Antivirus Protection
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me
Go Back   Dev Shed Forums > System Administration > Antivirus Protection
Reload this Page

Mad.dll / TV Media

Discuss Mad.dll / TV Media in the Antivirus Protection forum on Dev Shed.
Mad.dll / TV Media Antivirus Protection forum discussing issues relating to antivirus programs, spyware, hijack protection, and personal firewalls for all operating systems. Keep your systems protected from hackers and other hazards.

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
« Previous Thread | Next Thread »  
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
  #1  
Old February 22nd, 2005, 05:56 PM
Matt_T Matt_T is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Feb 2005
Posts: 5 Matt_T User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 17 m 54 sec
Reputation Power: 0
Mad.dll / TV Media
Hello, I currently got this problem with my internet freezing and not being able to even load it up and not being able to click into my Email from MSN... so i did some research and found a person with the almost exact same problem as I have... So i did what the forum suggested and still nothing. I downloaded the Hijackthis and it said it could not delete the file and to email someone about it... and so i shall post my log for you guys and hope for some help
Logfile of HijackThis v1.99.1
Scan saved at 5:43:57 PM, on 2/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\QuickTime\qttask.exe
C:\Documents and Settings\Kakin\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {4A61692A-5EA7-8F5A-C663-4BE9224050E0} - C:\WINDOWS\system32\gleruqsp.dll
O2 - BHO: (no name) - {AB88D40A-135C-6D62-9195-4F127804F816} - C:\WINDOWS\system32\qujwulrh.dll
O2 - BHO: (no name) - {C7202A05-3EE2-29FB-954B-3C34AE8799F7} - C:\WINDOWS\system32\hcqzltui.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AIM] "C:\Program Files\AIM+\AIM+.exe" -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by1fd.bay1.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O20 - AppInit_DLLs: mad.dll
O23 - Service: ohwhpakjqzye (awmrnkoy6) - Unknown owner - C:\WINDOWS\system32\rycedqdw6.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Thanks a lot everyone.
Matt
Reply With Quote
  #2  
Old February 22nd, 2005, 09:06 PM
rave41799 rave41799 is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Dec 2003
Posts: 132 rave41799 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 1 Day 5 h 34 m 23 sec
Reputation Power: 5
Send a message via AIM to rave41799 Send a message via Yahoo to rave41799
First off, try running HijackThis and fixing the following lines:

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {4A61692A-5EA7-8F5A-C663-4BE9224050E0} - C:\WINDOWS\system32\gleruqsp.dll
O2 - BHO: (no name) - {AB88D40A-135C-6D62-9195-4F127804F816} - C:\WINDOWS\system32\qujwulrh.dll
O2 - BHO: (no name) - {C7202A05-3EE2-29FB-954B-3C34AE8799F7} - C:\WINDOWS\system32\hcqzltui.dll
O20 - AppInit_DLLs: mad.dll
O23 - Service: ohwhpakjqzye (awmrnkoy6) - Unknown owner - C:\WINDOWS\system32\rycedqdw6.exe (file missing)

Reboot and see how everything works.

If it's still doing it, post a fresh HijackThis log.
Reply With Quote
  #3  
Old February 24th, 2005, 01:35 PM
Matt_T Matt_T is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Feb 2005
Posts: 5 Matt_T User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 17 m 54 sec
Reputation Power: 0
I don't think a single file was able to be deleted, i would fix selected. and then scan again and poof all the ones i tried to fix are back... here's the new log-

Logfile of HijackThis v1.99.1
Scan saved at 1:33:40 PM, on 2/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Documents and Settings\Kakin\Desktop\HijackThis.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {4A61692A-5EA7-8F5A-C663-4BE9224050E0} - (no file)
O2 - BHO: (no name) - {AB88D40A-135C-6D62-9195-4F127804F816} - (no file)
O2 - BHO: (no name) - {C7202A05-3EE2-29FB-954B-3C34AE8799F7} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AIM] "C:\Program Files\AIM+\AIM+.exe" -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by1fd.bay1.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O20 - AppInit_DLLs: mad.dll
O23 - Service: ohwhpakjqzye (awmrnkoy6) - Unknown owner - C:\WINDOWS\system32\rycedqdw6.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
Reply With Quote
  #4  
Old February 24th, 2005, 03:36 PM
rave41799 rave41799 is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Dec 2003
Posts: 132 rave41799 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 1 Day 5 h 34 m 23 sec
Reputation Power: 5
Send a message via AIM to rave41799 Send a message via Yahoo to rave41799
I'm so sorry ... how stupid of me. Run HJT and scan and fix those items that I told you about and then AFTER that, reboot into Safe Mode (press F8 while the white bar goes across your screen before you see the XP logo) and then find the following files and delete them:

C:\WINDOWS\system32\gleruqsp.dll
C:\WINDOWS\system32\qujwulrh.dll
C:\WINDOWS\system32\hcqzltui.dll
C:\WINDOWS\system32\rycedqdw6.exe

Also, try and find MAD.DLL ... I'm not sure what directory it's in, possible C:\Windows\System32 but you'll want to look. Make sure you're able to see hidden files as well.

After you do that, please visit the following sites and run the free scans they offer and have them fix anything they find:

Panda ActiveScan
Trend Micro

Once completed, scan with HJT again and post your log just to make sure we got them all!
Reply With Quote
  #5  
Old February 25th, 2005, 05:25 PM
Matt_T Matt_T is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Feb 2005
Posts: 5 Matt_T User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 17 m 54 sec
Reputation Power: 0
latest log.... doesn't seem a thing changed, i went into Safe mode, looking for those DLLs u said, and none were on my PC, even in Safe mode with hidden files viewable.

Logfile of HijackThis v1.99.1
Scan saved at 5:22:52 PM, on 2/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\AIM+\AIM+.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Kakin\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {4A61692A-5EA7-8F5A-C663-4BE9224050E0} - (no file)
O2 - BHO: (no name) - {AB88D40A-135C-6D62-9195-4F127804F816} - (no file)
O2 - BHO: (no name) - {C7202A05-3EE2-29FB-954B-3C34AE8799F7} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AIM] "C:\Program Files\AIM+\AIM+.exe" -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by1fd.bay1.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O20 - AppInit_DLLs: mad.dll
O23 - Service: ohwhpakjqzye (awmrnkoy6) - Unknown owner - C:\WINDOWS\system32\rycedqdw6.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
Reply With Quote
  #6  
Old February 26th, 2005, 02:12 PM
rave41799 rave41799 is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Dec 2003
Posts: 132 rave41799 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 1 Day 5 h 34 m 23 sec
Reputation Power: 5
Send a message via AIM to rave41799 Send a message via Yahoo to rave41799
Well it looks like the dll's are gone, it's just the 02-BHO entries that are still there. If you haven't, try running HJT and have it fix:

O2 - BHO: (no name) - {4A61692A-5EA7-8F5A-C663-4BE9224050E0} - (no file)
O2 - BHO: (no name) - {AB88D40A-135C-6D62-9195-4F127804F816} - (no file)
O2 - BHO: (no name) - {C7202A05-3EE2-29FB-954B-3C34AE8799F7} - (no file)
O23 - Service: ohwhpakjqzye (awmrnkoy6) - Unknown owner - C:\WINDOWS\system32\rycedqdw6.exe (file missing)

Rescan again after that. If they reappear, try a scan under Safe Mode with HJT. It should run just fine; delete the entries if they're there again. Also, while in Safe Mode, try finding and deleting:

C:\WINDOWS\system32\rycedqdw6.exe

Reboot, scan with HJT and see if you see those same entries again. I'm going to try and see if there's another method out there while you try that.

Post again with your results!
Reply With Quote
  #7  
Old February 27th, 2005, 01:34 AM
Matt_T Matt_T is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Feb 2005
Posts: 5 Matt_T User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 17 m 54 sec
Reputation Power: 0
Tried removing the BHO files- every time i scan they still show up, and for the rycedqdw6.exe, it never shows up in safe mode, so im kinda stuck between a rock and a hard place
Reply With Quote
Reply

Viewing: Dev Shed Forums > System Administration > Antivirus Protection > Mad.dll / TV Media

« Previous Thread | Next Thread »

Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Linear Mode Linear Mode
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump


Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 





© 2003-2008 by Developer Shed. All rights reserved. DS Cluster 5 hosted by Hostway.