twaintech.inf

Spybot found this file on my comp but I can find very little info related to this and if there is anymore files I should be looking for. Or how the heck it got on my computer in the first place!!

Any information would be great

 

Hi Brent,
This link may help you find the culprit though I am not sure if twaintech or twiantec are one and the same:

http://www.pcsympathy.com/gate.html?name=Forums&file=viewtopic&t=211

Here is a quote from it

Quote: Files:

temp\THI23C8.tmp
preInsTT.exe
twaintec.dll
twaintec.inf

Temp\
bi_prob.exe
dummy.htm
twaintec.ini
twtini.cab
twtini.inf

About:
Quote:

Twain-Tech is a software development company. We have developed a series of ad
targeting applications such as Twain-Tech.dll that help advertisers deliver targeted
ads. In addition to our software development, we also provide certain support services
to the distributors of our software.

Third party companies license and distribute our software, typically as part of their
sponsorship of free software or free content. As part of any licensing of our software,
Twain-Tech contractually requires all distributors to give notice concerning the
presence of our software and to provide consumers access to a Twain-Tech supplied

HTH Pilli

 

If you rightclick a .inf file and open it in notepad it can do no harm.
Could you do that and post what's inside.
That might reveal what it is and where it came from.

Regards,

Pieter

 

[version]
signature="$CHICAGO$"
AdvancedINF=2.0

[DefaultInstall]
CopyFiles=CopySystemFiles,INFFile
RegisterOCXs=RegisterOCXSection
AddReg=RegUninstall
RunPostSetupCommands=RunPostInstall,RunPol

[CopySystemFiles]
twaintec.dll,,,34
preInsTT.exe,,,34
polall1t.exe,,,34

[INFFile]
twaintec.inf,,,34

[DestinationDirs]
CopySystemFiles=10
INFFile=17

[RegisterOCXSection]
"%10%\twaintec.dll"

[DelRegEntries]
HKLM,Software\twaintec

[RunPostInstall]
"%10%\preInsTT.exe"

[Runpol]
"%10%\polall1t.exe /regserver"

[SourceDisksNames]
1="CAB File",,,

 

I have no idea how it got on my computer. I run Spybot everyday. Seems like it may be a new entry into spybots detection rules maybe?

 

Passing through some sites with malicious scripts, Java or Active x is all you need to do if you are using Internet Explorer.
Firefox or Opera are safer alternatives, just use IE on trusted sites, Windows update etc.

 

The reference to twaintec.dll settles that it is the malware
http://www.pchell.com/support/twaintec.shtml
As stated there it usually comes as "bundleware"

Regards,

Pieter

 

Whats weird is I have some of the files it lists but not all of them? I dont have the entry in Add/Remove and I dont have twaintec.dll... just twaintec.inf(spybot removed it already) and mxtarget.dll

 

Could it be it was stopped during the install ? (maybe due to some protecting software). That would explain some of the files being present and no entry in Add/Remove Software.

Or the rest was all removed earlier, but the first possibility seems more likely.

Regards,

Pieter

 

Neither Spybot or Adaware had found this on any of my 4 XP machines. Just installed PestPatrol on my 4th box and there it is again. I have Spybot and Adaware set to scan EVERYTHING on my systems and run both VERY regularily. It didn't show up in add/remove on any of the sysytems, so I'm guessing either Spybot or Spywareblaster blocked the install.

 

This is the third thread I have seen twainTec mentioned and in both cases, Pest Patrol played a part along with SpywareBlaster.

snapdragin gave a good post in this thread

https://www.wilderssecurity.com/showthread.php?t=45183


and here is other one...

https://www.wilderssecurity.com/showthread.php?t=45037

Cheers, TAS