS\Prefetch     36KB     PF File            3/10/2007 2:46 PM

I went to VIRUSTOTAL and when I went to browse and entered
Local Disc(C:)  (I don't no why the happy face got in here?)
placed the title, AOLSOFTWARE.EXEC-1D415B...

Pressed open and got;

File not found, please verify correct name and re-enter.

Have any idea what is wrong ?

Jp



Logged

CBMatt

  • Mod & Malware Specialist


    • Prodigy

  • Sad and lonely...and loving every minute of it.
    • Thanked: 167
    • Yes
  • Experience: Experienced
  • OS: Windows 7
Re: This is an undesirable program.
« Reply #8 on: March 12, 2007, 08:01:38 PM »
Jp,
Your search didn't turn up any other results?  What you're trying to scan is just a prefetch.  A prefetch basically just stores information about a .exe file to help it load faster.  You need to do the search again and find the actual aolsoftware.exe file.

And to stop the smiley from showing up, you'll need to check Check this if you'll be adding code (or don't like similies). before posting.

Quote
Quote
Command: C:\Windows\aolsoftware.exe

We already know it's in his C:\Windows\ directory.  Download Anti-virus / Anti-Spyware software and run it.  That should get rid of it.

-Rock
Rock,
I believe he is quoting this info from a web site.  What he posted is basically the exact same info on Bleeping Computer.
Logged
Quote
An undefined problem has an infinite number of solutions.
由obert A. Humphrey

Jp

  • Guest
Re: This is an undesirable program.
« Reply #9 on: March 12, 2007, 08:28:20 PM »
CBMatt,

[highlight]Rock,
I believe he is quoting this info from a web site.  What he posted is basically the exact same info on Bleeping Computer. [/highlight]

Correct.

Search Results;
aolsoftware        C:\Program Files\Common Files\...

LM_AOLsoftware      C:\Program Files\Common Files\...

aolSoftwareStrings  C:\Program Files\Common Files\...

Jp
Logged

CBMatt

  • Mod & Malware Specialist


    • Prodigy

  • Sad and lonely...and loving every minute of it.
    • Thanked: 167
    • Yes
  • Experience: Experienced
  • OS: Windows 7
Re: This is an undesirable program.
« Reply #10 on: March 12, 2007, 08:54:33 PM »
Quote
aolsoftware        C:\Program Files\Common Files\...

That's the one you want to scan.
Logged
Quote
An undefined problem has an infinite number of solutions.
由obert A. Humphrey

Jp

  • Guest
Re: This is an undesirable program.
« Reply #11 on: March 12, 2007, 10:10:46 PM »
CBMatt,

I pasted this to select file and pushed send, the following is what I got, . .What's it mean, please ?

0 bytes size received / Se ha recibido un archivo vacio

Jp
Logged

CBMatt

  • Mod & Malware Specialist


    • Prodigy

  • Sad and lonely...and loving every minute of it.
    • Thanked: 167
    • Yes
  • Experience: Experienced
  • OS: Windows 7
Re: This is an undesirable program.
« Reply #12 on: March 12, 2007, 10:35:31 PM »
That means you didn't properly specify the location.  You can't just copy "C:\Program Files\Common Files" because that's not the whole location.  See the "..." at the end?  That means there's more.  Open up the search again and right click on aolsoftware.exe and go to Properties.  You'll then want to copy the Location.  I've attached a picture of what I'm talking about.  See the blue highlighted line?  You'll want to copy that WHOLE section (left-click at the beginning, hold down the button, and move your mouse to the right until you get to the end of the text...then copy it).  However, that's only the folder that holds the file.  After you paste that, you'll have to add \aolsoftware.exe to the very end of it.  Then you can click on Send.

To make this easier...when you copy the Location, post it in this thread and I can show you what to do.
« Last Edit: March 12, 2007, 10:36:23 PM by CBMatt »
Logged
Quote
An undefined problem has an infinite number of solutions.
由obert A. Humphrey

Jp

  • Guest
Re: This is an undesirable program.
« Reply #13 on: March 12, 2007, 11:34:09 PM »
CBMatt,

Thanks Much, but I think there is no viruses found;

C:\Program Files\Common Files\AOL\1143471933\EE\aolsoftware.exe

STATUS: FINISHEDComplete scanning result of "aolsoftware.exe", received in VirusTotal at 03.13.2007, 06:28:16 (CET).

Antivirus Version Update Result
AntiVir 7.3.1.41 03.12.2007  no virus found
Authentium 4.93.8 03.13.2007  no virus found
Avast 4.7.936.0 03.12.2007  no virus found
AVG 7.5.0.447 03.12.2007  no virus found
BitDefender 7.2 03.13.2007  no virus found
CAT-QuickHeal 9.00 03.12.2007  no virus found
ClamAV devel-20060426 03.13.2007  no virus found
DrWeb 4.33 03.12.2007  no virus found
eSafe 7.0.14.0 03.12.2007  no virus found
eTrust-Vet 30.6.3473 03.13.2007  no virus found
Ewido 4.0 03.12.2007  no virus found
FileAdvisor 1 03.13.2007  no virus found
Fortinet 2.85.0.0 03.13.2007  no virus found
F-Prot 4.3.1.45 03.13.2007  no virus found
F-Secure 6.70.13030.0 03.13.2007  no virus found
Ikarus T3.1.1.3 03.12.2007  no virus found
Kaspersky 4.0.2.24 03.13.2007  no virus found
McAfee 4982 03.12.2007  no virus found
Microsoft 1.2306 03.13.2007  no virus found
NOD32v2 2110 03.12.2007  no virus found
Norman 5.80.02 03.12.2007  no virus found
Panda 9.0.0.4 03.12.2007  no virus found
Prevx1 V2 03.13.2007  no virus found
Sophos 4.15.0 03.12.2007  no virus found
Sunbelt 2.2.907.0 03.10.2007  no virus found
Symantec 10 03.13.2007  no virus found
TheHacker 6.1.6.074 03.12.2007  no virus found
UNA 1.83 03.12.2007  no virus found
VBA32 3.11.2 03.12.2007  no virus found
VirusBuster 4.3.19:9 03.12.2007 no virus found


Aditional Information
File size: 50736 bytes
MD5: c482c535cbfefe722ec1eb7f11f680a3
SHA1: 8fa6b9679b43df86947d5f3bd38d3f6ee48fc98 f

What ya think ?

Jp
Logged

CBMatt

  • Mod & Malware Specialist


    • Prodigy

  • Sad and lonely...and loving every minute of it.
    • Thanked: 167
    • Yes
  • Experience: Experienced
  • OS: Windows 7
Re: This is an undesirable program.
« Reply #14 on: March 13, 2007, 12:15:03 AM »
There you go, you got it right this time.  And according to the results and the location of your file, it looks legitimate.  You can delete the file if you really want to, but it's totally harmless.  I hope all of this puts your worries to rest.
Logged
Quote
An undefined problem has an infinite number of solutions.
由obert A. Humphrey
Pages: [1] 2  All   Go Up
« previous next »