PDA

View Full Version : End Program -n-



kjaada
07-07-2009, 09:13 AM
Have XP pro and latley have trouble shutting down.I get "Ending Program -n"
It then takes yonks and I have to click several end program now popups before it stops.I thought Firefox was the problem but I uninstalled and reinstalled that.
I am also running Xandros Presto inside windows and wonder about that.This started out of the blue not after anything in particular was done.

pctek
07-07-2009, 10:21 AM
So what is it your are ending? It should say which file(s) is causing the problems(s).

kjaada
07-07-2009, 11:23 AM
As it says "program - n
Which I understand is a linux program in one reference I found on Google.
If I end that then I also have to end at least 2 "Firefox's" before I shut down and all starts up ok again.It is very odd. If I switch off without "ending" then
my next start is almost useless as everything is sooo slow.

pctek
07-07-2009, 11:25 AM
Linux? So have you installed some Linux program then?
If so, uninstall it and Firefox.

Reinstall FF.

If not, I'd start with a malware scan and post a HJT log.

kjaada
07-07-2009, 11:50 AM
Is it possible for a linux program to "cross over"?
I have already uninstalled and reinstalled FF.
will get HJT and post log later.

kjaada
07-07-2009, 12:08 PM
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:04:35 a.m., on 7/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\COMODO\SafeSurf\cssurf.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\VoipCheapCom\VoipCheapCom.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DSE\XH9947\Installer\WINXP\DSEWCU.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nzcity.co.nz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [COMODO SafeSurf] "C:\Program Files\COMODO\SafeSurf\cssurf.exe" -s
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ScanSoft OmniPage SE 4.0-reminder] "C:\Program Files\ScanSoft\OmniPageSE4.0\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\OmniPageSE4.0\Ereg\ereg.ini"
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKCU\..\Run: [VoipCheapCom] "C:\Program Files\VoipCheapCom\VoipCheapCom.exe" -nosplash -minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: XH9947 DSE Wireless Client Utility.lnk = C:\Program Files\DSE\XH9947\Installer\WINXP\DSEWCU.exe
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1238730133859
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\cssdll32.dll C:\WINDOWS\system32\guard32.dll
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Google Update Service (gupdate1c9c12fb5cb0658) (gupdate1c9c12fb5cb0658) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

--
End of file - 5630 bytes

Blam
07-07-2009, 03:28 PM
Is it possible for a linux program to "cross over"?
I have already uninstalled and reinstalled FF.
will get HJT and post log later.

No...

This is extremely nasty:
O20 - AppInit_DLLs: C:\WINDOWS\system32\cssdll32.dll C:\WINDOWS\system32\guard32.dll

Find the two files and delete them

Run MBAM and Spyware Terminator.

kjaada
07-07-2009, 05:31 PM
Did all as advised and will report back if any problems still persist.So far looks good.
Thanks

Speedy Gonzales
07-07-2009, 05:48 PM
You can tick these as well then tick fix checked

Close browsers

I would uninstall Adaware. its past it used by date. Use something like malwarebytes

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [ScanSoft OmniPage SE 4.0-reminder] "C:\Program Files\ScanSoft\OmniPageSE4.0\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\OmniPageSE4.0\Ereg\ereg.ini"

You dont need these either

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

Umm I think both of these belong to Comodo firewall

C:\WINDOWS\system32\cssdll32.dll C:\WINDOWS\system32\guard32.dll (so if you deleted these files and Comodo stops working, thats why)

It looks like cssdll32.dll does belong to a trojan, but it also belongs to Comodo

wainuitech
07-07-2009, 07:18 PM
C:\WINDOWS\system32\cssdll32.dll C:\WINDOWS\system32\guard32.dll (so if you deleted these files and Comodo stops working, thats why)

It looks like cssdll32.dll does belong to a trojan, but it also belongs to Comodo Dead right Speedy - removing them, considering Comodo is installed may stop them it from working.

Its best to check, on the PC concerned what they actually belong to BEFORE "ASSUMING" (Again) :groan: that they are nasty -- you should Use something like Security Task Manager (http://www.neuber.com/taskmanager/index.html) -- it tells you EXACTLY what program(s) the .dll is running.

Pancake
07-07-2009, 07:56 PM
I think its about time you had a dedicated forum for removing malware where only people with knowledge of malware are allowed to answer posts.At this rate someone will end up a computer that will only be fit to use as a door stop..!!!!!!!!!!

gary67
07-07-2009, 08:14 PM
I wish that could happen Pancake, that's why I try not to post anything on threads about infections unless it's so obvious even I can see it

Blam
07-07-2009, 09:16 PM
I think its about time you had a dedicated forum for removing malware where only people with knowledge of malware are allowed to answer posts.At this rate someone will end up a computer that will only be fit to use as a door stop..!!!!!!!!!!

Sorry...next time I'll stick to what I know best..:o

pctek
08-07-2009, 09:11 AM
Now, now. HJT doesn't remove programs, it just removes reg entries and startup items, and it DOES make a backup. SO if you do remove something you shouldn't have, you can restore it back.
better safe then sorry..........