twaintech.inf

Discussion in 'other security issues & news' started by Brent, Jul 29, 2004.

Thread Status:
Not open for further replies.
  1. Brent

    Brent Registered Member

    Joined:
    Jun 22, 2004
    Posts:
    71
    Spybot found this file on my comp but I can find very little info related to this and if there is anymore files I should be looking for. Or how the heck it got on my computer in the first place!!

    Any information would be great :)
     
  2. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi Brent,
    This link may help you find the culprit though I am not sure if twaintech or twiantec are one and the same:

    http://www.pcsympathy.com/gate.html?name=Forums&file=viewtopic&t=211

    Here is a quote from it

    Quote: Files:

    temp\THI23C8.tmp
    preInsTT.exe
    twaintec.dll
    twaintec.inf

    Temp\
    bi_prob.exe
    dummy.htm
    twaintec.ini
    twtini.cab
    twtini.inf

    About:
    Quote:

    Twain-Tech is a software development company. We have developed a series of ad
    targeting applications such as Twain-Tech.dll that help advertisers deliver targeted
    ads. In addition to our software development, we also provide certain support services
    to the distributors of our software.

    Third party companies license and distribute our software, typically as part of their
    sponsorship of free software or free content. As part of any licensing of our software,
    Twain-Tech contractually requires all distributors to give notice concerning the
    presence of our software and to provide consumers access to a Twain-Tech supplied


    HTH Pilli
     
  3. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,331
    Location:
    Netherlands
    If you rightclick a .inf file and open it in notepad it can do no harm.
    Could you do that and post what's inside.
    That might reveal what it is and where it came from.

    Regards,

    Pieter
     
  4. Brent

    Brent Registered Member

    Joined:
    Jun 22, 2004
    Posts:
    71
    [version]
    signature="$CHICAGO$"
    AdvancedINF=2.0

    [DefaultInstall]
    CopyFiles=CopySystemFiles,INFFile
    RegisterOCXs=RegisterOCXSection
    AddReg=RegUninstall
    RunPostSetupCommands=RunPostInstall,RunPol

    [CopySystemFiles]
    twaintec.dll,,,34
    preInsTT.exe,,,34
    polall1t.exe,,,34

    [INFFile]
    twaintec.inf,,,34

    [DestinationDirs]
    CopySystemFiles=10
    INFFile=17

    [RegisterOCXSection]
    "%10%\twaintec.dll"

    [DelRegEntries]
    HKLM,Software\twaintec

    [RunPostInstall]
    "%10%\preInsTT.exe"

    [Runpol]
    "%10%\polall1t.exe /regserver"

    [SourceDisksNames]
    1="CAB File",,,
     
  5. Brent

    Brent Registered Member

    Joined:
    Jun 22, 2004
    Posts:
    71
    I have no idea how it got on my computer. I run Spybot everyday. Seems like it may be a new entry into spybots detection rules maybe?
     
  6. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Passing through some sites with malicious scripts, Java or Active x is all you need to do if you are using Internet Explorer.
    Firefox or Opera are safer alternatives, just use IE on trusted sites, Windows update etc.
     
  7. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,331
    Location:
    Netherlands
  8. Brent

    Brent Registered Member

    Joined:
    Jun 22, 2004
    Posts:
    71
    Whats weird is I have some of the files it lists but not all of themo_O? I dont have the entry in Add/Remove and I dont have twaintec.dll... just twaintec.inf(spybot removed it already) and mxtarget.dll
     
  9. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,331
    Location:
    Netherlands
    Could it be it was stopped during the install ? (maybe due to some protecting software). That would explain some of the files being present and no entry in Add/Remove Software.

    Or the rest was all removed earlier, but the first possibility seems more likely.

    Regards,

    Pieter
     
  10. honorable1nut

    honorable1nut Registered Member

    Joined:
    Apr 28, 2004
    Posts:
    19
    Neither Spybot or Adaware had found this on any of my 4 XP machines. Just installed PestPatrol on my 4th box and there it is again. I have Spybot and Adaware set to scan EVERYTHING on my systems and run both VERY regularily. It didn't show up in add/remove on any of the sysytems, so I'm guessing either Spybot or Spywareblaster blocked the install.
     
  11. Tassie_Devils

    Tassie_Devils Global Moderator

    Joined:
    May 8, 2002
    Posts:
    2,514
    Location:
    State Queensland, Australia
Thread Status:
Not open for further replies.