Dr Watson Postmortem Debugger [resolved]
Posted 26 March 2005 - 04:46 PM
Posted 26 March 2005 - 08:45 PM
Yes, while in safe mode I ran the hoster program and clicked the restore original hosts and it said your changes have been made. Then I ran the log.
Posted 26 March 2005 - 10:30 PM
Boot into Safe Mode again.
Use Windows Explorer and navigate to C:\Program files and look for the folder below (in bold):
C:\Program Files\PPC Advertor
If it is there, DELETE it!
If you can't find this folder I have a couple of other things to try to get rid of this thing!
Posted 26 March 2005 - 10:55 PM
Posted 26 March 2005 - 11:17 PM
I ran the requested search in safe mode and couldn't find the file you spoke of. I even ran a search for it just to be sure, but nothing was there. My internet explorer runs fine. It opens to the normal homepage.
Posted 27 March 2005 - 02:12 AM
Ok, let's try this now:
Boot into safe mode.
Go to Start > Run > then type in:
**make sure that space is in there between sfc and /
It will pull up a box that says "windows file protection" just let it do what it does
We'll see how this works! Let me know
Posted 27 March 2005 - 07:31 AM
Posted 27 March 2005 - 07:53 AM
Follow the arrows
Lets see what the error is click-- >Start -->Control Panel -->Aministrative tools-- >Component Services-- >Event Viewer (Local) -->Application from here you will see all Event Properties click on the errors you will then see what is the problem.
Inside the Event logs you will find every error message that your computer has had, and a list off all the faults from your system are loged in this area.
Posted 27 March 2005 - 11:06 AM
Please follow the directions given by Kc. Just doubleclick on the ones that say "error" (there will also be some that say information and warning) and tell us what it says in the dialogue box that it pulls up.
After this, we are going to repair Internet Explorer to see if that helps any!
Posted 27 March 2005 - 10:31 PM
The errors always came in pairs like I mentioned and the first is;
faulting application explorer.exe. version 6.0.2900.2180. fauliting module shell32dll, version 6.0.2900.2578, fault address 0x00054581.
The second error is;
faulting application drwtson32.exe.version 5.1.2600.0, faulting module dbghekp.dlllversion 5.12600.2180, fault address 0x0001295d
There were several other error logs from early march about could not contact filter driver, naifiltr.sys. is missing, about haning application errors with iexplorer and fauliting application erros about mmjb.
I don't know what I am looking at or what you need to know. Give me further advice on what to do and we can take it from there.
Posted 27 March 2005 - 10:41 PM
I have made an error and I think it may have cost you some time and confusion. I only realized this once I ran the event log viewer in my last post and had an epiphany. When I arrow over all programs from the start menu and the computer freezes and I get the error log it is encountering an error with windows explorer and not with internet explorer as previously stated. I guess when I read it quickly all I saw was explorer and thought internet explorer only and not windows explorer. I am sooooo sorry about this and I hope that we haven't been on a wild goose chase.
Let me know what to do from here.
Posted 28 March 2005 - 12:59 AM
Go back into the event viewer and look at the error messages that say "faulting drwtson32.exe" and tell me the faulting modules on them or are they all the same: dbghekp.dll (this is spelled correctly?) and tell me any other "faulting modules" on the errors that have come up recently due to this infection.
Posted 28 March 2005 - 03:09 AM
Please do not try any repairs to your system I need more information
faulting application drwtson32.exe.version 5.1.2600.0, faulting module dbghekp.dlllversion =5.12600.2180, fault address 0x0001295d
This item is suspect
This belongs to McAfee help
MUSICMATCH Jukebox Description:
Please do a search on your system for this item dbghekp right click on the item and make a note off it's properties
Post back with the information
Posted 28 March 2005 - 10:39 AM
This is the generals problem below is the good guy:
dbghelp.dll is flagged as a system process Windows Image Helper .
And this is the bad guy:
dbghekp.dlll version =5.12600.2180, fault Bad file may adversly impact your system
dbghelp.dll version 5.1.2600.0 Legal file version
We now need to find if the legal file is still on the generals system and also find what is controling the bad Guy.
Posted 28 March 2005 - 01:46 PM
Please locate the file (that was on the error message - defaulting module): dbghekp.dlll then zip it up. You can zip it up by right clicking on the file, then going to Send To > Compressed (zipped) folder. E-mail the zipped folder to: Spyware Submissions
As soon as we review what that file does, I will have a fix for you.
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users