Windows Task Ad ?? Anyone know what this is?

  SteveD73 22:35 07 Dec 04
Locked

Hope someone can help me. I discovered hijack this a while back and it is fantastic when used in conjunction with hijackthis.de
You simply save results as a .txt and let this url analyse them.
It then gives each entry either a tick,a cross or a ?
I've managed to get rid of all the nasty crosses , but still have a few entries with "?'s" next to them.
They seem to relate to something in my Program File called
"Windows TaskAd"
The windows bit suggests it's legit,but is it??
Here are the entries:
C:\Program Files\Windows TaskAd\WinTaskAd.exe
C:\Program Files\Windows TaskAd\WinSched.exe
(both say unknown process)
O4 - HKLM\..\Run: [Windows TaskAd] C:\Program Files\Windows TaskAd\WinTaskAd.exe
(Says unknown application)
Any help much appreciated.

  VoG II 22:43 07 Dec 04

Trying to fix these things automatically is *a very very bad idea*.

Post the full log here please. Make sure you are using the latest version click here

You may need to post it in chunks because of the 800 word limit on this site. Also please double-space it by adding a blank line every other line.

  SteveD73 22:53 07 Dec 04

Logfile of HijackThis v1.98.2
Scan saved at 22:13:25, on 07/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Norton Internet Security\NISUM.EXE

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Norton Internet Security\SymProxySvc.exe

C:\Program Files\Norton Internet Security\NISSERV.EXE

C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Ahead\InCD\InCD.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Norton Internet Security\IAMAPP.EXE

C:\PROGRA~1\NORTON~1\navapw32.exe

C:\Program Files\Logitech\iTouch\iTouch.exe

C:\Program Files\Common
Files\Real\Update_OB\realsched.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Windows TaskAd\WinTaskAd.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\Program Files\Windows TaskAd\WinSched.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Steve\Desktop\HIJACKTHIS\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = click here

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

  SteveD73 23:01 07 Dec 04

O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [iamapp] C:\Program Files\Norton Internet Security\IAMAPP.EXE

O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe

O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Windows TaskAd] C:\Program Files\Windows TaskAd\WinTaskAd.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: Yahoo! Pool 2 - click here

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - click here

O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - click here

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - click here

O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - click here

O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - click here

Hope I've done this correctly..You obv know much more than I about these things.Can I just ask what is wrong with using hijackthis.de.
It doesn't automatically fix anything,it merely suggests problems by flagging them up with big red crosses or amber question marks. The ammending is left to the user. I have used this method a few times and as a novice have found it a useful tool. Opinion?

  Nellie2 07:05 08 Dec 04

Hi SteveD73

If it were as easy as usuing an automatic anyliser then I would have a lot more free time on my hands... I might even get to watch Corrie now and then!! :D

A lot of work has gone into hijackthis.de but there is a bit more to keeping your system free of spyware than just fixing a few entries in a log... some things need to be done in a certain order, files and folders need to be hunted for and deleted, sometimes it takes a bit more than just a fix using hijackthis... there are so many variables.

The problem you have flagged is quite common now, its called Windupdates click here

Bring up task manager, Ctrl-Alt-Del and end these processes if you see them;

WinTaskAd.exe
WinSched.exe

Then run hijackthis and fix the following;

O4 - HKLM\..\Run: [Windows TaskAd] C:\Program Files\Windows TaskAd\WinTaskAd.exe

Then delete this folder;

C:\Program Files\Windows TaskAd

You should be able to delete it ok in normal mode, but if you have any problems with it then try booting into safe mode to do it.

Hope that helps.

  SteveD73 10:52 08 Dec 04

Thanks so much for your time & effort with this. It is very much appreciated. Will have a go with your instructions tonight.
Thanks Again
sTEVE

This thread is now locked and can not be replied to.

How to get Windows 10 for free | How to install Windows 10: There is still a way to avoid paying…

1995-2015: How technology has changed the world in 20 years

Alex Chinneck’s giant ice cube Christmas tree at Kings Cross

Apple rumours & predictions 2017: The iPhone 8, new iPads, and everything else you should expect fr7…