Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Problems with running Rootrepeal and crashing


  • This topic is locked This topic is locked
2 replies to this topic

#1 cocodemer

cocodemer

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:02:01 AM

Posted 19 April 2009 - 05:32 PM

Hi

I have been having problems after accidentaly downloading WinPC defender onto my laptop, with nasty pop up consequences. I tried a few antimalware programs but nothing was working, It had also loaded Windowsclick,you can read about the progress I have made with these problems here

http://www.bleepingcomputer.com/forums/ind...p;#entry1221990

When I tried to run Rootrepeal and also DrwebCure-it the machine crashed. As you can see it has been sugested I post here, presumably to get a better overview of the general state of my laptop. Here are the DDS files:


DDS (Ver_09-03-16.01) - NTFSx86
Run by Colin at 23:03:26.37 on 19/04/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.447.59 [GMT 1:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Colin\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/
uSearch Page = hxxp://www.google.com
uWindow Title = Microsoft Internet Explorer provided by Orange
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: ST: {9394ede7-c8b5-483e-8773-474bf36af6e4} - c:\program files\msn apps\st\01.03.0000.1005\en-xu\stmain.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: MSNToolBandBHO: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\msn apps\msn toolbar\msn toolbar\01.02.5000.1021\en-us\msntb.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll
TB: MSN: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\msn apps\msn toolbar\msn toolbar\01.02.5000.1021\en-us\msntb.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File
TB: {4E7BD74F-2B8D-469E-A1FB-F862B587B57D} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [Power2GoExpress]
uRun: [MsnMsgr] "c:\program files\msn messenger\MsnMsgr.Exe" /background
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [VTTimer] VTTimer.exe
mRun: [VTTrayp] VTtrayp.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [{1290A33C-85F5-4164-A1BE-7DD299D4986A}] "c:\program files\cyberlink\powerbackup\PBKScheduler.exe"
mRun: [PCMService] "c:\program files\cyberlink\powercinema\PCMService.exe"
mRun: [REGSHAVE] c:\program files\regshave\REGSHAVE.EXE /AUTORUN
mRun: [SunJavaUpdateSched] c:\program files\java\jre1.5.0_03\bin\jusched.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
dRun: [ctfmon.exe] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-4-9 325640]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-4-9 27656]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-4-9 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-4-9 298264]
S0 szkg5;szkg;c:\windows\system32\drivers\szkg.sys --> c:\windows\system32\drivers\szkg.sys [?]
S3 pnicml;pnicml;\??\c:\docume~1\colin\locals~1\temp\pnicml.sys --> c:\docume~1\colin\locals~1\temp\pnicml.sys [?]
S3 s3chipid;s3chipid;\??\c:\docume~1\colin\locals~1\temp\s3chipid.sys --> c:\docume~1\colin\locals~1\temp\s3chipid.sys [?]

=============== Created Last 30 ================

2009-04-19 22:11 -cd----- c:\program files\Cobian Backup 9
2009-04-18 13:26 -cd----- c:\documents and settings\colin\DoctorWeb
2009-04-17 13:28 0 ac------ c:\documents and settings\colin\settings.dat
2009-04-16 18:17 -cd----- c:\docume~1\colin\applic~1\Malwarebytes
2009-04-16 17:46 15,504 ac------ c:\windows\system32\drivers\mbam.sys
2009-04-16 17:46 38,496 ac------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-16 17:46 -cd----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-04-16 17:23 473,600 -c------ c:\windows\system32\dllcache\fastprox.dll
2009-04-16 17:23 453,120 -c------ c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 17:23 401,408 -c------ c:\windows\system32\dllcache\rpcss.dll
2009-04-16 17:23 284,160 -c------ c:\windows\system32\dllcache\pdh.dll
2009-04-16 17:23 227,840 -c------ c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 17:23 110,592 -c------ c:\windows\system32\dllcache\services.exe
2009-04-16 17:23 729,088 -c------ c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 17:23 714,752 -c------ c:\windows\system32\dllcache\ntdll.dll
2009-04-16 17:23 617,472 -c------ c:\windows\system32\dllcache\advapi32.dll
2009-04-16 17:22 -cd----- c:\program files\Malwarebytes' Anti-Malware
2009-04-16 17:22 2,560 -c------ c:\windows\system32\xpsp4res.dll
2009-04-16 17:22 1,203,922 -c------ c:\windows\system32\dllcache\sysmain.sdb
2009-04-16 17:22 215,552 -c------ c:\windows\system32\dllcache\wordpad.exe
2009-04-13 21:22 -cd-h--- C:\$AVG8.VAULT$
2009-04-13 14:43 -cd----- c:\windows\pss
2009-04-12 20:43 -cd----- c:\program files\Enigma Software Group
2009-04-09 21:24 10,520 ac------ c:\windows\system32\avgrsstx.dll
2009-04-09 21:24 108,552 ac------ c:\windows\system32\drivers\avgtdix.sys
2009-04-09 21:23 325,640 ac------ c:\windows\system32\drivers\avgldx86.sys
2009-04-09 21:23 -cd----- c:\windows\system32\drivers\Avg
2009-04-09 21:22 -cd----- c:\program files\AVG
2009-04-09 21:22 -cd----- c:\docume~1\alluse~1\applic~1\avg8
2009-04-09 19:08 -cd----- c:\program files\Spybot - Search & Destroy
2009-04-09 19:08 -cd----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-04-01 17:34 159,744 ac------ c:\windows\system32\lfpng13n.dll
2009-04-01 17:34 462,848 ac------ c:\windows\system32\ltkrn13n.dll
2009-04-01 17:34 450,560 ac------ c:\windows\system32\ltimg13n.dll
2009-04-01 17:34 401,408 ac------ c:\windows\system32\lfcmp13n.dll
2009-04-01 17:34 299,008 ac------ c:\windows\system32\ltdis13n.dll
2009-04-01 17:34 206,336 ac------ c:\windows\system32\ltefx13n.dll
2009-04-01 17:34 163,840 ac------ c:\windows\system32\ltfil13n.dll
2009-04-01 17:34 69,632 ac------ c:\windows\system32\lfgif13n.dll
2009-04-01 17:34 57,344 ac------ c:\windows\system32\lfbmp13n.dll
2009-03-21 15:06 989,696 -c------ c:\windows\system32\dllcache\kernel32.dll

==================== Find3M ====================

2009-03-06 15:22 284,160 ac------ c:\windows\system32\pdh.dll
2009-03-03 01:18 826,368 ac------ c:\windows\system32\wininet.dll
2009-02-20 19:09 78,336 ac------ c:\windows\system32\ieencode.dll
2009-02-09 13:10 729,088 -c------ c:\windows\system32\lsasrv.dll
2009-02-09 13:10 714,752 ac------ c:\windows\system32\ntdll.dll
2009-02-09 13:10 617,472 ac------ c:\windows\system32\advapi32.dll
2009-02-09 13:10 401,408 ac------ c:\windows\system32\rpcss.dll
2009-02-09 12:13 1,846,784 -c------ c:\windows\system32\win32k.sys
2009-02-07 19:02 2,066,048 ac------ c:\windows\system32\ntkrnlpa.exe
2009-02-06 12:11 110,592 ac------ c:\windows\system32\services.exe
2009-02-06 12:08 2,189,056 ac------ c:\windows\system32\ntoskrnl.exe
2009-02-06 11:39 35,328 ac------ c:\windows\system32\sc.exe
2009-02-03 20:59 56,832 ac------ c:\windows\system32\secur32.dll
2006-06-23 09:16 0 ac------ c:\docume~1\colin\applic~1\wklnhst.dat
2006-04-10 15:32 56 -c-shr-- c:\windows\system32\CAFFA869B5.sys
2006-04-10 15:32 3,766 ac-sh--- c:\windows\system32\KGyGaAvL.sys
2008-11-29 19:25 32,768 ac-sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008112920081130\index.dat

============= FINISH: 23:04:05.06 ===============

At the moment the machine seems to be running fine with no noticeable slow running, but I havent really tested it. the only things I know for sure arent working are Rootrepeal, and Drweb cureit.

Any advice on where to go from here to complete the clean up would be great.

Thanks

BC AdBot (Login to Remove)

 


#2 Baabiouz

Baabiouz

    Finnish Malware Fighter


  • Members
  • 3,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:10:01 AM

Posted 03 May 2009 - 01:16 PM

Hello

Apologize for the delay in response we get overwhelmed at times but we are trying our best to keep up.
If you have since resolved the original problem you were having would appreciate you letting us know If not please perform the following below so I can have a look at the current condition of your machine.

Thanks and again sorry for the delay.

Before we can continue I need to see a fresh HijackThis log. Would you please send a fresh HijackThis log here? :thumbup2:
Posted Image

#3 Baabiouz

Baabiouz

    Finnish Malware Fighter


  • Members
  • 3,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:10:01 AM

Posted 10 May 2009 - 03:48 AM

This thread will now be closed.
If you need this topic reopened, please contact me.

This applies only to the original topic starter.
Everyone else please begin a New Topic.
Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users