dr. watson postmortem debugger

Geeks to Go Forums > Operating Systems > Windows XP™, 2000, 2003, NT

Today's New Content

2 Pages
1
2
→

dr. watson postmortem debugger can't open folders

#1 jsgcckeb

Group: Member
Posts: 1
Joined: 13-February 05

Posted 13 February 2005 - 12:09 PM

Hi

I'm new to Geeks to Go! and I could sure use some help. Since I've downloaded a new MS update, I cannot open any folders and I keep getting the dr watson post mortem debugger screen. I am working in safe mode right now and everything seems fine. My system is windows xp with sp2. I have run all spyware removers and currently use Netscape instead of IE. I have included my HJT log. Thanks for your help.

Logfile of HijackThis v1.98.2
Scan saved at 10:00:14 AM, on 2/13/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\Documents and Settings\Owner\Desktop\PC h***\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\usgmj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\usgmj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\usgmj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\usgmj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\usgmj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\usgmj.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\usgmj.dll/sp.html#37049
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.startup.homepage", "www.google.com"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\ri5q6cyh.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\ri5q6cyh.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_16_0.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [CTStartup] "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /run
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [netpw32.exe] C:\WINDOWS\system32\netpw32.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1\Bin\REGIST~1.EXE
O4 - HKLM\..\RunOnce: [addji.exe] C:\WINDOWS\addji.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [NOMAD Detector] "C:\Program Files\Creative\NOMAD Jukebox Zen (USB2.0)\PlayCenter2\CTNMRUN.EXE"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
O4 - Global Startup: Enable Wireless Keyboard Driver.lnk = C:\Program Files\Wireless Device\Wireless Keyboard\Magickey.exe
O4 - Global Startup: Enable Wireless Mouse Driver.lnk = C:\Program Files\Wireless Device\Wireless Mouse\MouseAp.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\Exif Launcher\QuickDCF.exe
O4 - Global Startup: Image Transfer.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/...nst20040510.cab

#2 bomproject

Group: Member
Posts: 1
Joined: 15-February 05

Posted 15 February 2005 - 12:36 AM

(Bump)

Someone please help us with the dr. watson postmortem debugger problem. Microshaft should have detected this error before issuing whatever update they did that is causing this stupid error in the first place.

I can't open any folders on my computer either. I can't even open control panel for crying out loud. Anyone have any advice on how to get rid of this stupid error?????

#3 qshi03

Group: Member
Posts: 1
Joined: 15-February 05

Posted 15 February 2005 - 04:21 PM

Same here, I did a search on the site for the same problem and i found help. buuut... I still need a little more guidence through it all.

#4 sstrayhorn

Group: Member
Posts: 1
Joined: 15-February 05

Posted 15 February 2005 - 06:12 PM

I am having the same problem. Everytime I try to open documents using My Documents or My Computer, I received a wait and then get the Dr. Watson Postmortem Debugger error message. It appears at that time my computer freezes. Please help!!!!!!

#5 ravens_creed

Group: Member
Posts: 26
Joined: 16-February 05

Posted 16 February 2005 - 02:15 PM

I, too, seem to be infested with this nasty Dr.Watson postmortem debugger problem. I wouldn't classify myself as a computer whizz, but I think I understand what it is to a point...

I'm fairly certain it has nothing to do with Windows or Microsoft. I'm nearly 100% certain it is a virus or trojan of some sort. It's smart too. It changes its own name to avoid detection or being removed. Either that, or it's hiding somewhere, spawning new trojans like a mother laying eggs or something. Aside from coming up as Dr.watson32.exe or whatever it is when we try and open "my computer" or any system folders, I've seen it appear in my task manager as ierk.exe, ietk.exe, d3ku32.exe, all kinds of funky stuff. I'm pretty sure the reason we can't open any system folders is because it doesn't want us to get in there and remove it, and obviously it would be vulnerable if we could (I've had viruses before where you look for them where they're supposed to be but they aren't there, even after a safe mode reboot!). What does all this mean? I don't know, because I still can't open my computer and it's obviously still there, no matter how many times ad-aware se or avg scan and try and remove it. d*** it. d*** it straight to h***.

#6 MaanDeep

Group: Member
Posts: 4
Joined: 01-March 05

Posted 01 March 2005 - 03:11 PM

I am joining this group too. The group of geeks as well as group of people with PC infected with this bizzare problem. Looks like everybody including me, affected by this problem have XP OS. Not sure if reinstalling the OS with 2K might be better.

#7 peachyass666

Group: Member
Posts: 5
Joined: 01-March 05

Posted 01 March 2005 - 08:29 PM

hi all, im getting so frutrated with this, i cant open anything at all except internet and i dont know much about computers except that i cannot remove dr watson by either avg or microsofts spyware remover. has anyone had any joy on how to fix this?

#8 ravens_creed

Group: Member
Posts: 26
Joined: 16-February 05

Posted 01 March 2005 - 09:35 PM

I've actually managed to remove it twice now, quite easily. I just followed the instructions they gave for cleaning your systems of ads, viruses, trojans, etc.

http://housecall-bet.../start_corp.asp

that online virus software seemed to be really helpful.

#9 peachyass666

Group: Member
Posts: 5
Joined: 01-March 05

Posted 01 March 2005 - 10:00 PM

it wont let me scan my computer, says its only supported english internet explorer or soemcrap like that even though im selcting uk

#10 ravens_creed

Group: Member
Posts: 26
Joined: 16-February 05

Posted 01 March 2005 - 10:21 PM

http://www.geekstogo...?showtopic=2852

go to that link and follow the instructions exactly and you'll be just fine. :tazz:

#11 MaanDeep

Group: Member
Posts: 4
Joined: 01-March 05

Posted 03 March 2005 - 01:16 PM

Hi Ravens_creed,

I followed the exact steps given at http://www.geekstogo...?showtopic=2852 until running Trojan remover and rebooting, but still cannot open Windows Explorer or Control Panel. It would be great if you highlight what all stepts do we need to follow.

Thanks.. (I am getting really frustrated with this bug)

#12 Guest_thatman_*

Group: Guest

Posted 03 March 2005 - 01:58 PM

Hi jsgcckeb , bomproject , qshi03 , sstrayhorn , ravens_creed , MaanDeep , peachyass666

Welcome to geekstogo

Please update HijackThis v 1.99.1
Create a new folder on your C:Drive name the folder C:\HJT\ NOW DOWNLOAD HijackThis To the new folder, Unzip the exe file and post a new HijackThis.log.
Please Post in to your own threads thank you.

The following information is the canned fix we will be using, when you have post your HJT.log Type I am ready for the fix

Please read through the instructions before you start (you may want to print this out).

Please download and install these programs - don't run them yet!!

Please download and unzip
About:Buster to a folder. Inside the folder is a readme file that has instructions on the use of the program.
AboutBuster MUST be updated before you use it.
Start AboutBuster, click the update button, check for update, drag the box to the side and hit download updates, close the box . Don't run it yet.

Please download and install AD-Aware.
Check Here on how setup and use it - please make sure you update it first.

Download and unzip cwsserviceremove to your desktop. use either link below:
cwsserviceremove
cwsserviceremove.zip

Download CW-Shredder at the link below:
CWShredder

Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked.
Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"

For anyone using Windows XP, 'Search' will not automatically show hidden files even if your folder options settings are set to do that. Do this so you can see hidden files and folders - Click here to download xphidden.zip. Extract xphidden.reg from the zip file and save it to the desktop. When done, double-click the xphidden.reg and when asked to merge say yes.

+++++++++++++++++++++++++++++++++++++++++++++++++

Here's the fix:

Important Step
1. Go to Start->Run and type "Services.msc" (without quotes) then hit Ok
Scroll down and find the service called:

No file to remove

When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows. If you don´t find this service listed go ahead with the next steps.

2. Reboot into Safe Mode: Click here if you don't know how to do this.

3. Press Ctrl+Alt+Delete once -> Click Task Manager -> Click the Processes tab -> Double-click the Image Name column header to alphabetically sort the processes -> Scroll through the list and look for:

If you find the files, click on them, and then click End Process -> Exit the Task Manager.

4. CLOSE ALL WINDOWS AND BROWSERS Scan with HijackThis and put checks next to all the following,

Then click on "Fix Checked"

5. Using Windows Explorer delete the following files if present:
If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. if it is uncheck it and try again.

(and any other files with the same name that end in .dll, .exe or .dat, you may find them right next to each other, example - appsw.exe, appsw.dll, appsw.dat)

6. Run AboutBuster . This will scan your computer for the bad files and delete them. Save the report (copy and paste into notepad or wordpad and save as a .txt file) and post a copy back here when you are done with all the steps.

7. Scan with AdAware and let it remove any bad files found.

8. Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

Temporary Files
Temporary Internet Files
Recycle Bin

9. Double click on the cwsserviceremove and when asked to merge say yes.

10. Run CW-Shredder - Hit the FIX button - let it run and fix what it finds.

11. Reboot into normal mode.

12. Download the Hoster from here http://members.aol.com/toadbee/hoster.zip. Press "Restore Original Hosts" and press "OK". Exit Program.

13. Download and run this online virus scan:
http://housecall.tre.../start_corp.asp
Make sure you check "AutoClean"

Please reboot and post a fresh HijackThis.log to see how we did.

Kc :tazz:

#13 csd

Group: Member
Posts: 18
Joined: 04-March 05

Posted 04 March 2005 - 08:25 AM

MaanDeep, on Mar 3 2005, 08:16 PM, said:

#14 csd

Group: Member
Posts: 18
Joined: 04-March 05

Posted 04 March 2005 - 08:34 AM

Hi I'm havign the same problem as the rest of you. Instructions from Thatman are
great however I have a couple of questions. Under Here's the fix, I don't see the files
to search for under #3. I also don't see the under 4) put checks next to the following, I
don't see what to put checks next to. Same with 5) delete th efollowing files if present: then it doesn't list any files?????

I'm ready to try anything at this point! I have two machines infected with this virus!

#15 Guest_thatman_*

Group: Guest

Posted 04 March 2005 - 09:21 AM

Hi all

To all members each computer will have differant maleware that is way each user should start there own thread , the HJT.log is needed to help with the removal off malware.

Kc :tazz: