Trojan Virus & Quickbooks Software Won't Open

Question

teatear 0 Newbie Poster

16 Years Ago

Thank you all for being here to help me with this problem I'm having. I've used computers for years but this is over my head. I saw a post here when you guys helped a lady a few years back having a similiar problem with her software. I hope you have the same good results with mine.

About a week ago, my Quickbooks Software wouldn't open. It shows up in the task tray but won't open. It shows in Task Manager that it's running. I get an error message QBW caused a General Protection Fault in module QBWIN.DLL at 002A:0168. It gives an error message to end program WOWEXEC when shutting down the computer. When I tried to re install Quickbooks, it said that the program already running and waiting on a response from me. I had tried to reinstall the program disks after I tried a couple of things below.

I have Windows XP Home Edition. My AGV anti virus program detected Trojan Horse Dropper.Agent.JOC, Adware Generic. NTR, Trojanhorse Generic11.PWW and VirusFound JS/Psyme. I deleted the items through AGV and I had to delete them in groups because they were large. In the recycle bin they showed up as 46ab9 Windows Install Package 22,864KB and as A0009164 Windows Installer Package 22,864KB. I have a list of the individual items that was deleted through AVG if it's needed at this point.

I have ran scans with a-squared Free and Ad-Aware that were installed on my computer by my computer repair store. I deleted cookies that were low or medium risk. This computer had a new hard drive installed in August 2008 after the power supply and the C hard drive went bad.

I used some instructions that I found from the Quickbooks website that suggested to download Microsoft .NET Framework Version 2.0 Redistributable Package (x86) and where someone solved their problem but it didn't work for me. I've also updated the Windows Updates along the way.

I followed the PP instructions here for this forum.

Following is the MalwareBytes' Anti-Malware log:

Malwarebytes' Anti-Malware 1.28
Database version: 1142
Windows 5.1.2600 Service Pack 3

9/12/2008 12:00:56 PM
mbam-log-2008-09-12 (12-00-44).txt

Scan type: Full Scan (C:\|)
Objects scanned: 92776
Time elapsed: 42 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\cpbrkpie.coupon6ctrl.1 (Adware.Coupons) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{9522b3fb-7a2b-4646-8af6-36e7f593073c} (Adware.Coupons) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a85a5e6a-de2c-4f4e-99dc-f469df5a0eec} (Adware.Coupons) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{87255c51-cd7d-4506-b9ad-97606daf53f3} (Adware.Coupons) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{6e780f0b-bcd6-40cb-b2db-7af47ab4d4a4} (Adware.Coupons) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{a138be8b-f051-4802-9a3f-a750a6d862d4} (Adware.Coupons) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\CouponPrinter.ocx (Adware.Coupons) -> No action taken.

There was no log from ESET as it found no problems.

I wasn't able to use the Deckard's System so no log from them.

Following is the Uninstall List from Hi Jack This:

Acrobat.com
Acrobat.com
Ad-Aware
Adobe AIR
Adobe AIR
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Reader 9
AOL Toolbar 5.0
a-squared Free 3.5
AVG Free 8.0
Brother MFL-Pro Suite
Coupon Printer for Windows
ESET Online Scanner
Google Earth
Google Toolbar for Internet Explorer
Google Updater
High Definition Audio Driver Package - KB888111
HijackThis 1.99.1
Hotfix for Windows XP (KB952287)
Java(TM) 6 Update 7
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Visual C++ 2005 Redistributable
MySurvey Messenger
Nero OEM
OLYMPUS CAMEDIA Master 4.1
PaperPort
PowerDVD
QuickTime
Realtek AC'97 Audio
Realtek High Definition Audio Driver
Security Update for Microsoft .NET Framework 2.0 (KB928365)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Windows XP Service Pack 3
WordPerfect Office 11

Nothing was found through the Microsoft WIN Malicious Software Removal Tool.

Again thank you for the help. I'm in a bind here, I am suppose to mail my taxes for our small business by the extension deadline on Monday the 15th but can't without my bookkeeping program and data. I surely appreciate anything you can do to help me.

Thanks,

Terri

windows-virus

6 Contributors
35 Replies
684 Views
12 Years Discussion Span
Latest Post 3 Years Ago Latest Post by haibatullahsafi

jholland1964 650 Posting Expert

16 Years Ago

Did you delete these all the way out or are they still in the Recycle Bin?
I am a bit concerned because when checking on the few you noted these could have been false postitives, meaning they were not a trojan or virus at all. This is why it is recommended that you keep items removed in Quarantine for awhile to be certain they actually were not false positives and files key to running of specific programs. If a file is moved to Quarantine then it is not active anymore but available for restoration in case it really was a valuable file.

You may need to fully uninstall the Quicken program and reinstall it. If you have stored files I would back them up to an outside source to be sure you don't lose the information contained in them...a CDR or Flash drive would be good if possible.

To assure a clean install of Quicken you should be certain that you totally uninstall it and all remaining files of the corrupt version. This way when you reinstall you will have totally, fresh and clean program files there.

Quicken has a removal tool for this which can be found here, with instructions for it's use.

https://quicken.custhelp.com/cgi-bin/quicken.cfg/php/enduser/std_adp.php?p_faqid=4108

Judy

jholland1964 650 Posting Expert

16 Years Ago

Sorry, didn't read it correctly, thought it was Quicken. You know that Quickbook program is way out of date, may be the reason it was so hard to reinstall. That may be your only option though.
Hopefully somebody smarter than I will come along and read this and offer a solution. Sorry I couldn't be of more help.
Judy

jholland1964 650 Posting Expert

16 Years Ago

Am looking at your HJT now but one thing you do need to do is run Malwarebytes' Anti-Malware again and this time have it fix everything found.
Then run a new HJT log and post that one along with the new Malwarebytes' log
Judy

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

teatear 0 Newbie Poster · Answer 1 · 2008-09-13T02:09:54+00:00

Well, mine is Quickbooks for Windows Version 3.0 which was bought in the 90's. Quicken is a different product.

I don't know if I should unistalling it and re installing Quickbooks on my own because the computer repair store had a difficult time getting the data back up correctly when they installed the hard drive. It worked fine for over a month and the tech has some files on the computer called old PC quickbooks. So I don't know if I should try this.

The deleted files from AVG are no longer in the recycle bin.

Thanks Judy for your help.......

Is there any thing else I could try?

teatear 0 Newbie Poster · Answer 2 · 2008-09-13T02:47:01+00:00

Would you please take a look at my hi jack log and see if everything looks normal? A couple of other things I forgot about at first, my acrobat reader doesn't come up when I need it. This and the QBooks problem happened right after I installed Internet Explorer 7. I didn't like it, so I uninstalled and went back to Internet explorer 6. So, when the Quickbooks wouldn't open, I tried updating again to the Internet Explorer 7 but it still didn't work and that was before I deleted the AVG Quaratined Files. If this hi jack log looks ok, I will either get the courage to unistall QB or take it back to the repair store. Could it be that I'm now missing some Explorer type files?

I have installed my QBooks program on my husband's computer and the data is on there so I'm ok there plus the computer store probably still has my data too. I just can't work on his computer like I need to to get my taxes done.

The Hi Jack Log:

C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\MySurvey Messenger\MySurveyMessenger.exe
C:\Program Files\a-squared Free\a2service.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\S1QFGDEN\HijackThis[1].exe

R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AOL Toolbar BHO - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - Startup: MySurvey Messenger.lnk = C:\Program Files\MySurvey Messenger\MySurveyMessenger.exe
O8 - Extra context menu item: &AOL Toolbar Search - C:\Documents and Settings\All Users\Application Data\AOL\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 3 · 2008-09-13T03:52:03+00:00

You know in reading through all of this again, couple things I missed...you say these removed items ended up in your Recycle Bin...Why? Normally if my antivirus program removes something it is sent to the Quarantine OR just plain deleted, not to the Recycle Bin but deleted.
The other thing you say, these were supposedly viruses or trojans but what showed in the Recycle Bin were two Windows Installer Packages and the file sizes were just about right for the Windows Installer 3.1
I am wondering, were these uninstalled by mistake?
Look in Add/Remove and see if it is listed there, should be there but I also don't see it on your Uninstall list either.
You do need this to install many programs, maybe that is why you can't get the Quickbooks to install
Go HERE and download and see if that helps. Meanwhile I will take a look at your log.

teatear 0 Newbie Poster · Answer 4 · 2008-09-13T04:02:40+00:00

Thanks Judy

The 8 items that Malwarebytes' found before is in the quarantine section there. Should they be deleted from there? Also, I did a computer restart before I ran the hi jack log.

I found a txt log at the site too, I opened it and I'm pasting it here. It shows that they were deleted....??

Malwarebytes' Anti-Malware 1.28
Database version: 1142
Windows 5.1.2600 Service Pack 3

9/12/2008 12:03:57 PM
mbam-log-2008-09-12 (12-03-57).txt

Scan type: Full Scan (C:\|)
Objects scanned: 92776
Time elapsed: 42 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\cpbrkpie.coupon6ctrl.1 (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9522b3fb-7a2b-4646-8af6-36e7f593073c} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a85a5e6a-de2c-4f4e-99dc-f469df5a0eec} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{87255c51-cd7d-4506-b9ad-97606daf53f3} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6e780f0b-bcd6-40cb-b2db-7af47ab4d4a4} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{a138be8b-f051-4802-9a3f-a750a6d862d4} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\CouponPrinter.ocx (Adware.Coupons) -> Quarantined and deleted successfully.

Do you still want me to re run the MalwareBytes? If so, will the quick scan do?

Terri

teatear 0 Newbie Poster · Answer 5 · 2008-09-13T04:21:49+00:00

About the Windows Installer 3.1, I have Windows XP Service Pack 3 (would it be there?) but I don't see Windows Insaller 3.1 in the Add or Remove Programs area. Should I download still?

What happened with the recycle bin is; I found out that AVG had quarantined all of the Trojan horse files and the other ones too. So I was going to delete them one by one but it gave me a note that said it was too large and then the computer took me to an area of the start menu where all of the folders of the computer are listed and automatically showed me the packs of files to delete. When I did, they then went to the recycle bin. I emptied the recycle bin thinking that these scans would pick up info from all files. So my bad there.

I have all of the files listed that were deleted though. I did a print screen and posted them in a Word File and printed them also if you want me to type them out for you to see or if there is a way to attach a word file to you, I could do that.

Terri

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 6 · 2008-09-13T05:04:27+00:00

About the Windows Installer 3.1, I have Windows XP Service Pack 3 (would it be there?) but I don't see Windows Insaller 3.1 in the Add or Remove Programs area. Should I download still?

I would say yes, install it.

I have all of the files listed that were deleted though. I did a print screen and posted them in a Word File and printed them also if you want me to type them out for you to see or if there is a way to attach a word file to you, I could do that.

You should be able to attach a Word file here.

teatear 0 Newbie Poster · Answer 7 · 2008-09-13T05:56:51+00:00

Judy, There is an option of which download to choose. I did read about it but it's confusing to me. B] Please tell me which one or is it all of them.[/B].

My system a
processer is a .x86 Family 15 Model 2 stepping 9 GenuineIntel 2600 Mhz
& System Type is x86 based PC

From Here:

Go HERE and download and see if that helps. Meanwhile I will take a look at your log.

The instructions say:

The links in this section correspond to separate files available in this download.

Download the files most appropriate for you..??

File Name:
File Size
Redist.txt
2 KB
Download

windows installer 3.1 EULA.doc
58 KB
Download

WindowsInstaller-KB893803-v2-x86.exe
2.5 MB
Download

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 8 · 2008-09-13T06:17:01+00:00

File Name:
File Size
Redist.txt This is the Redistributables text saying how in can be redistributed.

windows installer 3.1 EULA.doc This is the End User License Agreement

WindowsInstaller-KB893803-v2-x86.exe This is the actual Windows Installer.

teatear 0 Newbie Poster · Answer 9 · 2008-09-13T07:12:28+00:00

Ok, I tried but got a setup Error saying:

Setup has detected that the Service Pack version of this system is newer than the update that you are applying. There is no need to install this update and an ok button.

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 10 · 2008-09-13T07:18:39+00:00

jholland1964 650 Posting Expert

16 Years Ago

Then download this one.

teatear 0 Newbie Poster · Answer 11 · 2008-09-13T07:26:40+00:00

Judy, This is an error log from my Advanced System Information under the Help Topics. I was in there looking around and found it. Can you tell anything from it maybe?

Refresh screen

Error Log
Date - Time Source Description
Thursday, August 28, 2008 W32Time Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

Thursday, August 28, 2008 W32Time The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time.

Friday, September 05, 2008 Service Control Manager The Application Management service terminated with the following error: The specified module could not be found.

Sunday, September 07, 2008 SideBySide Generate Activation Context failed for C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll. Refe rence error message: The
operation completed successfully. .

Sunday, September 07, 2008 DCOM The server {98D9A6F1-4696-4B5E-A2E8-36B3F 9C1E12C} did not register with DCOM within the required timeout.

Sunday, September 07, 2008 SideBySide Generate Activation Context failed for
C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll. Refe rence error message: The
operation completed successfully. .

Sunday, September 07, 2008 DCOM The server {98D9A6F1-4696-4B5E-A2E8-36B3F 9C1E12C} did not register with DCOM within the required timeout.

Sunday, September 07, 2008 SideBySide Generate Activation Context failed for C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll. Refe rence error message: The operation completed successfully. .

Sunday, September 07, 2008 DCOM The server {98D9A6F1-4696-4B5E-A2E8-36B3F 9C1E12C} did not register with DCOM within the required timeout.

Monday, September 08, 2008 SideBySide Generate Activation Context failed for C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll. Refe rence error message: The operation completed successfully. .

Friday, August 08, 2008 Applicatio n Hang Hanging application IEXPLORE.EXE, version 6.0.2900.2180, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Friday, August 08, 2008 Applicatio n Hang Fault bucket 126637809.
Wednesday, August 13, 2008 Applicatio n Hang Hanging application IEXPLORE.EXE, version
6.0.2900.2180, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Wednesday, August 13, 2008 Applicatio n Hang Fault bucket 126637809.

Thursday, August 14, 2008 Applicatio n Hang Hanging application IEXPLORE.EXE, version 6.0.2900.2180, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Thursday, August 14, 2008 Applicatio n Hang Fault bucket 126637809.

Thursday, August 14, 2008 Applicatio n Hang Hanging application IEXPLORE.EXE, version 6.0.2900.2180, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Thursday, August 14, 2008 Applicatio n Hang Fault bucket 126637809.

Thursday, August 14, 2008 Applicatio n Hang Hanging application IEXPLORE.EXE, version 6.0.2900.2180, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Thursday, August 14, 2008 Applicatio n Hang Fault bucket 126637809.

Saturday, August 16, 2008 Applicatio n Error Faulting application iexplore.exe, version 6.0.2900.2180, faulting module unknown, version 0.0.0.0, fault address 0x044b9934.

Sunday, August 17, 2008 Microsoft Office 11 Faulting application msaccess.exe, version 11.0.5614.0, stamp 3f3c8e3c, faulting module msaccess.exe, version 11.0.5614.0, stamp 3f3c8e3c, debug? 0, fault address 0x001af85f.

Sunday, August 17, 2008 Applicatio n Hang Hanging application IEXPLORE.EXE, version 6.0.2900.2180, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Sunday, August 17, 2008 Applicatio n Hang Fault bucket 126637809.

Wednesday, August 20, 2008 Applicatio n Hang Hanging application IEXPLORE.EXE, version 6.0.2900.2180, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Wednesday, August 20, 2008 Applicatio n Hang Fault bucket 126637809.

Thursday, August 21, 2008 Applicatio n Hang Hanging application IEXPLORE.EXE, version 6.0.2900.2180, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Thursday, August 21, 2008 Applicatio n Hang Fault bucket 126637809.

Monday, August 25, 2008 Applicatio n Error Faulting application iexplore.exe, version 6.0.2900.2180, faulting module mshtml.dll, version 6.0.2900.3395, fault address 0x00095e4d.

Monday, August 25, 2008 Applicatio n Error Fault bucket 882448357.

Wednesday, August 27, 2008 Applicatio n Hang Hanging application IEXPLORE.EXE, version 6.0.2900.2180, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Wednesday, August 27, 2008 Applicatio n Hang Fault bucket 126637809.

Tuesday, September 09, 2008 Applicatio n Hang Hanging application iexplore.exe, version 6.0.2900.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Tuesday, September 09, 2008 Applicatio n Hang Fault bucket 724398357.

Thursday, September 11, 2008 Applicatio n Hang Hanging application iexplore.exe, version 6.0.2900.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Thursday, September 11, 2008 Applicatio n Error Faulting application cdrconv.exe, version 11.833.0.0, faulting module cdrrip110.dll, version 11.245.0.0, fault address 0x0012fdfe.

Thursday, September 11, 2008 Applicatio n Error Fault bucket 52498524.

teatear 0 Newbie Poster · Answer 12 · 2008-09-13T07:36:56+00:00

ok, I downloaded the 4.5 and it restarted the computer. I tried to open the QBooks program but it's sitting in the tray and won't open.

teatear 0 Newbie Poster · Answer 13 · 2008-09-13T07:50:13+00:00

teatear 0 Newbie Poster

16 Years Ago

I scanned the 4 pages showing the files that I deleted through AVG on 9/5/08 and have uploaded it as an attachment. Hope it comes through...

Terri

This attachment is potentially unsafe to open. It may be an executable that is capable of making changes to your file system, or it may require specific software to open. Use caution and only open this attachment if you are comfortable working with msword files.

~~Files_Deleted_AVG.doc (408 KB)

teatear 0 Newbie Poster · Answer 14 · 2008-09-13T08:16:41+00:00

I just tried to open my Adobe Reader 9 and got the error:
Fatal Error Message
Acrobat failed to load it Core DLL

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 15 · 2008-09-13T08:44:49+00:00

The error you mentioned is a file corruption of the core.dll file of the acrobat reader. so its is best to uninstall your old copy first then install a new one.

http://www.adobe.com/products/

Will do some checking on those errors but to research each one will take me awhile.
Judy

teatear 0 Newbie Poster · Answer 16 · 2008-09-13T09:27:53+00:00

As Adobe was trying to remove itself it showed a warning error of 1905.Module
C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx failed to unregister. HRESULT -2147220472 Contact your support personnel. And gives an ok button. I'll hit ok

I did and it no longer shows on the ADd and remove programs.

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 17 · 2008-09-13T10:24:03+00:00

I have to be perfectly honest here teatear, I really think some very key files were removed or damaged, either by the Trojans OR by the removal of these files.
Looking at all you removed, a large number of these were in your System Restore, another group were Internet Temp files and then the others seem to be related to the Windows Installer files. To have this much damage in so many programs, I don't know for sure they can be repaired.
Can I ask, when did you install XP SP3? Where did you get it? Did you download it from the Microsoft site or someplace else?

All of the event errors showing this;

Friday, September 05, 2008 Service Control Manager The Application Management service terminated with the following error: The specified module could not be found.

have to be related to the removal of the files when you got deleted the items from the computer after the discovery of the Trojans.

Many of the other errors are related to the Hanging of Internet Explorer and all seemed to happen prior to Sept. 5 when you removed the files. The other errors with Adobe Reader and others seem all to have occurred AFTER Sept. 5th.

It just really looks to me like many files were damaged or corrupted by either the removal of the Trojans, the Trojans themselves OR some incorrect files were removed.

The other thing I really wonder about is this;

I don't know if I should unistalling it and re installing Quickbooks on my own because the computer repair store had a difficult time getting the data back up correctly when they installed the hard drive. It worked fine for over a month and the tech has some files on the computer called old PC quickbooks. So I don't know if I should try this

The version of Quickbooks you have been using is way out of date, it is very possible it isn't equipped to run on XP SP3 and maybe that is why he had such a problem installing it. You say he has some files called old PC quickbooks, what are these do you know? Open them and find out.

Frankly, after searching this Trojan finding by AVG there were many posts stating that this was a false positive, meaning of course this was not a trojan. It doesn't help you I know since you have removed these files. I really am very hesitant to have you try anything else. I just feel some core files have been damaged here, which would indicate a repair needs to be done. But I also don't want you to lose your valuable Quickbook files either.
I rarely do this, but think at this time maybe your best option would be to contact the tech that did the install of the new hard drive last month and see what he thinks should be done.
Judy

teatear 0 Newbie Poster · Answer 18 · 2008-09-13T11:09:40+00:00

I got the XP3 from the windows update, a link from my computer under tools. I went ahead with it because the OBooks website instructions said that it was important to do. . The Qbooks worked for over a month fine until I upgraded to Internet Explorer 7 and then removed it. It extracted alot of files too during the upgrade. I've also used Qbooks on this computer for over 5 years but maybe it doesn't like the Service Pack 3.

I know from reading other forums that others are having the same problems with Qbooks (the new versions) not opening after installing and updating other programs and some are getting a solution. One got it by installing the .Net Microsoft program that I tried to do. The one years ago here at Dani Web had to cut off restore somehow because the registry was wrong. I am still trying to find that thread, I know I saved it. I wonder about that because all of that malware was to do with registry and the adobe file wouldn't unregister during the uninstall.

Yes, I can take it back to the store. I was just hoping that I would see if we could figure it out before Monday so i could get the taxes done on time. I agree that the files that QBooks needs to run probably got deleted but the problem of not opening happened before I deleted the files. They could have been quaratined though.

The old PC QBook files look the same as the newly installed program, I got the tutorial screen to open up but I couldn't get the companies to open. I have 3 companies and there is one sample data file. And the Adobe program is working now since I re installed it.

Anyway, if you aren't comfortable with going further, that's fine. I appreciate your caution and I want to thank you for your time and effort in helping me with it all.

It's 1 am here so I'm going to sign off now. I will check back tomorrow just in case you have a brainstorm idea; but if not, I'll take it on to the tech at the repair store.

Thanks Again Judy!!.....Terri

This is the history of my Windows update as it shows on the website for this computer:

Windows XP Windows Malicious Software Removal Tool - September 2008 (KB890830) Wednesday, September 10, 2008 Automatic Updates

Windows XP Security Update for Windows XP (KB938464) Wednesday, September 10, 2008 Automatic Updates

Windows XP Security Update for Microsoft .NET Framework, Version 2.0 (KB928365) Monday, September 08, 2008 Automatic Updates

Windows XP Update for Windows XP (KB951978) Saturday, September 06, 2008 Automatic Updates

Windows XP Windows XP Service Pack 3 (KB936929) Friday, September 05, 2008 Windows Update

Windows XP Windows Genuine Advantage Validation Tool (KB892130) Friday, September 05, 2008 Windows Update

Windows Internet Explorer 7 Dynamic Installer Cumulative Security Update for Internet Explorer 7 Dynamic Installer for Windows XP (KB953838) Thursday, September 04, 2008 Other Source

Windows XP Windows Internet Explorer 7 for Windows XP Tuesday, September 02, 2008 Automatic Updates

Windows Windows Update Agent 7.2.6001.784 Wednesday, August 27, 2008 Automatic Updates

<<Previous 1-10 11-20 21-30 Next >>

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 19 · 2008-09-13T19:58:43+00:00

Hi Terri,
Well, your list of updates DOES give me somewhat of a clue, or even a couple and since you listed all this I figure you must have the same feelings that I am having. I could be wrong, BUT I think all of this goes to the Install of XP SP3. Look at the date, September 5. The very same day your AVG flagged these files as trojans. Now I firmly believe these were very likely false positives. I have found on countless websites AVG and only AVG flagging these supposed trojans. I just don't think they were or are. I think AVG sees these suddenly new files and something in these makes it think that they are bad files.

I would really advise you to uninstall the XP SP3 and go back to XP SP2.
The instructions on how to do this can be found here;

http://support.microsoft.com/kb/950249

I would also guess that you should also uninstall all the automatic updates installed AFTER Sept. 5 also. Just go backwards on the list, beginning with the most recent and ending then with that SP3 install.

Be sure to reboot if told to do so each time AND be sure to reboot after the whole process is complete.

Now once you have done this of course your Auto Update will probably notifiy you of updates available. Don't do them yet though. Wait and see if you can get your Quickbook program to work. Obviously something in either IE7 or, I think, SP3 has damaged or blocked that in some way.
Let me know.
Judy

teatear 0 Newbie Poster · Answer 20 · 2008-09-13T20:34:46+00:00

Well, I know that the Qbooks not opening came before Thurs Sept 4 because I called the tech that day and had wanted to call him the day before about the problem. I also wrote it in an email to a friend so I know my memory is right. I remember telling him that I had tried to update to IE7 and then uninstalled it. He said that he had had others who had problems with IE7.

I then told him that I would see what I could find but might still bring it too him later. That was some of the reason so much happened on Sept 5, I saw those viruses and tried to get rid of them.

I think you have a good idea to unistall all of it though. I know that when I looked at IE7 info on the computer, it states that some third party software may not work correctly. Wish I had read that before I updated it. I also think AVG and other anti virus should warn us novices about deleting files too soon. Maybe they do, I didn't see it though.

Thanks Judy, I will try your suggestions...........

Another thought, does the computer have the ability to restore back to a date prior to say Sep 1st before I updated to IE7?

teatear 0 Newbie Poster · Answer 21 · 2008-09-13T21:51:27+00:00

I just change my security setting to allow pop ups to see if it would let the Qbooks windows come up.

As you can see by the attachment, the program is open in task manager and is in the tray. Something is stopping it from opening the windows. This is the same problem prior to Sept 5th.

The tutorial window and the help window comes up at the start menu explore section and I was able to open a Qbooks text document there. I was able to open things in the help menu but it's all about how to handle the bookkeeping tasks.

WOWEXEC is involved too. It's error message that it cannot end comes up with the QBW error unpon shutting down the computer.

Do you think re installing or downloading IE6 might help? Would it hurt anything?

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 22 · 2008-09-13T22:18:57+00:00

Hold off on the IE6 reinstall. I am doing some searching concerning this Wowexec.exe error and may have hit on something but want to do more reading. I will get back to you ASAP.
Judy

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 23 · 2008-09-13T23:21:55+00:00

Another thought, does the computer have the ability to restore back to a date prior to say Sep 1st before I updated to IE7

I would say, don't try this. System Restore has all ready been altered by the removal of items during that AVG removal so chances of going back farther are, at best limited. I just wouldn't risk it. You could end up with more trouble than you have now.
Now here is what I found about the WOWEXEC problem. It is related to your old version of Quickbooks. Took me awhile because I am not fluent in "computereeze" so had to find someplace that would give me the explanation in plain English.
The problem, I "think" really lies with that Quickbook program itself. It is for one of the original versions of Windows which came out prior to 1992, actually around 1985. These 1st versions of Windows ran actually "on top of" the older MS-DOS operating systems. This is probably why your tech had difficulty even installing this program on the new hard drive several months ago.
This wowexec.exe is the file which helps this probably 16 year old program run on the computers we have today. One of it's problems is when you turn off Quickbooks, wowexec.exe doesn't turn off as you found, it just sits there.
This wowexec is supposed to enable, if I read this correctly, 16-bit applications (which this Quickbook version probably is) run on 32-bit machines, which is what we have today.
The way to stop this error is Stop Quickbooks, since you can't even get it to open you will have to stop it via Task Manager. Then when it stops then stop the wowexec file.

Now in searching on the Quickbooks Troubleshooting here is what I have found for not being able to open...Key thing noted is this to begin with; ensure your QuickBooks version is the most current release Yours obviously is not, it is at least 15 years old.
Here are the steps given on the troubleshooting site;

QuickBooks does not open
A number of different issues such as a damaged report can keep the QuickBooks [company name] file from opening. The steps below show you how to open QuickBooks to the No Company Open window, and configure QuickBooks not to save the desktop.
1. Copy the [company name] file to a known good PC that has QuickBooks installed.
2. Click the Windows Start button and click Programs (or All Programs).
3. Click QuickBooks, press and hold the Ctrl key and then click the QuickBooks version (Example: QuickBooks Premier). Once you see the File menu release the Ctrl key.
4. Click the File menu and click:
* QuickBooks 2007 and later:
1. Open or Restore Company
2. Click Open a company file and click Next.
* QuickBooks 2006: Click Open Company.
5. At the bottom of the Open a Company window uncheck Open file in multi-user mode.
6. Browse to your [company name] file, and then click on it once to select it.
7. Press and hold the Alt key on your keyboard while you click Open. If you are prompted for a password, release the Alt key, enter your password, then depress the Alt key again while you click OK. Continue to press the Alt key until the [company name] file opens to a blank desktop.
* If the [company name] file opens, continue to step 8.
* If the [company name] file does not open it is damaged beyond the scope of this article. Restore a Backup or contact our Technical Support staff for repair of your file by our Data Services department.
8. Click the Edit menu and click Preferences.
9. Click Desktop View in the left pane of the Preferences window.
10. Click the My Preferences tab.
11. Click Don't save the desktop, and then click OK.

Terri, honestly think you do need to get a NEW Quickbook program. Especially since you are running a small business with it.
I believe the "trojan find" problem stemmed from the update to SP3, but I don't believe the Quickbook failure has anything to do with that. I think the update to IE7 did bring the Quickbook problems to light however, it obviously can't run on IE7.
Now you might try a repair of IE6 and see if this helps with the Quickbook. If it does then absolutely update the Quickbook to the very latest version. Probably will take you awhile to learn to navigate through the program, I know nothing about it but from what I read on their site...I am still totally clueless as to what version or program portion you should update to and how.
Judy

teatear 0 Newbie Poster · Answer 24 · 2008-09-14T01:37:58+00:00

Well, I think you are right, I've been reading alot about the WOWEXEC too and some people are finding ways to work around it but it looks like you have to really know your programming to do the fixes.

Yes, we bought the program in 1990 and it went through about 6 upgrades and so then we bought this version 3.0 around 1992. It was to get away from all of the upgrades and it was for Windows 3.1 or higher back then. I have gotten these type of error messages on every computer we bought through the years but never to the point where it wouldn't open. And I have been reading posts where folks with the new versions of QBooks are having the same problem, it shows in the tray but won't open on the desktop.

I still have the old computer from back then and it runs......lol......I even tried to update it with this version. It handles the program fine but won't back up the data from this newer computer. Anyway, I might try deleting that off and installing this fresh just to keep the company info backed up. Well, that probably won't work.......come to think of it if the data won't go on....?? Or that might be because it's had to convert the existing data to the newer program. I might give it a shot when I get time.

The program and data is on the other computer too (he runs Windows 2000) and I'm going to go get his computer and bring it to my office just to try to get the taxes done and then figure out what to do. It is coming up fine in there. I've just lost about 4 months of data but I can re construct it.

I'm not going to buy a new Qbooks because our product line was sold last year and I'm just trying to complete that and be done with it all. If it could have just lasted another month or so......:)

I don't know if I will take it back to the tech guy or just go buy an older used computer and not use it for the internet and all the updates and upgrading that goes with it......

Anyway, thanks for all of your help. Youv'e been super great in helping me and researching stuff. Have a good weekend, what's left of it. I have to say that I learned alot anyway......Terri

teatear 0 Newbie Poster · Answer 25 · 2008-09-14T01:44:23+00:00

Well, one more thing, I still think that it's IE7 that caused the problem. I mean, geez, this version of QBooks did run on this computer for 5 years.....so it's not like it wasn't compatible to start with. It must just not be compatible with IE7.

And I tried running it with the compatibility wizard, but that didn't work either. I bet IE7 just cost me a bundle in IRS penalty fees if I can't get my tax done on time now.......lol.....

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 26 · 2008-09-14T03:26:13+00:00

I have learned a lot too...enough to know I don't want to mess with Quickbooks, I have enough trouble with simple Excel sheets!:icon_confused:
Judy