Spybot 1.6.2 will not run to completion, crashes. DDS.txt File

[plug_it_in]

Well running Kaspersky again as I accidentally stopped it at 51% this was the story so far

KASPERSKY ONLINE SCANNER 7.0: scan report
Sunday, September 26, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Sunday, September 26, 2010 07:39:16
Records in database: 4240748
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - Critical areas:
C:\Documents and Settings\Administrator\Desktop\Start Menu\Programs\Startup
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
C:\Program Files
C:\WINDOWS

Scan statistics:
Objects scanned: 80457
Threats found: 3
Infected objects found: 4
Suspicious objects found: 0
Scan duration: 01:52:02


File name / Threat / Threats count
C:\Program Files\RealVNC\VNC4\vncconfig.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.ad 1
C:\Program Files\RealVNC\VNC4\winvnc4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.ad 1
C:\Program Files\Remote Desktop Control\apc_Admin.exe Infected: not-a-virus:RemoteAdmin.Win32.RemoteDesktopControl.a 1
C:\Program Files\SystemScheduler\WSProc.dll Infected: not-a-virus:Monitor.Win32.Hooker.at 1

Scanning stopped by the user.

[jmw3]

They appear to be false positives - flagged due to the nature of the programs.

So the only problem you're experiencing is that Spybot won't run. Have you tried an uninstall/reinstall?

[plug_it_in]

First thing I did was remove Spybot and reinstall. Is there more to do to makse sure its really gone .

btw I got Kaspersky to run on all of C Drive and here it is :

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Monday, September 27, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Sunday, September 26, 2010 11:11:47
Records in database: 4242833
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - Folder:
C:\

Scan statistics:
Objects scanned: 232949
Threats found: 7
Infected objects found: 11
Suspicious objects found: 0
Scan duration: 05:29:09


File name / Threat / Threats count
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\19E00004.VBN Infected: Trojan.Win32.Genome.aeeu 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\19E0000A.VBN Infected: Trojan.Win32.Genome.aeeu 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\19E00010.VBN Infected: Trojan-GameThief.Win32.OnLineGames.umal 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\19E00012.VBN Infected: Trojan-GameThief.Win32.OnLineGames.umal 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\19E00014.VBN Infected: Trojan-GameThief.Win32.OnLineGames.uowc 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\19E00015.VBN Infected: Trojan.Win32.Genome.aeeu 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\19E00025.VBN Infected: Trojan-Downloader.Win32.Agent.csiz 1
C:\Program Files\RealVNC\VNC4\vncconfig.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.ad 1
C:\Program Files\RealVNC\VNC4\winvnc4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.ad 1
C:\Program Files\Remote Desktop Control\apc_Admin.exe Infected: not-a-virus:RemoteAdmin.Win32.RemoteDesktopControl.a 1
C:\Program Files\SystemScheduler\WSProc.dll Infected: not-a-virus:Monitor.Win32.Hooker.at 1

Selected area has been scanned.

[jmw3]

What about trying to run Spybot with all other Security programs disabled? What happens if you try to run it from Safe Mode?

Download Security Check by screen317 from one of the following links & save it to your desktop:
Link 1
Link 2

• Double click SecurityCheck.exe to run it then press any key at the prompt to continue
• Once the tool has finished a Notepad document should open named checkup.txt
• Copy/paste the contents of checkup.txt & post in your next reply

[plug_it_in]

Results of screen317's Security Check version 0.99.5
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
ESET Online Scanner v3
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
IBM 32-bit Runtime Environment for Java 2, v5.0
Java(TM) 6 Update 21
IBM 32-bit Runtime Environment for Java 2, v5.0
Adobe Flash Player 10.1.82.76
Adobe Reader 9.3.4
````````````````````````````````
Process Check:
objlist.exe by Laurent
Symantec Client Security Symantec AntiVirus DefWatch.exe
Symantec Client Security Symantec AntiVirus SavRoam.exe
Symantec Client Security Symantec AntiVirus Rtvscan.exe
Symantec Client Security Symantec Client Firewall ISSVC.exe
Symantec Client Security Symantec Client Firewall SymSPort.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

[jmw3]

Hi

Is there a way to fuind out why Spybot is crashing ? Wouldnt that give a clue ?

Possibly. I'll get back to you that.

There's something else I want to check out.

Can you just confirm it is only Spybot that won't run. Your other security programs - Symantec AV & Firewall are fine. And that there are no other problems.

[plug_it_in]

I cant thank you enough for all your time and effort.

I reinstalled Spybot again, but this time to a different directory than the default, just in case it was referenced anywhere. I also enabled TeaTimer which I dont normally run. First I ran with no update and YEAH it ran . Found 45 errors. Then updated and ran again . Again ran fine. Turned off TeaTimer and is running fine. It always failed when it jumps from out 9K 10k entry to 24k entry.

So something you took me through must have fixed it.

All the very best .

[jmw3]

Good stuff

Clean Up
Now we need to clear out the programs we've been using to clean up your computer, they are not suitable for general malware removal and could cause damage if used inappropriately.
Remove ComboFix
The following will implement some cleanup procedures as well as reset System Restore points:
Click Start > Run then copy/paste the following coded text into the Run box and click OK:

ComboFix /Uninstall

OTC
Download OTC by Old Timer here & save it to your desktop.
Double click on OTC.exe. Click on CleanUp!.
You will receive a prompt that it needs to restart the computer to remove the files. Click Yes.
It will restart your computer automatically. If it doesn't, please restart your computer manually.
You can delete the following from your desktop:
TFC.exe
RKUnhookerLE.exe
The Gmer.exe file (it will be randomly named .exe file)
MBRCheck.exe
SecurityCheck.exe
Any logs that may have been saved to your desktop
You can remove the Kaspersky & Eset Online Scanners if present. This can be done via Add or Remove Programs

All Clean
Now that your system is safe we would like you to keep it that way.
Take the time to follow these recommendations & it will greatly reduce the risk of further infections and greatly diminish the chances of you having to visit here again.

Create a Clean System Restore Point
Create a new, clean System Restore point which you can use in case of future system problems:
Press Start->All Programs->Accessories->System Tools->System Restore
Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close
Now remove old, infected System Restore points:
Next click Start->Run and type cleanmgr in the box and click OK
Ensure the boxes for Temporary Files & Temporary Internet Files are checked. You can choose to check other boxes if you wish but they are not required.
Select the More Options tab, under System Restore click Clean up... and click Yes to the prompt
Click OK and Yes to confirm.

Microsoft Windows Update
Microsoft releases patches for Windows and Office products regularly to patch up Windows and Office products loopholes and fix any bugs found. Install the updates immediately if they are found.
To update Windows
Go to Start > All Programs > Windows Update
To update Office
Open up any Office program.
Go to Help > Check for Updates

Malwarebytes' Anti-Malware
Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It is totally free but for real-time protection you will have to pay a small one-time fee.
You can find a tutorial here. Keep it updated & run it regularly.

SpywareBlaster
Download and install Javacools SpywareBlaster from here
SpywareBlaster adds a list of ActiveX controls, tracking cookies and sites which will be blocked in either Internet Explorer or Firefox browsers. You need to manually check for updates regularly.

Download and Install a HOSTS File
A HOSTS file is a big list of bad web sites. The list has a specific format, a specific name, (name is just HOSTS with no file extension), and a specific location. Your machine always looks at that file in that location before connecting to a web site to verify the address. So the HOSTS listing can be used to "short circuit" a request to a bad website by giving it the address of your own machine.
Install MVPS Hosts File From Here
The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
You can Find the Tutorial HERE

Install WinPatrol
Download it here
You can find information about how WinPatrol works here

Read some information here on how to prevent Malware.

Hopefully these steps will help keep your computer clean.

[jmw3]

Since this issue appears to be resolved ... this Topic has been closed.

Note:If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include fresh DDS & Attach logs and a link to your previous thread.

If it has been less than four days since your last response and you need the thread re-opened, please send me or Moderator a private message (pm). A valid, working link to the closed topic is also required.