computer freeze during scan for malware

First topic message reminder :

I use norton internet security 2010 and windows xp,IE 8 recently after I visit web side xinhau news my computer freeze on and off.First freeze up during scan to find out any malware and never can finish the job.This even happen in safe mode.I ask for norton tech.support help they check my computer and told to visit their virus removal service but need to charge 99.9$.Now the freeze more frequely because this I can not down load other antivirus program for rescue.Please help. wau

Hi DM,
good morning,I am runing your locksearch scan on my "sick' computer.It runs in DOS,already 40 minutes and don't know where it go.How long I
have to wait?I did not back up the registry will it be ok?Base on SITE ADVISOR they don't give green light for this program.Is it safe to use?

l

Yes safe to use.

You cannot use it on the Normal Windows screen?

Hello DM,
I just finish run the locksearch scan,but I don't know how to obtain the result and copy to sent here.My computer seems runing pretty "normal".Your program works.Thanks a lot.problems resolved.Will followup for few more days.Thanks again.

OK.

Hi DM,
I come back again,I have some problems.After scan by locksearch,the computer seems working but also show few important files are missing ,one of them is msi.dll file.When I try to open and run some clean up programs but failure due to msi.dll missing and ask me to reinstall it.Please help me how to correct this problem.

Hi DM,Seems can not found this file from my computer.It show as following;runing from:c:\documents and settings\xxxxxxx\desktop\win32kdiag(2).exe log file at:c:\documents and settings\xxxxx\desktop\win32kdiag.txt.
warning:could not get backup privilige
searching c:\windows......
fineshed.What all these mean.I am the owner of this computer.What next I can do?

Download [You must be registered and logged in to see this link.] by OldTimer to your Desktop.

• Close all windows and double click OTL.exe.
  
• Click Run Scan and let the program run uninterrupted.
  
• It will produce two logs for you, one will pop up - OTL.txt, the other will be saved on your Desktop - Extras.txt. Post both logs in this thread.
  
• You may need to use two posts to get it all.
  

Hi DM,
After scan by win32kdiag.exe and OTL.exe and clean up ,the msi.dll and framedyn.dll still missing what should I do.I don't know how to copy those log here,sorry.

Hello Jay,
Good morning(in my side),thank you very much so far for your help.Frankly to tell that I post my problems just for learn how to due with the reality;day in day out of malware invation,not care that much about my old computer.since here is forum and your are a tutor do you mind to answer my following questions;1)I read your article about this issue you never mention;combofix,locksearch,win32kdiag,Otl,are these programs are diagnostic tool or therapytic tool? are you testing as reascher?2)under what condition to pick which one and why?3)what is different from each of them?any side effect of each program and how to avoid it?Jay,I really want to learn will you teach me.thanks.

They are diagnostic programs for research of malware on your computer.

Difference between them all depends. Whether I am looking for locked programs, infected files, Windows errors, incorrect system files, etc.

Conditions depend on how much diagnostic needs to be done. It is all about instinct, and what should be done next.

There are very little side effects. Except with GMER and ComboFix. Both have a way to be too powerful, so either one could do a little to some damage if they are not run properly.

=========

Download [You must be registered and logged in to see this link.] to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• Under the Custom Scan box paste this in
  
  netsvcs
  msconfig
  safebootminimal
  safebootnetwork
  activex
  drivers32
  %SYSTEMDRIVE%\*.exe
  %systemroot%\*. /mp /s
  c:\$recycle.bin\*.* /s
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  nvstor32.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  explorer.exe
  svchost.exe
  userinit.exe
  qmgr.dll
  ws2_32.dll
  proquota.exe
  imm32.dll
  kernel32.dll
  ndis.sys
  autochk.exe
  spoolsv.exe
  xmlprov.dll
  ntmssvc.dll
  mswsock.dll
  Beep.SYS
  ntfs.sys
  termsrv.dll
  sfcfiles.dll
  st3shark.sys
  ahcix86.sys
  srsvc.dll
  nvrd32.sys
  /md5stop
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time
    
  
  

I finish the scan but don't know how to copy to here.pleaswe tell me How.

If you can see the logs, copy the information, then paste it here. Just send it in 1/3 at a time.

Still with us? If so, please do the following:

Please download DDS by sUBs from [You must be registered and logged in to see this link.] or [You must be registered and logged in to see this link.] and save it to your Desktop.

Note: Before scanning, make sure all other running programs are closed. There shouldn't be any scheduled antivirus scans running while the scan is being performed. Do not use your computer for anything else during the scan.

• Double click on the DDS icon, allow it to run.
• A small box will open, with an explanation about the tool. No input is needed, the scan is running.
• Notepad will open with the results, click Yes to the Optional_Scan
• Please follow the instructions that pop up for posting the results.
• Close the program window, and delete the program from your Desktop.