Content Top
DAL Computer Help » Internet Security Help » Spyware, Adware, Viruses and HijackThis Logs » [Active] windbg.exe

Recommended Fix

Click here to fix Windows Errors and Optimize Windows Performance

Need Computer Help?
Register Now for FREE

[Active] windbg.exe

Reply
Thread Tools
Spyware, Adware, Viruses and HijackThis Logs
  #1 (permalink)  
Old 18-10-2009, 10:46 PM
townsbg's Avatar
Dedicated Member
Loyal Contributor
  
Join Date: Apr 2005
Posts: 1,612
townsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big deal
Question [Active] windbg.exe
So today a Super Anti-Spyware says that I have a worm & the file is windbg.exe. It has the following path C:\Program Files\Debugging Tools for Windows (x86). System lookup says that it is a worm while bleepingcomputer says that it is a part of the dubugging tools for windows which I installed for reading a dmp file. I got it from microsoft's website. My question is, which is it? Do I need to uninstall the program to remove it or let it be? For now I let super anti-spyware quarantine it. I don't think that it is set to run automatically. SA found nothing else except cookies & Avira didn't find anything. HJThis in case you need it.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:42:44 PM, on 10/18/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\RunOnce: [*WerKernelReporting] %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq
O4 - HKUS\S-1-5-21-1917923516-3562878391-1490279686-1000\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'Ben')
O4 - HKUS\S-1-5-21-1917923516-3562878391-1490279686-1000\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe" (User 'Ben')
O4 - HKUS\S-1-5-21-1917923516-3562878391-1490279686-1000\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (User 'Ben')
O4 - HKUS\S-1-5-21-1917923516-3562878391-1490279686-1000\..\Run: [AdobeBridge] (User 'Ben')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanage...ex-2.2.4.2.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://supportspace.webex.com/clien...t/ieatgpc1.cab
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: SupportSpace platform helper service (SupportSpaceHelperService) - SupportSpace, Inc. - C:\Program Files\SupportSpace\Support Platform\supportspace_tools.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe

--
End of file - 7312 bytes
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #2 (permalink)  
Old 20-10-2009, 03:15 AM
broni's Avatar
Senior Member
  
Join Date: Nov 2004
Posts: 2,269
broni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniture
re: [Active] windbg.exe
Upload the file to VirusTotal - Free Online Virus and Malware Scan for security check.
__________________
My Home Page
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #3 (permalink)  
Old 20-10-2009, 03:45 AM
townsbg's Avatar
Dedicated Member
Loyal Contributor
  
Join Date: Apr 2005
Posts: 1,612
townsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big deal
Re: [Active] windbg.exe
well i told SA to restore it from the quarantine but it didn't and now it isn't in the quarantine.
Last edited by townsbg; 20-10-2009 at 04:01 AM.
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #4 (permalink)  
Old 20-10-2009, 04:05 AM
townsbg's Avatar
Dedicated Member
Loyal Contributor
  
Join Date: Apr 2005
Posts: 1,612
townsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big deal
Re: [Active] windbg.exe
Well unless SA put it somewhere else, I suppose that the file is gone. It isn't in the quarantine folder. I used the installer to repair it the installation & scanned the replacement (Results). I also scanned the installer and nothing.
Last edited by townsbg; 20-10-2009 at 04:27 AM.
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #5 (permalink)  
Old 20-10-2009, 04:31 AM
broni's Avatar
Senior Member
  
Join Date: Nov 2004
Posts: 2,269
broni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniture
Re: [Active] windbg.exe
File attached.
It'd be good idea to post in SAS forum and let them know.
Attached Files
File Type: zip windbg.zip (202.9 KB, 1 views)
__________________
My Home Page
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #6 (permalink)  
Old 20-10-2009, 05:00 PM
townsbg's Avatar
Dedicated Member
Loyal Contributor
  
Join Date: Apr 2005
Posts: 1,612
townsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big dealtownsbg is quite a big deal
Re: [Active] windbg.exe
That there is a false positive? So do I have a problem? Where is that forum?

I already have the file. A repair initialized from the installer restored it.
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #7 (permalink)  
Old 20-10-2009, 11:43 PM
broni's Avatar
Senior Member
  
Join Date: Nov 2004
Posts: 2,269
broni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniturebroni is beginning to become part of the furniture
Re: [Active] windbg.exe
SUPERAntiSpyware.com • Index page
Start new topic in False Positives
Let them know, what happened.
No, you don't have a problem, SAS has a problem with false positive and it's always a good idea to let them know.
__________________
My Home Page
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
Reply

« Previous Thread | Next Thread »

Thread Tools

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
[Active] help plz ron30189 Spyware, Adware, Viruses and HijackThis Logs 58 30-09-2009 12:14 AM
[Active] help!! tracie Spyware, Adware, Viruses and HijackThis Logs 1 29-08-2009 09:17 PM
[Active] Problem domederick Spyware, Adware, Viruses and HijackThis Logs 9 23-08-2009 12:55 AM
Active X... norman Windows XP Help 1 07-05-2009 02:00 AM
active x shardan Windows XP Help 1 29-09-2006 12:41 AM


All times are GMT +1. The time now is 01:26 AM.
Member Login
Remember me ?
Forgot password?
Ads

Want to Advertise? Click Here
Help Categories
Desktop / Server Apps
Drivers
Firewalls and Networks
Games
General Internet Issues
Hardware
Linux
MAC OS
Modding / Overclocking
Search Engines
Spyware and Security
Web Development
Windows 2000
Windows 7
Windows 98
Windows ME
Windows Vista
Windows XP

Computer Repair Companies
Bottom Corner Bottom Nav