Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Windows explorer / Dr Watson Repeat Crashes / High cpu - Pushow97.dll

Started by andyds , Mar 11 2009 05:14 AM

  • This topic is locked This topic is locked

#16
andyds
Posted 18 March 2009 - 08:04 AM

andyds

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
hi kahdah,

how do i copy the file u mentioned to a computer with internet access?

p.s everything is running fine but the music programme im using keeps crashing. so i checked the viewer and it says there is a disk error so ive done a chkdsk and it says there is a bad sector @ c:\windows\docu~1\local settings\history\history.ie5 which is exactly what was why it was crashing last time..

do u think that this could be the problem?

also if it is a bad sector can this be fixed or is this the end for my c: drive?
  • 0

Advertisements

#17
kahdah
Posted 18 March 2009 - 11:51 AM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
A bad sector is going to be more eventually.
I would get your things to a new drive asap.

Go to that file location and copy the file to the removable drive then upload it from there.
  • 0

#18
andyds
Posted 19 March 2009 - 12:37 AM

andyds

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
hi kahdah,

here is the report..

File 55914131.sys received on 11.22.2008 19:09:02 (CET)
Current status: finished
Result: 0/37 (0.00%)
Compact Compact
Print results Print results
Antivirus Version Last Update Result
AhnLab-V3 2008.11.21.0 2008.11.22 -
AntiVir 7.9.0.35 2008.11.21 -
Authentium 5.1.0.4 2008.11.22 -
Avast 4.8.1281.0 2008.11.21 -
AVG 8.0.0.199 2008.11.22 -
BitDefender 7.2 2008.11.22 -
CAT-QuickHeal 10.00 2008.11.21 -
ClamAV 0.94.1 2008.11.22 -
DrWeb 4.44.0.09170 2008.11.22 -
eSafe 7.0.17.0 2008.11.19 -
eTrust-Vet 31.6.6222 2008.11.22 -
Ewido 4.0 2008.11.22 -
F-Prot 4.4.4.56 2008.11.21 -
F-Secure 8.0.14332.0 2008.11.22 -
Fortinet 3.117.0.0 2008.11.22 -
GData 19 2008.11.22 -
Ikarus T3.1.1.45.0 2008.11.22 -
K7AntiVirus 7.10.531 2008.11.22 -
Kaspersky 7.0.0.125 2008.11.22 -
McAfee 5441 2008.11.21 -
McAfee+Artemis 5441 2008.11.21 -
Microsoft 1.4104 2008.11.22 -
NOD32 3632 2008.11.21 -
Norman 5.80.02 2008.11.21 -
Panda 9.0.0.4 2008.11.22 -
PCTools 4.4.2.0 2008.11.22 -
Prevx1 V2 2008.11.22 -
Rising 21.04.52.00 2008.11.22 -
SecureWeb-Gateway 6.7.6 2008.11.22 -
Sophos 4.35.0 2008.11.22 -
Sunbelt 3.1.1823.2 2008.11.22 -
Symantec 10 2008.11.22 -
TheHacker 6.3.1.1.159 2008.11.19 -
TrendMicro 8.700.0.1004 2008.11.22 -
VBA32 3.12.8.9 2008.11.21 -
ViRobot 2008.11.18.1474 2008.11.18 -
VirusBuster 4.5.11.0 2008.11.22 -
Additional information
File size: 148496 bytes
MD5...: 0aa3ad071827118fcc8f37f7a6ab7aa1
SHA1..: 59784c49ffe530931010070c8843366f9d7fa6f0
SHA256: 3e893bcf9e3ec8fa44c8ef0cf7c2d269212651d65c16b30bd953cc3a54f3b2aa
SHA512: b56442c4271033f9547727ac097fc903f0bd51c062f415726aeee3e6abde24e1
ec127cb548086d5429ff4dc4e78c322b2594bb4f29f817338299f6c9c23bbc25
PEiD..: -
TrID..: File type identification
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x33010
timedatestamp.....: 0x4873470a (Tue Jul 08 10:52:58 2008)
machinetype.......: 0x14c (I386)

( 8 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1a848 0x1aa00 6.38 ca8bbffb8c1aac75560de3ffede16f38
NONPAGED 0x1c000 0x25 0x200 0.30 76fbfaa1c4997eccce3ca016c3b1345b
.rdata 0x1d000 0x850 0xa00 4.25 6ffc26ac817e2ae1a1cf5ce42adc9f0b
.data 0x1e000 0x1b00 0x600 6.42 2680643c152bf562cae4ab5d1ed2070c
PAGE 0x20000 0x2cdc 0x2e00 6.28 7516763c152ec5b6c5df87c555fadbb5
INIT 0x23000 0x1b88 0x1c00 5.96 4459dca4b85a564cb98f26cfbff36fbe
.rsrc 0x25000 0x400 0x400 3.36 09f200edb8e02e6fa4ab2f6bc27ad921
.reloc 0x26000 0x1b6e 0x1c00 6.47 5d73a4e2a3be56c2448dbd9511deefa3

( 3 imports )
> ntoskrnl.exe: IoAllocateWorkItem, RtlDeleteElementGenericTableAvl, RtlGetElementGenericTableAvl, FsRtlIsNameInExpression, RtlInsertElementGenericTableAvl, InitSafeBootMode, InterlockedPopEntrySList, InterlockedPushEntrySList, ExInitializeNPagedLookasideList, ExDeleteNPagedLookasideList, SeTokenType, SeCreateClientSecurity, SeImpersonateClientEx, IoVerifyVolume, IoDeviceObjectType, IoBuildSynchronousFsdRequest, IoDeleteDevice, IoDeleteSymbolicLink, IoUnregisterShutdownNotification, MmIsAddressValid, IoFreeMdl, MmUnlockPages, MmProbeAndLockPages, IoAllocateMdl, IoRegisterShutdownNotification, IoCreateSymbolicLink, IoCreateDevice, RtlAppendUnicodeToString, KeDelayExecutionThread, KeQuerySystemTime, strncmp, IoGetCurrentProcess, ExGetPreviousMode, SeReleaseSubjectContext, IoQueueWorkItem, SeCaptureSubjectContext, PsDereferenceImpersonationToken, RtlCopySid, RtlLengthSid, SeQueryInformationToken, PsReferencePrimaryToken, PsReferenceImpersonationToken, PsIsThreadTerminating, IoThreadToProcess, RtlInitializeGenericTableAvl, READ_REGISTER_UCHAR, ProbeForRead, RtlLookupElementGenericTableAvl, ObQueryNameString, CmUnRegisterCallback, MmUserProbeAddress, CmRegisterCallback, ZwEnumerateValueKey, ZwDeleteValueKey, ZwQueryKey, wcsrchr, NtBuildNumber, KeClearEvent, ExInitializePagedLookasideList, ExDeletePagedLookasideList, PsLookupProcessByProcessId, RtlCopyUnicodeString, RtlNumberGenericTableElementsAvl, RtlEnumerateGenericTableAvl, PsSetLoadImageNotifyRoutine, PsSetCreateThreadNotifyRoutine, PsSetCreateProcessNotifyRoutine, PsRemoveCreateThreadNotifyRoutine, PsRemoveLoadImageNotifyRoutine, IoFreeWorkItem, IofCompleteRequest, IoWMIRegistrationControl, MmGetSystemRoutineAddress, RtlCompareMemory, IoWMIWriteEvent, ZwQueryInformationProcess, KeStackAttachProcess, _wcsicmp, KeUnstackDetachProcess, ZwOpenKey, ZwEnumerateKey, RtlUnicodeStringToInteger, ZwQueryValueKey, ZwCreateKey, RtlIntegerToUnicodeString, ZwSetValueKey, RtlAppendUnicodeStringToString, ZwDeleteKey, DbgBreakPoint, ZwCreateFile, IoGetRelatedDeviceObject, _vsnwprintf, KeQueryInterruptTime, strncpy, RtlInitUnicodeString, RtlCompareUnicodeString, IoFileObjectType, ObReferenceObjectByPointer, _allmul, KeWaitForMultipleObjects, KeSetEvent, ExDeleteResourceLite, ExInitializeResourceLite, memcpy, _except_handler3, ZwOpenProcess, ZwTerminateProcess, PsCreateSystemThread, ObReferenceObjectByHandle, ZwClose, PsTerminateSystemThread, ObfDereferenceObject, KeGetCurrentThread, PsGetCurrentProcessId, PsGetCurrentThreadId, RtlUpcaseUnicodeChar, RtlUpperChar, memset, ExAllocatePoolWithTag, KeInitializeEvent, IoBuildDeviceIoControlRequest, IofCallDriver, KeWaitForSingleObject, SeQueryAuthenticationIdToken, ExFreePoolWithTag
> HAL.dll: KfReleaseSpinLock, KeGetCurrentIrql, ExAcquireFastMutex, ExReleaseFastMutex, KfAcquireSpinLock
> FLTMGR.SYS: FltQueryInformationFile, FltGetRoutineAddress, FltIsDirectory, FltGetFileNameInformation, FltParseFileNameInformation, FltAllocateCallbackData, FltPerformSynchronousIo, FltFreeCallbackData, FltReferenceFileNameInformation, FltReleaseFileNameInformation, FltGetStreamHandleContext, FltGetStreamContext, FltEnumerateVolumeInformation, FltRegisterFilter, FltStartFiltering, FltSetCallbackDataDirty, FltGetDestinationFileNameInformation, FltSetStreamHandleContext, FltCancelFileOpen, FltSetStreamContext, FltReleaseContext, FltGetVolumeProperties, FltAllocateContext, FltQueryVolumeInformation, FltGetVolumeName, FltSetInstanceContext, FltSetVolumeContext, FltUnregisterFilter, FltFsControlFile, FltGetVolumeFromFileObject, FltGetVolumeContext, FltGetInstanceContext, FltCreateFile, FltClose, FltFlushBuffers, FltSetInformationFile, FltWriteFile, FltBuildDefaultSecurityDescriptor, FltCreateCommunicationPort, FltFreeSecurityDescriptor, FltObjectReference, FltAllocatePoolAlignedWithTag, FltReadFile, FltFreePoolAlignedWithTag, FltObjectDereference, FltSendMessage, FltCloseClientPort, FltCloseCommunicationPort, FltReleaseResource, FltAcquireResourceShared, FltAcquireResourceExclusive, FltGetFileNameInformationUnsafe

( 0 exports )

Everything seems to be ok.. I chkdsk'd the error on c: drive and it has seemed to clear the bad sector in the docu~\history.ie5

Even though this is clear for now do u think that this could be the start of the end for the c: drive??.

If so, is it wise to duplicate the c:boot drive now before it faults? is this an easy process to do or is there software to help me do this..

thanks again for your help..
  • 0

#19
kahdah
Posted 19 March 2009 - 06:20 AM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
A bad sector is going to be more eventually.
I would get your things to a new drive asap.

The only software that I know of is Acronis true image home.
It gives you a clone option to clone your drive to a new one.
Leaving it still bootable.

You can find that software here :
http://www.acronis.c...ucts/trueimage/
=========================
Please go to Start>Run type in Notepad.
Copy what is in the code box below into the open Notepad window.
Change the "Save As Type" to "All Files". Save it as fixthis.bat on your Desktop.
@Echo off

del "c:\documents and settings\Owner\Start Menu\Programs\Startup\is-65BMI.lnk"
sc stop "is-65BMIdrv"
sc delete "is-65BMIdrv"
del fixthis.bat
Exit
Then please double click on fixthis.bat a window will open and close quickly.This is normal.
====================
Cleanup:

Please download OT CLeanit from Here save it to your desktop.
Double click on OT Clean it to run it.
Then click on Clean up.
Restart your computer when prompted.
This will remove what tools we used.
===============
Delete\uninstall anything else that we have used.

Including this folder C:\Rsit

System Restore
Then I will need you to reset your System Restore points.
The link below shows how to create a clean restore point.
How to Turn On and Turn Off System Restore in Windows XP
http://support.micro...kb/310405/en-us

If you are using Vista then see this link > http://www.bleepingc...143.html#manual
=====================================
After that your log is clean. :)


The following are some articles and a Windows Update link that I like to suggest to people to prevent malware and general PC maintenance.

Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.

Prevention article To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections please read the Prevention artice by Miekiemoes.

If your computer is slow Is a tutorial on what you can do if your computer is slow.
  • 0

#20
andyds
Posted 23 March 2009 - 03:56 AM

andyds

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
thanks kahdah,

everything is working great now..

You are a genius
  • 0

#21
kahdah
Posted 23 March 2009 - 05:22 AM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
You are welcome :)


Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If your the topic starter, and need this topic reopened, please contact me via pm with the address of the thread.

Everyone else please begin a New Topic.
  • 0

#22
kahdah
Posted 23 March 2009 - 05:23 AM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP