Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

windows\system32\dxmasf32.dll is not a valid windows image


  • This topic is locked This topic is locked
2 replies to this topic

#1 huskerz7

huskerz7

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Canada
  • Local time:11:27 PM

Posted 18 May 2010 - 10:06 PM

getting continous pop ups saying *windows\system32\dxmasf32.dll is not a valid windows image*
I do not know how to remove/stop this from happening


DDS (Ver_10-03-17.01) - NTFSx86
Run by USER at 22:07:35.64 on Tue 05/18/2010
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.24 [GMT -4:00]

AV: Rogers Online Protection Anti-Virus *On-access scanning enabled* (Updated) {5B5A3BD7-8573-4672-AEA8-C9BB713B6755}
FW: Rogers Online Protection Firewall *enabled* {80593BF4-D969-4EC5-ADAE-A22F2DFC7A22}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Rogers Online Protection\Rogers Online Protection\Fws.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Rogers\SelfHealing\RogersSelfHelpService.exe
C:\Program Files\Rogers\Update Manager\RogersUpdateManager.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\Rogers Online Protection\Rogers Online Protection\SafeConnect\Bin\SanaAgent.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Rogers Online Protection\Rogers Online Protection\rps.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Rogers Online Protection\Rogers Servicepoint Agent\RogersServicepointAgent.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Rogers\SelfHealing\shs.exe
C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe
C:\Program Files\Rogers Online Protection\Rogers Online Protection\RpsSecurityAwareR.exe
D:\itunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Rogers Online Protection\Rogers Servicepoint Agent\RogersServicepointAgentComHandler.exe
C:\Documents and Settings\USER\Desktop\dds.scr
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\taskmgr.exe

============== Pseudo HJT Report ===============

BHO: {02af025a-7a30-4812-a7d9-3bd384e447ad} - c:\windows\system32\dsquery32.dll
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\smart web printing\hpswp_printenhancer.dll
BHO: HP Print Clips: {053f9267-dc04-4294-a72c-58f732d338c0} - c:\program files\hp\smart web printing\hpswp_framework.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: PopKill Class: {3c060ea2-e6a9-4e49-a530-d4657b8c449a} - c:\program files\rogers online protection\rogers online protection\pkR.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
uRun: [TomTomHOME.exe] "c:\program files\tomtom home 2\TomTomHOMERunner.exe"
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [RogersServicepointAgent.exe] "c:\program files\rogers online protection\rogers servicepoint agent\RogersServicepointAgent.exe" /AUTORUN
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [Rogers SHS] c:\program files\rogers\selfhealing\shs.exe
mRun: [Monitor] "c:\program files\leapfrog\leapfrog connect\Monitor.exe"
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "d:\itunes\iTunesHelper.exe"
dRunOnce: [nltide_2] regsvr32 /s /n /i:U shell32
mExplorerRun: [RTHDBPL] c:\docume~1\user\locals~1\temp\174.tmp
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
uPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
mPolicies-explorer: NoWelcomeScreen = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {58ECB495-38F0-49cb-A538-10282ABF65E7} - {E763472E-A716-4CD9-89BD-DBDA6122F741} - c:\program files\hp\smart web printing\hpswp_extensions.dll
IE: {700259D7-1666-479a-93B1-3250410481E8} - {A93C41D8-01F8-4F8B-B14C-DE20B117E636} - c:\program files\hp\smart web printing\hpswp_extensions.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {E68C89AA-554F-43F3-8D5E-9B36D873081B} - hxxp://www.rogershelp.com/ocf/prjOCFTools.CAB
Handler: intu-qt2009 - {03947252-2355-4e9b-B446-8CCC75C43370} - d:\tax backup\ic2009pp.dll
Notify: 3c426f10899 - c:\windows\system32\dxmasf32.dll
Notify: avgrsstarter - avgrsstx.dll
AppInit_DLLs: c:\windows\system32\dxmasf32.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-10-29 216200]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-10-29 29512]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-10-29 242896]
R1 KLIF;KLIF;c:\windows\system32\drivers\klif.sys [2009-10-30 179984]
R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-5-12 611664]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-3-15 916760]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-3-15 308064]
R2 PD91Agent;PD91Agent;c:\program files\raxco\perfectdisk2008\PD91Agent.exe [2008-9-22 693512]
R2 RadialpointSafeConnectAgent;Rogers Online Protection SafeConnectAgent;c:\program files\rogers online protection\rogers online protection\safeconnect\bin\SanaAgent.exe [2008-11-14 4937752]
R2 RogersSelfHelpService;Rogers SHS Service;c:\program files\rogers\selfhealing\RogersSelfHelpService.exe [2008-5-16 140648]
R2 RogersUpdateManager;Rogers Update Manager;c:\program files\rogers\update manager\RogersUpdateManager.exe [2008-4-22 163840]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-11-13 92008]
R3 Radialpoint Security Services;Rogers Online Protection;c:\program files\rogers online protection\rogers online protection\RpsSecurityAwareR.exe [2009-6-22 170736]
R3 RadialpointSafeConnectDriver;RadialpointSafeConnectDriver;c:\program files\rogers online protection\rogers online protection\safeconnect\driver\platform_xp\SafeConnectDriver.sys [2008-11-14 161304]
R3 RadialpointSafeConnectFilter;RadialpointSafeConnectFilter;c:\program files\rogers online protection\rogers online protection\safeconnect\driver\platform_xp\SafeConnectFilter.sys [2008-11-14 29720]
R3 RadialpointSafeConnectShim;RadialpointSafeConnectShim;c:\program files\rogers online protection\rogers online protection\safeconnect\driver\platform_xp\SafeConnectShim.sys [2008-11-14 27376]
S2 gupdate1ca63169809c38c;Google Update Service (gupdate1ca63169809c38c);c:\program files\google\update\GoogleUpdate.exe [2009-11-11 133104]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [2010-1-8 18560]
S3 PD91Engine;PD91Engine;c:\program files\raxco\perfectdisk2008\PD91Engine.exe [2008-9-22 910600]

=============== Created Last 30 ================

2010-05-19 01:22:44 284672 ----a-w- c:\windows\system32\dnssd32.dll
2010-05-19 01:21:06 0 ----a-w- c:\documents and settings\user\defogger_reenable
2010-05-19 00:30:26 284672 ----a-w- c:\windows\system32\dinput832.dll
2010-05-18 23:23:27 284672 ----a-w- c:\windows\system32\dfshim32.dll
2010-05-18 22:22:49 284672 ----a-w- c:\windows\system32\dpnet32.dll
2010-05-18 21:22:40 284672 ----a-w- c:\windows\system32\dmsynth32.dll
2010-05-18 20:22:57 284672 ----a-w- c:\windows\system32\dsprop32.dll
2010-05-18 20:21:11 20 ----a-w- c:\windows\system32\DXMASF32.DLL
2010-05-18 19:22:21 284672 ----a-w- c:\windows\system32\dataclen32.dll
2010-05-18 18:22:19 284672 ----a-w- c:\windows\system32\d3dx9_3532.dll
2010-05-15 12:09:00 0 d-----w- c:\program files\FunWebProducts
2010-05-15 11:59:20 283648 ----a-w- c:\windows\system32\dsquery32.dll
2010-05-11 23:14:00 280064 ----a-w- c:\windows\system32\dpserial32.dll
2010-05-11 11:37:26 280064 ----a-w- c:\windows\system32\dmstyle32.dll
2010-05-11 10:41:33 280064 ----a-w- c:\windows\system32\drmv2clt32.dll
2010-05-11 09:43:20 280064 ----a-w- c:\windows\system32\dnsapi32.dll
2010-05-11 08:36:32 280064 ----a-w- c:\windows\system32\dplay32.dll
2010-05-11 07:36:24 280064 ----a-w- c:\windows\system32\dmintf32.dll
2010-05-11 06:36:28 280064 ----a-w- c:\windows\system32\docprop232.dll
2010-05-11 05:36:00 280064 ----a-w- c:\windows\system32\d3dx10_4132.dll
2010-05-11 04:35:55 280064 ----a-w- c:\windows\system32\faultrep32.dll
2010-05-11 03:35:53 280064 ----a-w- c:\windows\system32\extmgr32.dll
2010-05-11 02:35:53 280064 ----a-w- c:\windows\system32\evr32.dll
2010-05-11 01:35:46 280064 ----a-w- c:\windows\system32\eapp3hst32.dll
2010-05-11 00:35:43 280064 ----a-w- c:\windows\system32\duser32.dll
2010-05-08 17:37:45 39 ----a-w- c:\windows\system32\6cc26817
2010-05-05 20:50:16 280064 ----a-w- c:\windows\system32\dot3ui32.dll
2010-05-05 19:49:39 280064 ----a-w- c:\windows\system32\exts32.dll
2010-05-05 18:49:30 280064 ----a-w- c:\windows\system32\dxtmsft32.dll
2010-05-05 17:49:29 280064 ----a-w- c:\windows\system32\dx7vb32.dll
2010-05-05 16:58:04 5726 ----a-w- c:\windows\GnuHashes.ini
2010-05-05 16:50:48 943 --sha-w- c:\windows\system32\1813135168
2010-05-05 16:50:47 817 ----a-w- c:\windows\system32\1010986768
2010-05-05 16:49:52 280064 ----a-w- c:\windows\system32\htui32.dll
2010-05-05 16:49:43 113 ----a-w- c:\windows\system32\sl234073554
2010-05-05 16:49:43 0 d-sh--w- c:\windows\system32\SysWoW32
2010-05-05 16:49:26 203776 --sh--w- c:\windows\system32\unrar.exe
2010-05-05 16:49:26 0 d-----w- c:\windows\system32\242223223
2010-05-05 16:49:23 0 d-sh--w- c:\docume~1\user\applic~1\SystemProc
2010-05-05 16:49:01 1081856 --sha-w- c:\windows\system32\6C8.tmp
2010-05-05 16:48:56 284672 ----a-w- c:\windows\system32\iassvcs32.dll

==================== Find3M ====================

2010-05-19 01:45:41 43298336 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-05-19 01:27:04 388128 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-05-15 12:25:30 38168 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-05-15 12:25:29 582728 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-05-04 13:31:04 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-03-26 16:33:02 141136 ----a-w- c:\windows\hpoins14.dat
2010-03-15 12:50:25 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-10-29 20:55:48 16384 --sha-w- c:\windows\system32\config\systemprofile\cookies\index.dat
2009-10-29 20:55:55 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\index.dat
2009-10-29 20:55:55 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009102920091030\index.dat
2009-10-29 20:55:48 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\index.dat

============= FINISH: 22:19:44.14 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 syler

syler

  • Malware Response Team
  • 8,150 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Warrington, UK
  • Local time:04:27 AM

Posted 20 May 2010 - 09:25 AM

Hello and and Welcome to Bleepingcomputer

Please note we are very busy, so if I don't hear from you within 5 days the topic will be closed, If you have since
resolved your issues I would appreciate if you would let me no so I can close this topic.


We need to create an OTL Report
  1. Please download OTL from one of the following mirrors:
  2. Save it to your desktop.
  3. Double click on the icon on your desktop.
  4. Click the "Scan All Users" checkbox.
    Under the Custom Scans/Fixes box at the bottom, paste in the following bold text.
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemroot%\*. /mp /s
    %SYSTEMDRIVE%\*.exe
    netsvcs
    msconfig
    drivers32
    CREATERESTOREPOINT

  5. Push the button.
  6. Two reports will open, copy and paste them in a reply here:
    • OTL.txt <-- Will be opened
    • Extra.txt <-- Will be minimized

Thanks

unite.jpg


#3 syler

syler

  • Malware Response Team
  • 8,150 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Warrington, UK
  • Local time:04:27 AM

Posted 25 May 2010 - 10:05 AM

Due to the lack of feedback this Topic is closed.

If you need this topic reopened, please request this by sending me a PM
with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.

unite.jpg





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users