Alexa Spyware

[hewee]

I ran Ad-aware and was clean and then I updated my Ad-aware signature file and ran it and it found the Alexa Spyware on my PC.
I know what Alexa Spyware and I never installed it.

Here is the ending of the report here.
--------------------------------------------------
Doubleclick file:C:\WINDOWS\Cookies\user@doubleclick[1].txt
FileSize : 0 kb
FileCreation time : 12-2-01 6:14:16 PM
Last accessed : 12-22-01
Build :
OS : No executable


File scan result:
Suspicious files found:1



Scan complete
==============
Suspicious modules found:0
Suspicious keys found :1
Suspicious folders found:0
Suspicious files found:1
=========================
Spyware components ignored:0
Spyware components found total:2
--------------------------------------------------

The one "Suspicious files found:1" is the Alexa Spyware "See image".
I never use I.E. because I use Netscape.
But I did use the I.E. once for the " Windows Update" and that was the only time.


So is it a Alexa Spyware file or not? I had looked at the file it points to and it is only a .html page.
The RELATED.HTM is just a white blank page. Dated 642 bytes Fri Apr 23 22:22:00 1999 Hypertext Markup Language.
This is a new PC and a lot of the dates are Apr 23 22:22:00 1999 and Thu Nov 08 18:50:08 2001. This last date being the day the that Windows was install.
So it's a "Suspicious files" only after the update Ad-aware signature file is all I know.

Can I deleted the Suspicious Alexa file with Ad-aware?

 

[Rollin' Rog]

You can definitely delete it. But it's strange how it got there if Alexa was never installed. Do you remember what you updated at Windows Update?

 

[hewee]

Strange how it got there alright.
Plus as you see the name Alexa only shows up on Ad-aware.

The update I used and downloaded Windows Media Player 7.01.

So it was installed tru the update so I don't know if I had just downloaded it and installed it on my own if I would of seen other options I could of said yes or no to.
Now when I first used it, it wanted to be online but I changed that option by unchecking the "Start Player in media guide. I don't see any other setting that makes me think it's Windows Media Player.

So if I delete the file tru Ad-aware is the Windows Update going to work? From look at other .html pages in the C:\windows\web folder it look like the other .html pages are just the things we all see when we are there like.

Here is the code from the C:WINDOWS\WEB\RELATED.HTM
--------------------------------------------------
<script>

//Build the query
userURL=external.menuArguments.location.href;
RelatedServiceURL="http://related.msn.com/related.asp?url=";

//Perform simple check for Intranet URLs
//this is where the http or https will be, as found by searching for :// but skip res:
protocolIndex=userURL.indexOf("://",4);
serverIndex=userURL.indexOf("/",protocolIndex + 3);
urlresult=userURL.substring(0,serverIndex);

//Check if Intranet URL - then open search bar

if (urlresult.indexOf(".",0) < 1) userURL="Intranet URL";
finalURL = RelatedServiceURL + escape(userURL);
external.menuArguments.open(finalURL, "_search");

</script>


--------------------------------------------------

I know if you go here http://www.microsoft.com/windows/ie/previous/webaccess/default.asp that you can add the Web Accessories and you can get Explorer Bars and yep there is Alexa. But these are all ad-ons and I never did that.

A search on my PC and the register of Alexa comes up clean so just how Ad-aware thinks it's Alexa I don't know. It does only say Suspicious. Never had spyware so don't know what it says if you really have something or if it just says Suspicious for anything it finds.

NOTE:
I do not have the Windows Scripting Host installed on my PC because I know it is safer.
See my post here.
http://forums.techguy.org/showthread.php?s=&threadid=61865&highlight=Windows+scripting+host

 

[casper03]

where do you get the latest defenitions for adaware ?

 

[TonyKlein]

Totally unexpectedly, ( ), at the Lavasoft site: http://www.lavasoftusa.net/

And more specifically here: http://www.lavasoftusa.net/aaw/binary/reflist.zip

Unpack it to the Lavasoft Ad-Aware folder in Program Files, and have it overwrite the one that's there.

And Rog, after installing the latest Reflist.sig, I found 1 Alexa item as well, which surprised me, for I never find anything with Ad-Aware.
I can't for the life of me imagine where that one came from, but it's gone now, anyway.

 

[casper03]

just ran it and thankfully found nothing ..
just goes to show adaware is doing its job.

 

[eddie5659]

Hiya

Just read this at Lavasoft:

Alexa is most definetly packaged with iexplorer. I have removed it a number of times from several computers and then ran ie repair off line. It always came back after repair was complete. All this was done off line. I have to believe that it exist in the installation of iexplorer from 5 and up through 6. I took a clean computer, installed win98 then went on line an installed ie5.1. I scanned with ad-aware and found alexa. Leaves no other answer.Mel

http://www.lavasoft.de/cgi-bin/forums/ikonboard.cgi?s=3c26387b23d1ffff;act=ST;f=2;t=78;hl=



Regards

eddie

 

[Rollin' Rog]

As a matter of fact I found that entry as well with the latest update. But having actually installed Alexa myself a couple of years ago, I thought it was just a remnant which Ad-aware had not detected previously.

I don't think there is any harm in either removing or leaving it. You could always restore it easily enough if you have any doubts. Just keep the backup.

By the way, is anyone else getting a script error now on this page (syntax error)?

 

[eddie5659]

Rollin'

Are you meaning this page or the link that I gave? If this one, not me. But the link sometimes does. It was a bit strange, but have to keep trying. I can get the direct route if that is the problem.

eddie

 

[hewee]

casper03,

I got the latest defenitions for adaware from Lavasoft.


TonyKlein and Rollin' Rog,

I have the latest defenitions and I can understand how you would think it was from having the Alexa because I know someone that had the Alexa software and he was cleaning up on it for months. Each new defenitions for adaware found more of Alexa.

So was your new Alexa in the same place as mine?

No script error here.

eddie5659,

Thanks there on the search you did.
I wonder why I never heard of this before because it been around a long time then.
I got the new PC last month with 98SE and the Microsoft Internet Explorer version 5.00.2614.3500 was installed with it. The date of I.E. is Friday, April 23, 1999 10:22:00 PM. You think after all that time someone would of found it.

--------------------------------------------------

I want to thank you all.

OK you can close this case.

Or wait and close it in a couple days to see what others have to say about finding Alexa.

 

[Rollin' Rog]

I think it was, but I'm not absolutely sure, I didn't even bother to back it up when I deleted it.

Weird I'm the only one getting a script error on this page

I think it's something in that html code Hewee posted, doesn't display at all for me. I can edit the post, but I can't quite catch what it is.

 

[hewee]

Rollin' Rog,

That funny because all is ok on the page for me.

I will edit my post and take off the http so they are not clickable to see what happens?

See what happen for you that is.

EDIT:
Wait I see you did edit my post above.
Did it fix it?

 

[beach51]

Hi Guys,I went to the windows update site last night and download the update it said i was missing.It was a security update dated April 2001.I could have sworn i had that update,but went ahead and downloaded it.After i download anything,i always run Ad-aware,sure enough there was Alexa.

Rog,am also getting script errors on this site only,started getting them yesterday(syntax).Just had 2 since i was typing this.

 

[TonyKlein]

And you have 'enable script debugging' unchecked in Internet Options/Advanced?

 

[beach51]

Hi Tony,yes have that unchecked.It had to come from window update.I was doing some house cleaning yesterday,removed some files,scandisk,defrag,ran Ad-aware,no spyware.Ran a virus scan,then downloaded the update like i said,ran ad-aware,and there it was.