Fuzzylogik
Posts: 7 +0
I've been working on this problem off and on all week and now I need your help.
The first sign of problems was when my ZA firewall blue screened during an update last week. When I tried to scan my HD with NAV, NMAIN.EXE routinely hits 99% of system resources and will sit there for hours if left uninterrupted (it never accomplishes anything but Task Manager never reports that the program hangs. When I attempt to terminate the service, I receive the following error: "The opeation could not be completed. Access is denied." I am logged in as the administrator of a XP Pro box. The only way to terminate this file is to reboot.
Since then, I have found that I have mysterious files that show up in my HKEY_LOCAL_MACHINE: Run that always start with "DM" (example: dmydd.exe, dmfne.exe, dmppg.exe, etc). The names of the files do not seem to be important, but they always begin with DM, they replicate with time, and they point to c:\windows\system32. The problem: these files do not exist anywhere. I have "show hidden files and folders" checked, so I should see all files on my computer. A further complication: Ad-Aware hangs within 15-30 seconds into the scan and Task Manager IMMEDIATELY reports that it is not running as soon as it hangs. I have successfully run Spybot and it has located "Windows Security Center" errors for anitvirus and Firewall, but when I checked out these errors in my registry, they did not exist at all (ie HKEY_LOCAL_MACHINE\Software\Microsoft\SecurityCenter does exist but the FirewallDisableNotify key (for instance) does NOT exist within SecurityCenter). It did find Pipas.A and Findspy.A in that scan as well, but they do not appear to be able to cause the damage that I am experiencing.
Out of frustration, I ran TrendMicro's scan twice today. The first time it found a number of worms, but did not report what they were specifically. I had it fix the problems remotely and it appeared to work. After experiencing further problems thereafter, I ran TrendMicro's viruscan again to double check and it came back clean.
I have installed and reinstalled NAV several times (each time after I feel like I've discovered part of the problem). Currently I have no AV on my computer. And if you are going to lamblast me for using NAV, hey, you are preaching to the choir right now. I've never had a virus/worm slip through like this and I am NOT a happy camper. The only other SW that I use as a filter is Spyware Blaster (vs. Spybot's immunization, which I've had some problems with historically). Truthfully this program probably has not been updated in the last 3-4 months.
I've been looking for bugs that can cause these specific problem through Techspot and the like to no avail. I'm pretty damn frustrated right now and would appreciate ANY helpful thoughts, critiques, name calling, etc.
Thanks in advance for your help. (BTW, I'll post a Hijack, but I typically don't like to post it until it has been requested).
Fuzzylogik
The first sign of problems was when my ZA firewall blue screened during an update last week. When I tried to scan my HD with NAV, NMAIN.EXE routinely hits 99% of system resources and will sit there for hours if left uninterrupted (it never accomplishes anything but Task Manager never reports that the program hangs. When I attempt to terminate the service, I receive the following error: "The opeation could not be completed. Access is denied." I am logged in as the administrator of a XP Pro box. The only way to terminate this file is to reboot.
Since then, I have found that I have mysterious files that show up in my HKEY_LOCAL_MACHINE: Run that always start with "DM" (example: dmydd.exe, dmfne.exe, dmppg.exe, etc). The names of the files do not seem to be important, but they always begin with DM, they replicate with time, and they point to c:\windows\system32. The problem: these files do not exist anywhere. I have "show hidden files and folders" checked, so I should see all files on my computer. A further complication: Ad-Aware hangs within 15-30 seconds into the scan and Task Manager IMMEDIATELY reports that it is not running as soon as it hangs. I have successfully run Spybot and it has located "Windows Security Center" errors for anitvirus and Firewall, but when I checked out these errors in my registry, they did not exist at all (ie HKEY_LOCAL_MACHINE\Software\Microsoft\SecurityCenter does exist but the FirewallDisableNotify key (for instance) does NOT exist within SecurityCenter). It did find Pipas.A and Findspy.A in that scan as well, but they do not appear to be able to cause the damage that I am experiencing.
Out of frustration, I ran TrendMicro's scan twice today. The first time it found a number of worms, but did not report what they were specifically. I had it fix the problems remotely and it appeared to work. After experiencing further problems thereafter, I ran TrendMicro's viruscan again to double check and it came back clean.
I have installed and reinstalled NAV several times (each time after I feel like I've discovered part of the problem). Currently I have no AV on my computer. And if you are going to lamblast me for using NAV, hey, you are preaching to the choir right now. I've never had a virus/worm slip through like this and I am NOT a happy camper. The only other SW that I use as a filter is Spyware Blaster (vs. Spybot's immunization, which I've had some problems with historically). Truthfully this program probably has not been updated in the last 3-4 months.
I've been looking for bugs that can cause these specific problem through Techspot and the like to no avail. I'm pretty damn frustrated right now and would appreciate ANY helpful thoughts, critiques, name calling, etc.
Thanks in advance for your help. (BTW, I'll post a Hijack, but I typically don't like to post it until it has been requested).
Fuzzylogik
- 
