Windows XP Rundll error - please help

[llblawyer]

am such a pill, have quarantined the ones from ad aware so need to download next problem, will get on with it!!

 

[muckshifter]

am such a pill, have quarantined the ones from ad aware so need to download next problem, will get on with it!!

No, you is doing fine ... and I wasn't 'picking' on you.

I found another nice little program for you to "test out" for the rest of us ...

You mentioned "look2me" and this little program can find and help eliminate that particular nastie ...

http://www.simplytech.it/L2MRemover/index_e.htm

... you are helping others here who may have a simular 'problem' as it will act as a guide we can point to.

 

[muckshifter]

hi sorry didn't download all the programs you said straight away, am still ploughing through trying not to mess it all up completely, have downloaded and run Ad aware and it's found "win32.Trogan downloader" AND "winantivirus pro" which says it needs quarantining which I am pressing to do but doesn't appear to be doing anything. Have one more program to run then close it down etc and run in safe mode but there is something there i guess. Apologies again for not more closely following your advice immediately.
I really appreciate all you are doing to help with this, really don't want to lose all my work etc, am trying to back all that up aswell as sort this out but my dvd drive is not wanting to work properly either, guess it's all part of the same problem. Thanks will keep going!!
Katherine

Phew ... you better start praying.

win32.Trogan downloader ... is a barsteward, it invites other Trojans to the 'party' and is pretty good at it ... however, you may find it plainly listed in Add/Remove Program as "Active Alert and Internet Optimizer" if these are in your Add/Remove Programs, then un-install them.

Now, winantivirus pro ... had an invite to the party ... but Ad-AwareSE or MS Defender should get this one ... if not, guess what, yep, another program to download and run. It is Ewido pretty good tool but not one I like, so I tend to forget about it. sorry.

Are we winning ... I do hope so.

 

[llblawyer]

Hi again
The L2M Remover wasn't a success for me as I couldn't get it to work at all then the system crashed with something according to Microsoft as a "stop error", started back up and am now trying to run Ewido but that's gonna be my lot for the night, it's not going to be fixed today I guess!! Fingers crossed I'll get a bit further tomorrow, this has been a great help and I think it's removed some of the stuff that got in, will start it in "safe"tomorrow and do the programs again like you said and see where we go from there. Thanks again, catch you soon.

 

[muckshifter]

TTFN

 

[llblawyer]

Hi Just to keep you posted on the situation. I've got all the programs you mentioned installed and running (i think) and they don't appear to be finding any big problems except cookies but the system is still not doing all it should. I still have the Rundll error and things like the Recycle Bin isn't working. I can open it but it won't empty automatically i have to select all and then right click to delete but then it won't go from the screen at all until I close down so really don't know now if something is still there or not. Have had no other mention of Trojan downloader since yesterday but am still concerned considering these other problems. Any more ideas?
Cheers
Katherine

 

[llblawyer]

oh sorry there is also something in my add/remove programs called "softV92 Data Fax Modem with Smart CP which I have no idea how it got there or what it is and why it won't go, even when i say to remove and it appears to, it comes back next time it's switched on. May be fine just haven't noticed it before and like i say don't know why when or how.
Cheers again!

 

[muckshifter]

Hmmm, me is running out of idea's ... the softV92 Data Fax Modem is probably a PCI modem fitted to the PC, as we all used to be on dial-up back then.

I'm still not too concerned about w004234b.dll ... though anoying, whatever is trying to find it, cannot run without it. But, it would be nice to get it killed off.

It can be caused by any of the below possibilities.

1. Another program was uninstalled that removed a .dll file that was required by another program or the operating system.
2. A program was installed that overwrote the .dll file with either an older version or a version that is incompatible with other programs causing .dll errors.
3. A bad installation of a program corrupted one or more files causing the .dll errors.
4. Another user or program maliciously or mistakenly deleted the .dll file or an associated file.
5. A hardware issue exists with the computer, such as a bad hard disk drive, causing the data on the drive to become corrupt, casing the .dll errors.

Can you post me a new HJT log

 

[llblawyer]

Hi, sorry to be bugging you with this!! I believe at some time during the panic i installed Drivecleaner2006 free which although i don't believe is working as i've done all i can to remove it's components it's still in the program files, refusing to be removed. Can't believe that people actually do this just to disrupt others, time they got a life!! Cheers again. Log follows as requested!

Logfile of HijackThis v1.99.1
Scan saved at 20:56:13, on 06/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Sony\HotKey Utility\HKserv.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Sony\HotKey Utility\HKWnd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\KATHER~1\LOCALS~1\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tiscali.co.uk/broadband
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [EPSON Stylus C46 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P32 "EPSON Stylus C46 Series (Copy 1)" /O6 "USB002" /M "Stylus C46"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Auto EPSON Stylus C46 Series on HAL2000] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P39 "Auto EPSON Stylus C46 Series on HAL2000" /O18 "\\HAL2000\Printer2" /M "Stylus C46"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [jyl58d57] RUNDLL32.EXE w004234b.dll,n 00258d550000000a004234b
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: WKCALREM.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.co.uk/broadband
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - https://www.plaxo.com/down/latest/PlaxoInstall.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.co.uk/SnapfishUKActivia.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-30.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1144062495300
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BF6BBE9A-0656-4598-A0CD-32DAC03959B5} (Image Uploader 3.0 Control) - http://www.tescophoto.com/wpp/tesco//app/opcuploader.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylomgames.com/activex/zylomgamesplayer.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game11.zylomgames.com/activex/zylomloader.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\VAIO Entertainment\VzTaskScheduler.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)
O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_SVC.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

 

[muckshifter]

AH HA ... gotcha


Fix this one ...
O4 - HKLM..Run: [jyl58d57] RUNDLL32.EXE w004234b.dll,n 00258d550000000a004234b

my sincere apologize, I missed it in the first log file too ...

 

[llblawyer]

CHEERS HAVE DONE THAT, Will turn off and restart and fingers crossed, will let you know!! You're a star!
Cheers

 

[muckshifter]

Also, you can uninstall Ewido, I do not like it and you do not need it and MSWD, using MS Windows Defender should be enough to "help" stop them getting on your PC in the first place.

As for Drivecleaner2006 ... yes you are correct, it is Malware in it's own right and should be avoided at all costs. I did not see it listed in your Log files, so I assume you managed to get rid of it. yes?

Check under ... Crogram FilesDrivecleaner2006 ... if that directory/folder exists, just delete it. Do this in safe mode.

 

[llblawyer]

Hi have done all that and is looking good, no rundll error anymore!! Uninstalled Ewido, excellent job but the drive cleaner 2006 is a different matter, it still exists in program files and when i tell it to delete it i get the message "Cannot delete UDCDShell.dll: access is denied.Make sure the disk is not full or write protected and that the file is not currently in use" which it isn't as far as i can tell but it doesn't want to go!!

 

[muckshifter]

Did you try it in safe mode ?

OK, try this tool ...

http://ccollomb.free.fr/unlocker/

... I have just tested it, it works on my test PC but I have nothing 'naughty' enough ... I'm going to keep it anyway.

It is very easy to use ... just install it, then go back to that folder and right-click, then you'll see un-locker's little wand, use the wand, then if it worked, un-install un-locker so you won't 'break' anything by accident.

 

[llblawyer]

As always, thanks! Will get back to you in the morning with progress report, my bed is calling!!

 

[muckshifter]

As always, thanks! Will get back to you in the morning with progress report, my bed is calling!!

You is welcome ... nice to see someone beat me to bedtime.

I get to 'play' for another hour yet ...

 

[llblawyer]

Hi here we are for another day and I'm starting to think there's going to be no end to this. Did try to delete Drivecleaner in safe mode to no avail, have now dowloaded the unlocker but it says it can't do it as my settings don't allow debugging to i've read all the FAQ's on unlocker and downloaded something for xp but it says to put something in the command line that when i do it it says invalid.

The following is from the unlocker site, have downloaded then tried to input what they say as the c prompt but i must be going wrong somewhere so have no idea how to give myself debugging rights!! What a flipping mess!!

- How to set privileges on Windows XP home edition? Download the resource kit here and from the command line set the privileges you need: SeBackupPrivilege, SeDebugPrivilege and SeLoadDriverPrivilege. Here is the example for the debug privileges: ntrights +r SeDebugPrivilege -u YourAccountName

Appreciate this is going a bit further than the original problem but I do believe it's all related! As always in your debt if you can come up with something!

Cheers Katherine

 

[muckshifter]

OK, I'm on a vendeta on this one ...

Download the .zip file at the bottom of this post, extract it, and run the killbox.exe file.

When it loads type the full path to the file you would like to delete in the field and press the Delete File button (looks like a red circle with a white X).

It will prompt you to reboot, allow it to do so, and hopefully your file will now be deleted.

 

[llblawyer]

Hi i think it may do it but not as the moment because it says that the "file does not exist" this may be because i deleted everything i could and it has left in program files a file named drive cleaner 2006 free but when you open it all that is inside is "UDCShell.dll" and this apparently cannot be deleted! Am i driving you mad yet!

 

[llblawyer]

there is a think on killbox that says "unregister .dll before deleting"?? is that likely to do anything. I await your respected response!!