cmdservice problems

[Uri.raveh]

Hi,
It's not the cmdService that causes it all???

Here's the check.bat login.txt:


Running from C:\Documents and Settings\Administrator\Desktop\Anti Spyware
Il file system Š di tipo NTFS.
C: non Š danneggiata.
C:\WINNT\system32\anomps.dll
C:\WINNT\system32\aza0015me.dll
C:\WINNT\system32\aza6lifs1826.dll
C:\WINNT\system32\azao0713e.dll
C:\WINNT\system32\d00m0ad1ed0.dll
C:\WINNT\system32\dn2s01f7e.dll
C:\WINNT\system32\dnj6011se.dll
C:\WINNT\system32\dnn0015me.dll
C:\WINNT\system32\e2jmlc111f.dll
C:\WINNT\system32\e602lgdo160c.dll
C:\WINNT\system32\en22l1fo1.dll
C:\WINNT\system32\en68l1ju1.dll
C:\WINNT\system32\en8ql1l51.dll
C:\WINNT\system32\enl8l13u1.dll
C:\WINNT\system32\enpul1791.dll
C:\WINNT\system32\f8l02i3mg8.dll
C:\WINNT\system32\fp4403hqe.dll
C:\WINNT\system32\fp6s03j7e.dll
C:\WINNT\system32\fp8003lme.dll
C:\WINNT\system32\fp8s03l7e.dll
C:\WINNT\system32\g4jo0e13eh.dll
C:\WINNT\system32\g6jo0g13e6.dll
C:\WINNT\system32\g6jolg1316.dll
C:\WINNT\system32\g8400ihme84a0.dll
C:\WINNT\system32\gD400ihme84a0.dll
C:\WINNT\system32\h2j40c1qef.dll
C:\WINNT\system32\h6l20g3oe6.dll
C:\WINNT\system32\hrlq0535e.dll
C:\WINNT\system32\i2nmlc511f.dll
C:\WINNT\system32\i4600ejmehoa0.dll
C:\WINNT\system32\i6jqlg1516.dll
C:\WINNT\system32\irjol5131.dll
C:\WINNT\system32\irr6l59s1.dll
C:\WINNT\system32\j06mlaj11do.dll
C:\WINNT\system32\j22q0cf5ef2.dll
C:\WINNT\system32\jt4607hse.dll
C:\WINNT\system32\jt6s07j7e.dll
C:\WINNT\system32\jt8s07l7e.dll
C:\WINNT\system32\jtjo0713e.dll
C:\WINNT\system32\k408ledu1h08.dll
C:\WINNT\system32\k826lifs1826.dll
C:\WINNT\system32\k8620ijoe8oc0.dll
C:\WINNT\system32\kt8ml7l11.dll
C:\WINNT\system32\ktpml7711.dll
C:\WINNT\system32\l0l60a3sed.dll
C:\WINNT\system32\l2j8lc1u1f.dll
C:\WINNT\system32\l2l6lc3s1f.dll
C:\WINNT\system32\l42s0ef7eh2.dll
C:\WINNT\system32\lu_messagetext.dll
C:\WINNT\system32\lvrs0997e.dll
C:\WINNT\system32\m6820gloe6qc0.dll
C:\WINNT\system32\m8poli7318.dll
C:\WINNT\system32\mv04l9dq1.dll
C:\WINNT\system32\mv0ul9d91.dll
C:\WINNT\system32\mvp8l97u1.dll
C:\WINNT\system32\mz4sdmod.dll
C:\WINNT\system32\n0p40a7qed.dll
C:\WINNT\system32\n86q0ij5e8o.dll
C:\WINNT\system32\o2660cjsefo60.dll
C:\WINNT\system32\o8lu0i39e8.dll
C:\WINNT\system32\p04ulah91d4.dll
C:\WINNT\system32\p08q0al5edq.dll
C:\WINNT\system32\p0n8la5u1d.dll
C:\WINNT\system32\p48qlel51hq.dll
C:\WINNT\system32\p8p6li7s18.dll
C:\WINNT\system32\r0r6la9s1d.dll
C:\WINNT\system32\r68s0gl7e6q.dll
C:\WINNT\system32\rZsser.dll
FINDSTR: Impossibile aprire C:\WINNT\system32\fpn2035oe.dll
FINDSTR: Impossibile aprire C:\WINNT\system32\mhiseq.dll
FINDSTR: Impossibile aprire C:\WINNT\system32\q2pslc771f.dll

[LonnyRJones]

Thanks

Save xcaclsIT.zip to c:\
or the root of the drive that windows is installed on (normaly c
(edited to remove Link , Its a beta)
Extract the files inside also to C:\, open the new xcaclsIT folder
open badfiles text and add this entire list.

C:\WINNT\system32\anomps.dll
C:\WINNT\system32\aza0015me.dll
C:\WINNT\system32\aza6lifs1826.dll
C:\WINNT\system32\azao0713e.dll
C:\WINNT\system32\d00m0ad1ed0.dll
C:\WINNT\system32\dn2s01f7e.dll
C:\WINNT\system32\dnj6011se.dll
C:\WINNT\system32\dnn0015me.dll
C:\WINNT\system32\e2jmlc111f.dll
C:\WINNT\system32\e602lgdo160c.dll
C:\WINNT\system32\en22l1fo1.dll
C:\WINNT\system32\en68l1ju1.dll
C:\WINNT\system32\en8ql1l51.dll
C:\WINNT\system32\enl8l13u1.dll
C:\WINNT\system32\enpul1791.dll
C:\WINNT\system32\f8l02i3mg8.dll
C:\WINNT\system32\fp4403hqe.dll
C:\WINNT\system32\fp6s03j7e.dll
C:\WINNT\system32\fp8003lme.dll
C:\WINNT\system32\fp8s03l7e.dll
C:\WINNT\system32\g4jo0e13eh.dll
C:\WINNT\system32\g6jo0g13e6.dll
C:\WINNT\system32\g6jolg1316.dll
C:\WINNT\system32\g8400ihme84a0.dll
C:\WINNT\system32\gD400ihme84a0.dll
C:\WINNT\system32\h2j40c1qef.dll
C:\WINNT\system32\h6l20g3oe6.dll
C:\WINNT\system32\hrlq0535e.dll
C:\WINNT\system32\i2nmlc511f.dll
C:\WINNT\system32\i4600ejmehoa0.dll
C:\WINNT\system32\i6jqlg1516.dll
C:\WINNT\system32\irjol5131.dll
C:\WINNT\system32\irr6l59s1.dll
C:\WINNT\system32\j06mlaj11do.dll
C:\WINNT\system32\j22q0cf5ef2.dll
C:\WINNT\system32\jt4607hse.dll
C:\WINNT\system32\jt6s07j7e.dll
C:\WINNT\system32\jt8s07l7e.dll
C:\WINNT\system32\jtjo0713e.dll
C:\WINNT\system32\k408ledu1h08.dll
C:\WINNT\system32\k826lifs1826.dll
C:\WINNT\system32\k8620ijoe8oc0.dll
C:\WINNT\system32\kt8ml7l11.dll
C:\WINNT\system32\ktpml7711.dll
C:\WINNT\system32\l0l60a3sed.dll
C:\WINNT\system32\l2j8lc1u1f.dll
C:\WINNT\system32\l2l6lc3s1f.dll
C:\WINNT\system32\l42s0ef7eh2.dll
C:\WINNT\system32\lu_messagetext.dll
C:\WINNT\system32\lvrs0997e.dll
C:\WINNT\system32\m6820gloe6qc0.dll
C:\WINNT\system32\m8poli7318.dll
C:\WINNT\system32\mv04l9dq1.dll
C:\WINNT\system32\mv0ul9d91.dll
C:\WINNT\system32\mvp8l97u1.dll
C:\WINNT\system32\mz4sdmod.dll
C:\WINNT\system32\n0p40a7qed.dll
C:\WINNT\system32\n86q0ij5e8o.dll
C:\WINNT\system32\o2660cjsefo60.dll
C:\WINNT\system32\o8lu0i39e8.dll
C:\WINNT\system32\p04ulah91d4.dll
C:\WINNT\system32\p08q0al5edq.dll
C:\WINNT\system32\p0n8la5u1d.dll
C:\WINNT\system32\p48qlel51hq.dll
C:\WINNT\system32\p8p6li7s18.dll
C:\WINNT\system32\r0r6la9s1d.dll
C:\WINNT\system32\r68s0gl7e6q.dll
C:\WINNT\system32\rZsser.dll
C:\WINNT\system32\fpn2035oe.dll
C:\WINNT\system32\mhiseq.dll
C:\WINNT\system32\q2pslc771f.dll
C:\WINNT\system32\guard.tmp


exit the text and save as you do. Now run xcalcsit.bat, restart your PC when prompted
there will be a bluescreen error, not to worry. once windows has loaded run
c:\xcalcsit\Afterreboot.bat and post the report text
Aslo run the batch you made before and if any file show post logit.txt

[Uri.raveh]

Here's the "xcaclsIT" report:


Running from C:\xcaclsIT
Il file system Š di tipo NTFS.
C: non Š danneggiata.

Files proccessed and moved to C:\xcaclsIT\!backups

processed file: C:\WINNT\system32\anomps.dll
processed file: C:\WINNT\system32\aza0015me.dll
processed file: C:\WINNT\system32\aza6lifs1826.dll
processed file: C:\WINNT\system32\azao0713e.dll
processed file: C:\WINNT\system32\d00m0ad1ed0.dll
processed file: C:\WINNT\system32\dn2s01f7e.dll
processed file: C:\WINNT\system32\dnj6011se.dll
processed file: C:\WINNT\system32\dnn0015me.dll
processed file: C:\WINNT\system32\e2jmlc111f.dll
processed file: C:\WINNT\system32\e602lgdo160c.dll
processed file: C:\WINNT\system32\en22l1fo1.dll
processed file: C:\WINNT\system32\en68l1ju1.dll
processed file: C:\WINNT\system32\en8ql1l51.dll
processed file: C:\WINNT\system32\enl8l13u1.dll
processed file: C:\WINNT\system32\enpul1791.dll
processed file: C:\WINNT\system32\f8l02i3mg8.dll
processed file: C:\WINNT\system32\fp4403hqe.dll
processed file: C:\WINNT\system32\fp6s03j7e.dll
processed file: C:\WINNT\system32\fp8003lme.dll
processed file: C:\WINNT\system32\fp8s03l7e.dll
processed file: C:\WINNT\system32\g4jo0e13eh.dll
processed file: C:\WINNT\system32\g6jo0g13e6.dll
processed file: C:\WINNT\system32\g6jolg1316.dll
processed file: C:\WINNT\system32\g8400ihme84a0.dll
processed file: C:\WINNT\system32\gD400ihme84a0.dll
processed file: C:\WINNT\system32\h2j40c1qef.dll
processed file: C:\WINNT\system32\h6l20g3oe6.dll
processed file: C:\WINNT\system32\hrlq0535e.dll
processed file: C:\WINNT\system32\i2nmlc511f.dll
processed file: C:\WINNT\system32\i4600ejmehoa0.dll
processed file: C:\WINNT\system32\i6jqlg1516.dll
processed file: C:\WINNT\system32\irjol5131.dll
processed file: C:\WINNT\system32\irr6l59s1.dll
processed file: C:\WINNT\system32\j06mlaj11do.dll
processed file: C:\WINNT\system32\j22q0cf5ef2.dll
processed file: C:\WINNT\system32\jt4607hse.dll
processed file: C:\WINNT\system32\jt6s07j7e.dll
processed file: C:\WINNT\system32\jt8s07l7e.dll
processed file: C:\WINNT\system32\jtjo0713e.dll
processed file: C:\WINNT\system32\k408ledu1h08.dll
processed file: C:\WINNT\system32\k826lifs1826.dll
processed file: C:\WINNT\system32\k8620ijoe8oc0.dll
processed file: C:\WINNT\system32\kt8ml7l11.dll
processed file: C:\WINNT\system32\ktpml7711.dll
processed file: C:\WINNT\system32\l0l60a3sed.dll
processed file: C:\WINNT\system32\l2j8lc1u1f.dll
processed file: C:\WINNT\system32\l2l6lc3s1f.dll
processed file: C:\WINNT\system32\l42s0ef7eh2.dll
processed file: C:\WINNT\system32\lu_messagetext.dll
processed file: C:\WINNT\system32\lvrs0997e.dll
processed file: C:\WINNT\system32\m6820gloe6qc0.dll
processed file: C:\WINNT\system32\m8poli7318.dll
processed file: C:\WINNT\system32\mv04l9dq1.dll
processed file: C:\WINNT\system32\mv0ul9d91.dll
processed file: C:\WINNT\system32\mvp8l97u1.dll
processed file: C:\WINNT\system32\mz4sdmod.dll
processed file: C:\WINNT\system32\n0p40a7qed.dll
processed file: C:\WINNT\system32\n86q0ij5e8o.dll
processed file: C:\WINNT\system32\o2660cjsefo60.dll
processed file: C:\WINNT\system32\o8lu0i39e8.dll
processed file: C:\WINNT\system32\p04ulah91d4.dll
processed file: C:\WINNT\system32\p08q0al5edq.dll
processed file: C:\WINNT\system32\p0n8la5u1d.dll
processed file: C:\WINNT\system32\p48qlel51hq.dll
processed file: C:\WINNT\system32\p8p6li7s18.dll
processed file: C:\WINNT\system32\r0r6la9s1d.dll
processed file: C:\WINNT\system32\r68s0gl7e6q.dll
processed file: C:\WINNT\system32\rZsser.dll
processed file: C:\WINNT\system32\q2pslc771f.dll



And the check.bat login.txt:


Running from C:\Documents and Settings\Administrator\Desktop\Anti Spyware
Il file system Š di tipo NTFS.
C: non Š danneggiata.
C:\WINNT\system32\aza40a7qed.dll
C:\WINNT\system32\n2l80c3uef.dll
FINDSTR: Impossibile aprire C:\WINNT\system32\dn8o01l3e.dll
FINDSTR: Impossibile aprire C:\WINNT\system32\hr4m05h1e.dll
FINDSTR: Impossibile aprire C:\WINNT\system32\mvobjs.dll

[LonnyRJones]

Hi

Keep in mind that bug creates new file's every time the pc is restarted or when you log off and on again

repeat the same instructions again this time add this list to the bafiles.txt


C:\WINNT\system32\aza40a7qed.dll
C:\WINNT\system32\n2l80c3uef.dll
C:\WINNT\system32\dn8o01l3e.dll
C:\WINNT\system32\hr4m05h1e.dll
C:\WINNT\system32\mvobjs.dll

[Uri.raveh]

Hi, here's what came out.
By the way, I had no blue screen error both times.

xcalclsIT report:

Running from C:\xcaclsIT
Il file system Š di tipo NTFS.
C: non Š danneggiata.

Files proccessed and moved to C:\xcaclsIT\!backups

processed file: C:\WINNT\system32\aza40a7qed.dll
processed file: C:\WINNT\system32\n2l80c3uef.dll
processed file: C:\WINNT\system32\dn8o01l3e.dll
processed file: C:\WINNT\system32\hr4m05h1e.dll



chack.bat login.txt:


Running from C:\Documents and Settings\Administrator\Desktop\Anti Spyware
Il file system Š di tipo NTFS.
C: non Š danneggiata.
FINDSTR: Impossibile aprire C:\WINNT\system32\j4n20e5oeh.dll
FINDSTR: Impossibile aprire C:\WINNT\system32\mttask.dll
FINDSTR: Impossibile aprire C:\WINNT\system32\n4l8le3u1h.dll



Should I add these file too to the badfiles.txt and run again?
If it keeps on creating them how can we stop it?

Thanks

uri

[LonnyRJones]

Hi

Have you restarted the pc since running check bat ?
if not yes add those files to the list, be sure to edit out "FINDSTR: Impossibile aprire " that part though

[Uri.raveh]

I did restart it so I did the whole thing again. Now I'll try to keep the pc running.



So here we go

xcaclsIT report:

Running from C:\xcaclsIT
Il file system Š di tipo NTFS.
C: non Š danneggiata.

Files proccessed and moved to C:\xcaclsIT\!backups

processed file: C:\WINNT\system32\n4l8le3u1h.dll

check.bat login.txt

Running from C:\Documents and Settings\Administrator\Desktop\Anti Spyware
Il file system Š di tipo NTFS.
C: non Š danneggiata.
C:\WINNT\system32\dn2o01f3e.dll
C:\WINNT\system32\p8p60i7se8.dll
FINDSTR: Impossibile aprire C:\WINNT\system32\en44l1hq1.dll
FINDSTR: Impossibile aprire C:\WINNT\system32\jt8207loe.dll
FINDSTR: Impossibile aprire C:\WINNT\system32\rWsscrpt.dll


What should I do next?

[LonnyRJones]

Ok
add this list to badfiles.txt
C:\WINNT\system32\dn2o01f3e.dll
C:\WINNT\system32\p8p60i7se8.dll
C:\WINNT\system32\en44l1hq1.dll
C:\WINNT\system32\jt8207loe.dll
C:\WINNT\system32\rWsscrpt.dll


save and exit notepad then run xcalcsIt.bat and restart the pc, run check bat again and post that log if there are still files showing

[Uri.raveh]

hi

here's the log:

Running from C:\Documents and Settings\Administrator\Desktop\Anti Spyware
Il file system Š di tipo NTFS.
C: non Š danneggiata.
C:\WINNT\system32\lp_trans.dll
FINDSTR: Impossibile aprire C:\WINNT\system32\rWsscrpt.dll


I've noticed that the last file name here has already been added to the badfiles.txt
The first one no.

[Uri.raveh]

should I continue doing this until no more file names appear?
If so, What do I do then?