c:\windows\system32\cmd.exe/c erase

  3 phase 08:05 23 May 05

Ad watch keeps bringing up this file alert, the words 'c erase' bothers me greatly so I hit 'don't accept'.

I've done a google search and been directed to Techsupportforum.com; having registered at that site I find I'm now unable to log in - possibly due to Spybot preventing the loading of Avenue A - I get a similar problem at other tech help sites.
The Ad watch alert looks worrying so
1. can anyone confirm it is?
2. how do I work round the Spybot block if that indeed is what's preventing me from logging into Techsupportforum.com?
3. anyone got any better ideas about how to proceed?


  Diemmess 10:21 23 May 05

This looks like an infestation of malware calling for help from those who understand how to use HiJackThis. (I don't, but have had a lot of help)

Nellie2 is one of the most able and generous contributors to this site and if you can gain her help you can be guided through the complex process of cleaning all the gubbins away.

I suggest you download and run CClean, and Ad-Aware first to clear the basic nonsense.

Then download and run the latest HijackThis, save the log (it goes into a Notepad file)

Copy and Paste this log with a title "Nellie2 Help"....... BUT do it in about 3 successive posts because it will exceed the 800 word limit if you try and send it all at once.

Finally it will make things much easier all round if you paste a chunk and then edit it with an extra line space at the end of each line. If you don't, then the whole lot will squash up into one almost unreadable block.

  gudgulf 10:52 23 May 05

Do you get any other information?.......that looks like the sort of script set up by something such as Adaware itself to remove a file/folder on a computer reboot.It's normally in the registry under the "run-once" category and would normally have a target file or folder listed.Does Adwatch give you the full path?

Check your cookie handling settings to see if they are blocking access to the Tech support forums.You can also temporarily remove Avenue A from Spybot's block list by switching to the advanced mode from the main SpybotS&D control panel and selecting Settings then Ignore Products.You will find Avanue A in the Cookies or All Products list.Just put a tick in the box to stop it from being blocked.....Avenue A is just a tracking cookie so not really anything to worry about.Lots of sites use them.

  3 phase 09:38 27 May 05

Thanks for the suggestions; I'm getting there - slowly.
can now log into TechSupportForum, and am in the midst of doing their suggested invertigation.

'gudgulf' Not sure why Ad-watch from AdAware would flag up one of it's own pieces of script. However, you asked for the full path, here it is following on from the first part of the path as used in the title of thsi thread

...c erase"C:\docume~1suzsi\locals~1\temp\acsinstall.dll

mean anything to you?

  gudgulf 10:32 27 May 05

It means you should clear out all your Temporary files....CleanUp click here and ccleaner click here are both good tools to do this.Make sure you know all your passwords and stored user names etc because unless you opt to keep cookies/stored passwords in the settings for these programs they will clean them too.Ccleaner has an "Issues" tab,you should also run that and fix all that it finds.

Anything that wants to run from a "temp" directory is suspicious.

As for Adwatch flagging Adaware.. When you run CleanUp it usually finds files that it can't delete from Windows...It will ask you to restart windows and delete the files as Windows boots.To do that it will set a script much like the one in the title of your thread.It will also set startup entries in the registry to execute the delete command.Sorry a bit long winded but basically I was wondering if Adwatch was picking up that kind of activity from a program wanting to delete a file quite legitimately at Windows bootup.

Clear your temporary files and see if that solves the problem.

  gudgulf 11:02 27 May 05

acsinstall.dll seems to be something to do with the AOL connectivity service........do you use or have you recently removed AOL?

  3 phase 11:36 04 Jun 05

Seems like Tech Support Forum is taking me to some sort of resolution on this problem -

Thanks for you help

This thread is now locked and can not be replied to.

How to watch Windows Event live stream, live blog | Microsoft event live stream: Watch Microsoft…

1995-2015: How technology has changed the world in 20 years

This amazing app turns your iPad Pro into a Cintiq

iPhone 7 Plus review: A superb big-screen phablet, but the price tag's enormous | iPhone 7 Plus…