Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

odfanman.exe, IE popups


  • Please log in to reply
1 reply to this topic

#1 vierof

vierof

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:43 AM

Posted 16 September 2005 - 03:06 PM

I constanly (every few seconds new one) have the annoying popup windows "Internet Explorer has encountered a problem and needs to close".
And when I am shutting down my computer I always see the message "OdFanMan.exe DLL initialization failed"

My last Hijack this log file:

Logfile of HijackThis v1.99.1
Scan saved at 7:14:19 AM, on 9/16/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\unzipped\hijackthis\HijackThis.exe

O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe




Last Ewido log file (in safe mode)


---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 12:55:23 PM, 9/16/2005
+ Report-Checksum: 5E970D62

+ Scan result:

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP797\A0077922.exe -> TrojanDropper.Agent.hl : Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP800\A0081997.exe -> TrojanDropper.Agent.hl : Cleaned without backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP804\A0101934.exe -> Trojan.Pakes : Cleaned without backup
C:\WINDOWS\SYSTEM32\nppyu.dll -> Spyware.Adstart : Cleaned without backup
C:\WINDOWS\SYSTEM32\vgomj.dll -> Spyware.Adstart : Cleaned without backup


::Report End


I still have the same old and a few new problems

Odfanman.exe (certainly a spy) could not be deleted by used antispy programs and I found it in folder "../Program Files/Reamaker" together with ace.dll, atl.dll, rnrscp32.exe and other files, which were never found or deleted with antispy software. If I remove this file "Odfanman.exe" I am not able to start Windows in normal mode (system crashes) and only safe mode is possible.

During last week I used Ad-Aware, SpyBot, Spy Sweeper, Ewido and other software including Microsoft's AntiSpy Beta 1 and removed few (may be hundred !!) spy programs from my computer

BC AdBot (Login to Remove)

 


#2 OldTimer

OldTimer

    Malware Expert


  • Members
  • 11,092 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:North Carolina
  • Local time:11:43 AM

Posted 20 September 2005 - 08:21 AM

Hello vierof and welcome to the BC HijackThis forum. If that is the entire HijackThis log I am surprised the machine even starts up. there is nothing in it.

Let's try a different scanner and see what it shows us.

Download WinPFind.zip and unzip the contents to the C:\ folder.

Start in Safe Mode Using the F8 method:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until the boot menu appears.
  • Use the arrow keys to select the Safe Mode menu item.
  • Press the Enter key.
Locate the c:\winpfind\winpfind.exe file and double-click it to run it. Now click the Start Scan button to begin the scan.

When the scan is complete reboot normally and post the WinPFind.txt file (located in the WinPFind folder) back here along with a new HijackThis log and I will review the information when it comes in.

OT
I do not respond to PM's requesting help. That's what the forums are here for. Please use them so that others may benefit from your questions and the responses you receive.
OldTimer

Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users