Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Downloading and running DDS


  • This topic is locked This topic is locked
1 reply to this topic

#1 McTash

McTash

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Location:Northampton, England
  • Local time:09:44 AM

Posted 27 August 2010 - 11:32 AM

Hi all

Following a malware infection, I am in the process of follwing the instruction on the thread 'Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help'. However, DDS does not appear to be working as described (I am using Firefox, as IE has not worked since the infection). I can download the file dds.scr and move it to my desktop. However, opening the file just brings up a notepad with what appears to be some form of hierogplyphics displayed, not the black screen shown in the post:

below is part of the contents of this notepad:

MZ   @  !L!This program cannot be run in DOS mode.

$ PE L +I  2 n Z   @     0  f          .code     PEC2FO .rsrc    $R Pd5 d% 3PECompact2 VK ўoTN<N<T#=L34w
lTS`M6lՍ[NPHr_0)a ؾ,f)|Bţ3]ˣoKjvh-Pw4l4` \3nfwp"nseXcDgϨ|0 O E J\#2\bN\Mk(^EK] m
<_@tHw,K{YwCdAEj]vWbڰ.ϓcF (C&{;yU2)[)g*uŊ0ʫ䜁M呎s
PKڟ}Cb{/p=_IѶ_' ֐`VSJYgĹ|_KwD ;6ИoOGS̷c7KgB-6Xfv-pĝ]PmUu ;&ƲoY-00
+=C<%#ɚxu C1y4jST)<H]nwPmq*?>?244 i)mK᪆+:@C
N>t-dDS[.^ݏ|@ِtP\R-TqLAu\hcD4fi]6nl
o@AFGo*=ܔ|Hϗ~'VR
`m۟IͬK1Ux>ARC)^M.!5 ?S& vjulB礪`2vb'
J:%Æ5,
h23g/C\.2wiL%g𞁇ji]f˓@U?@.H0߽$UwGBݜԣb]jڞe
)l Lz?j,Bћw`UE[ԃPFW'
Ӛ𜤊h2QNY2ע:ڏ"5_:fyfƈɘ2V" Gx ys{[ "}g+Zqp=sA
0 Nİ"fC0:m4g3 %۹ά͢
<WqW0Y],AlBw$
]agH(aIyց>(D P5Z{qR9*.r)791;rT5X{ ; 1
಴X̠0fTq{ 00|-_
۾%h;s?8PVz^Po?&%fKx_IPzPHi@l0Y!)ߵl=*M3| kY6m&鼦 qO͖hCܾ1=K1
T 5BIk>yI~v +:`
60-npvpT^ }}LJqScs!
FcZ4qkh/g↎5i/>!J$^`S$(]4*\Vɶq9DK3v:32XEղB7Žbk.K{ ɱ滝v8]e Mp92S -4!/M[#C~*`"_Ǥ*Qޭ9hm!I獚b ;)!ƿfWJriK̦#BϚʱv߬qNU_5&΢Z׽ S .tP7i^ țvSQ!`[@7z35dD@tqToehK$w!cDzXCUUY3P+O"%x&1IxMoh*}od6#$"~IXڷl既ΔֿUFIo`C&K49.!+(ʯ%0'g "By;OAwdž<.ªYŜlJǐ=v0/5mjtwu.5g"[/~|6}Nnf9<?Sт &.0BY D{NhٽFrqi0sl򥥼4!;xĠxug3eZrjN#h=s`U=ca]Ĵu{\ ։Ja)cpjJjW)nۧVB\k0:T6i͗|H [Tu5oPE#^
)MU\ N/Kt!yc-
֒Ī,eH/C!yI<&PK
gMefF
 XBc O 0BmBh9t腗u'j]nėz#
2{+X21z
~S=|auO'ў#pgm5;_vfVu6sh_~d2;]|R'_U
m@G?])[B+;$x44=Q(b ۗ[@UёyZ$$qBb΂zٸskrY- d5UXI(*ygkJB64ZG7b'XSIҾ]AI@HmHCXR@dM,M 7|J |HPMoO=;2ow/zi]&dTO/E-߇B?)~d#.ʉAn
k f){l! ԏÜD%6 f\T^S5wQxrnC8@m
޶0
}*ۢ8[},8Hj^+& qX dDKGc0Fsv7X@-
\<XMt f$pi}Oӝ^_2jnШXhxy=2uߋӿiz--N՝Ovq?4"
#€X^H95^7XBB[Ŀjե(?<2
z.8O^%??-0 F0^F߇Mfάd,2'^ΰR;QVV-ɝ?78Zh\cnKl[W{~8WUztCp'o*s!gS,~ ⏏{9HSI _UapM;jD%Iuj-8/P_vT[P=*2V#C%92<\*8mj%*yT% ]v{@YPx"+czP6#ְX.aʌeR0R0_L,mKBx30`2P}ud'"-,4_7Ͷ}}I|M 1cdrC^2CPM4RhӺmKao{oZ+$^2QʫlNj$
a w+bESfJ
q%߷ܥ P B
vEh?j9BLQ~ UZsWa 5Dzo$_6o|_|2f{ٷQLbPwjJ$5P> Ҹ*!
_"AsNсTW*A'):thumbsup:ld`_L3EG)QWV,n:M ֗rʢs<Y D읭Gg$U㔟Hzo2t%F1(g K
Q"ۄ NIߥdUtFgIcghnXg~n[ /Ī_rξN<qGPJ,/cgߍmȭrhS.r'r6 V5S @Xal|z]\W.
&:*A .G8B9|hz}
8X=|]G0n clNS2
W}syA$2KWS@Er}g2fF3TOwrF!9zC4=Әx)uQmhf|B7doң)- ky=fo1 L)e 4(to(??v|\+TQ c
NewΧ}֩MlAw{1E!CAOd#4е#/Uۼvt JAW_IԱSS^33hAf=`WJLJ]pr䫽n»A ωBAa;h$sI&A=1ChړKZk(uʁCq{V= O^!.\'*f끻Ѐ\A M_/cbq%18>.T^* [Kte!X!ꙃ'K2fB@s3fvMH讹0 gSkl R"2Ќ*Xb) K}I@,[5>r$U2
~$^jXCw4Ta%Url\<Dz#.mD|gX ز<1L=ÖS[IH?NŭN?\lT?cpDa^GtL4C!:18_qߝ&exyCΘö6D Fw P?4,HeR@1yߑ1vKQhHsw7ڸ*kTa }#n?~è^](tXJWʞړ\YwMClLmIfAzL 4~b}Se8[ sL
!3ژCySv۞jϿRU^?ݬ> ;aJbeμ{B9IdjŋmOLlj_tڋ6?VXtJ'>2fv17(uA\{іK{ `<jfdtנ!: KmHt'c :^igfd fH<WoHo/݅['."bD{"FPR
`#JasUܚ:2ik߇ '|+qHU:V#HIݡїTC׏.}UAy%P?RSCOɉԺg
i5N}<Z3BV'rȶI4iP!=^F?#5;"W5WәiMe
h?ؓe>>'hTa+%f'P\į z"NMԥ:@=BUzAˆNVcc,WS%$ =HS(Lo)kNo޸ )Q+Tv *Ӆp/7 gp }5BG+=QS)90[* plrJȟ"ㄿFkfq xx!/+B-7!Qr5 Qp"HJ D:2
m[fݙ^+'B`$ojehx4c'P`"Y!U7ՁmRD
cMTuL6]Jvb^:w`2 !
a:k=Kv&"q;lZP|1\)A-} g''4t>\oqY*N{ صTNRo,g & 3{Um :sJxK ˜>rosf]>u1xݯɗJAgs44C
bhEuyߌ'TYz絺 (va!)
e3d7сλ4ۿSɋ
+
$'A)#5bzmy3J
6D1w&oF?CS͍̊iSB7v&'m[Zn8Xhw_9kP8\z@ό: ¢;q2Lo*y*Pvhޛ7+wK{yPѯ,ֿ5@P:+0xUy/1|ye\klx<b
qAG$1'lRIp_֠Tksdkw
W:n4wȥא<^p#>-'JL8PyNOܚm#V^'Y@+n@?ݰR6 C3k3z<QBI"!DL?VTBQtɦ7O/ٛ#ebR=ܻ6W&n9fɺ7ͅZDbvg>*
0*CxjCcѡe{K
6`c#e[.!#!!ee[=2g&5b,H-:Eu=f~cvtm!RAh1q<B= :+x KY ^is+nFssS0گr_톆QZb3 $Ⱥ$y_!!W0'_LxIȌ%`a4yW[`N'W $^H)o*};#i0H4puehS4

!b& !.N c=G@ۈ;b?TbRG \o!R `;N
O^jAv>'䆆|9YwQ9eHfG raDrsE@F
K5wEzb 6 1un2Ǹ]oت#`<Wj`ezdaBbD5%OuYs;0V-˂YC}C^Ƿ7lDŽ,k'ުBLMU]^5 l^e7*p{>ۈp k?vt3jQL/.!tvɊ)oL]v4u
_4_>bU c-%#=e:?'/GYvXgZ^ h|6`R@QnZUS'+"9l_/P>\yXO{Α3i
?SJE^rFhM<Тm1hVkR %KrB/Y-k4E4{<q7vXڲ6ҽS|3FfB0`;
IV=u}o`jl}]7w|m˄|VX??6쒫N53k:&IjP ex{vQd%jٰG 9\[ Z*Jڹ 0! U-?!uѼJ+yH~QmZ4KMO0?o=k$\ZlDW/oWW_dF߹'\SО2&h6d.,bf>O{<U]$_Z_[7lLX#
whZ t">1hcphWOTux6J`p Վ2Uvu;N1Ng]<Μ{BQ4zF`9Yg`Z&5/[LH%FVv1 DUqOIm|xR5o%*1jdasU)9DFƍt<6e<҈p{}zzU0/ξ V 33xBlO;UUK(-cpDiȞR!¦FA [r]V8D'['+e](6 $gX|~LcQ
q
gТ)L⮭$;͠?ʧ"
>\Z3!كeX) A!
(DҊ-b@j[<W~ԻWF8q;лI&X-C'KL~h+tVh$iYrOC xϻMjDff4l@e2_|j_r櫞3{fɄw'\G<-kRZU[5w.}5&b 3My;O@Fbh;0xa09ln؅Ixh w7CsFftøܱSlMz5ZYGDK~K>c_)'YR+/%;P(&-!݉DkTP?/gyA
-YOG=3N GWȉ2bw w?W܉
]rn]C.XIxC~6M>aea
cJ2f=;}=Qmeºֈ䪿=,b,g4C~$}rWŀXaf#kfhӋ`Ý959"{WDh YQz^/}
n.pDrR]ofƑf8:W"a0J:k_X ;ŷږ~n[ER^hPk˻y#њďqqbnUlk 砑Jռ8@!.wxS}P3q)F8u߄:zK#. @B
) wnNˇtﰉADCrl#1Y?ؑ9DBQa%_UCF%:#M3`/-` -WueXg ȵz

#:tе=uKw+0V9Gܦҗ}jB# J5hW>!}$ E"vcVxx.zF) 2[?Xey{ ҲIMNq3qQ+AsŖS|f&'t.r.9I+A. pmI
6]2
XCz;D~E˰ -E T sv [ӀiG ArP3A7 |,
=] ։n3TRZc7/&)tʼnCrtl3`tR{wp\h."nN $`\$QrgO hҵCnX̏5Eѯf@S ŠQ]29'_OaU.:@,p׉J34$3_ %xrbtfqǀt9̠:tЦ%=8dZTWG7h/;#rG
tP+/G,|Qz__ AG43ff2lDY
/VINhS !hW<!i}lSܐMx_ ;0
a2tԘ\ը CIl0|geZl =hc~x5.qaf?(,Jc )2]eٝ|"sjU:e >ʐ" U8%8j|2Ud׷cdV:Z\R5ofinz0!"g# Q
n.S1b'}n׆bIj1wB^38>8~y̫ըq}eA[WZ6*dJ*`GڧJݭ+"d
2m=uk}׳W$RNa4ڢ 2= hp4{Y.5n 0NΘ;ȏ_*ï3Q57"
o_;~j
s{
1s7 Dk 6:Xm9LAHYri8CN5y7lr&0N^"=Lh-\$AvT7(&0z(<UٗŅg_MЦ#'` [PF0@:3Jg^g۵8"s`r:r ~FAq_}DI#5[[Es+gkXu䠤W=lH~9P'y"=ok㐫}[-M<>:AGᅢ T6ԣ>ꕵk`iC>'q 6+{㉺3-QH1Yhw} 92eýN۪s;w"]~a 5milqqmp 78F⇌1qv/,i}=vɋztQ*U n
$I
0:4T7r_3ۓ}cBCηДT{ܻ4֞>XdnI,(g3 Ҙ
pPBg&AZQ+."鵵T q_(ß,.c l~4vWjv P
1 -h4}{5VЅ4U0Zf
mⓙ)oӏ2
Nkvѓ -5O]<t {ӗIb!|\4JG~(A}fM_,P%<86v-po>xA.0ɃK=4Y^mZwv@Xt^Ubd,e{%U ?~[Vtx@*kΠuN@kڂo7XŔURVV6='8BU)eNb9kF5a(c*hjTn{!3 (}),V9=V : M(qI'
ϒPz-bj, bR~ىv)$.߀ui"|C Ae"Y+zXsl]J )HD
?Qw7"&7qw#lBF@v}`VC"#mS3s$f\!dP*Y±) ψ!J-C31icTg
m0&)/#6=mNjK=9/kgM7= "q+
2q'<(hݢlGKqW
S1z}*?H=i|8
g|[hz %LolKy <NF!.>{\3g2)Hy|XU6 gϿwD@ b$.O,n=۶ MxlҪ(:#F{Y׊u[.I,U:-J̓pc5/Ʊ 4V~5#]U(R
L
or&F\{PD:8'5UKBܣ'JLъ;^-S8._4PUӗm8($2+?B*3.L6G"TK'-mڽ~D[3$*^QY:b%z t'CMWZf!"XS3ӅD4'{|rnU7UOONi<S5~kn4<K]QwTs:t sQeas
VLA^
*/3;c=CS|-
GOqH9B%7/yA6fy Hϊ1M*ͅGUWa z8.yxqm̗fݢB{RPF3bs9a i%,Hٳɫ#w`ϻ[[5cdݽyBx`5" DX鸡[ 4DX:xeaJ2`_C”UV<{:><-y,ce⊜NWL{t#7ZP*aw xˢLr'œh ˳-nT8H6xxb3_SY<Rl`&O;:"//1>73@AvDQ\j!ָe.;6>f==n/ =G6Y2erA]* t!0ncb44:Ar`S?Fܫa,P^rR…@t_uS&3"2h4ߓⴉ*fkrzd!O\Z>y>d.[P}F,@T:F"Rs>Ty6zL!']7
):Cdբ{Hi4n:"tk"mx%0AU0sWϑ(֓ $uW*+l%Ǹ\`Fsfc+R7vrCve \HtjZQA+~*߾ZK1r',+M8H|BK̥s;NbZs.a[}kckz#XG@ xjuer/F!dv1_p
kTMJx\[XP*&U²FNv
O9'e>rp
%~CL5a
qU7tRR+5K
aM4JF8^k!ݟN$;)=ŎW\!+wZ[Hx}}O/q>/g5]c򎱼a>FC۸_LXثDǏ`^/2^=UhDCpT$sMΊ  tP>fCQHV`ptЊrdFJTT\Hޫ|5~[K;ס^8v%tG1i9W7K^VW^`@Xu0*jO>'LI? llRϠYՊ>1b7&gI.V4d,bX9u^zT1-q諄)MrxI 3֫=As"b;*l:3.]yK0!`嫳D?~N{cjGxgtz<nH!U"0$>QQ2B.?zkWVtuo4p3p=ǭ%9E{ J

-r>;\fhK3mAbꐢ]OI,[s"ѭ/8*QG0-Zhh|{8E-=HH
[d;9I/vU<&Wj[!ʽ jUvM5|Cwu64 OWe bJ3-{#U<P*_'_cu@B7k'Uf\:@2>TT` Vvl>`>9zJr4VrH/Uiz0|mXVoa5"w9oJ R57+.`?9O:r /hK}m@<6OU{5vwPYЬys׎,Mlb0lh줸 dco֞V*QyoN}S4iĀ)[O:FW7{6  m3jF\Ӧ4BCѡ9Q*6>Dà传{.x4n+MȘm]H@dDO`
hS^3I2߃z8Tm'N51
V~` ӷ>rѝ`} _E+QћɼɣpCZg(
Q MK2 ]96=ȃ ֻ'pΗ1hӕƧd@(W-J+Ʉ.әk(GvKƅxQ{":+ FGt V!0%Xk5H4PYkNKՁXʿUï


The other weird thing I have noticed is that the file is listed as a screensaver rather than a script or application.

I am a relative novice in this matter, so I may have missed something glaringly obvious...

BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,801 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:10:44 AM

Posted 10 September 2010 - 02:10 PM

Hello,

I'm sorry we didn't see this sooner. I see that you have somehow managed to produce the DDS logs.

Now that you have posted a log here: http://www.bleepingcomputer.com/forums/topic346131.html you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a MRT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the MRT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the MRT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the MRT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRT Team member is already assisting you and not open the thread to respond.

Please be patient. It may take several days to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

To avoid confusion, I am closing this topic. Good luck with your log.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users