Autodesk max9 slow to save/load data files

mij · March 22, 2010

I started this in the Vista forum and was redirected here having reported a backdoor virus/trojan that supermalwarebites found and dealt with.

Need I do anything else? I have (via the phone and son) installed and ran spybot S&D, supermalwarebites and hijackthis. Also belarc advisor to compare the contents of the two computers that run this proggy.

A cheapy Acer runs this program and saves/loads these files to his server in 30 seconds.

The slightly better spec machine (I'll call it Onslow)takes 7 or 8 minutes to perform the same function.

I have an older machine of his here and that takes 80 seconds to load/save a 170MB file from his server (he is about 15 miles from me by road).

Is there a next step? Having run the above I thought it was dealt with?

Cheers

jim

Match · March 22, 2010

I think the problem here is that we could play for months and still not resolve the problem !!!

My best suggested course of action would be to Back up, and do a clean install of the OS, from a full format of the HDD, then re install the program and hope that things are better.

Problem being this could be a registry problem, a Bad sector on the HDD, or a failing HDD, but doubt the last as I think I read somewhere before it's just this one application that is having problems.

mij · March 22, 2010

I think the problem here is that we could play for months and still not resolve the problem !!!

My best suggested course of action would be to Back up, and do a clean install of the OS, from a full format of the HDD, then re install the program and hope that things are better.

Problem being this could be a registry problem, a Bad sector on the HDD, or a failing HDD, but doubt the last as I think I read somewhere before it's just this one application that is having problems.

A re-installation would be the natural thing to do but he says he has already done this so many times before that his licence wont allow another. I am of the opinion that his program on this machine has somehow got corrupted - of course I know nutting......

cheers

jim

mij · March 23, 2010

I have just spoken with him about this and got the info on remote access to his 'pooter.

He says that because of his problems he has come to the end of his licensed allowances and it would cost him another £600.00 to re-install the whole thing again. He is obviously loathe to do this. Perhaps we can disinfect it in some other way.

cheers

jim

RandyL · March 23, 2010

mij I can't understand this. A brand new Windows disk costs less.

In addition is he aware that you can only install one copy on one computer without paying more?

mij · March 23, 2010

mij I can't understand this. A brand new Windows disk costs less.

In addition is he aware that you can only install one copy on one computer without paying more?

It's not just windows is it. It's autocad that is the limiting factor. That is needed/part of Autodesk max 2009 or whatever it is. It's his graphics design package that is limited licence.

cheers

jim

Match · March 23, 2010

I think he is a little mixed up on the terms of the licence and may find this page interesting ;)

Autodesk - Licensing, Registration & Activation - Autodesk Product Activation FAQ

especially 7 and 8

mij · March 24, 2010

I think he is a little mixed up on the terms of the licence and may find this page interesting ;)

Autodesk - Licensing, Registration & Activation - Autodesk Product Activation FAQ

especially 7 and 8

I'll raise this tomorrow errrr. later on I mean....

cheers

jim

RandyL · March 24, 2010

Oh sorry. I thought you meant Windows not Autodesk. Now I understand.

Starbuck · March 24, 2010

Hi Jim

If you want me to take a look.... a few things for you to do:

Step 1

Download TFC by OldTimer to your desktop

Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
It will close all programs when run, so make sure you have saved all your work before you begin.
Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion.
Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

Step 2

Please download Malwarebytes Anti-Malware and save it to your desktop.

Make sure you are connected to the Internet.
Double-click on Download_mbam-setup.exe to install the application.
When the installation begins, follow the prompts and do not make any changes to default settings.
When installation has finished, make sure you leave both of these checked:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
[*]Then click Finish.
[*]MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
[*]On the Scanner tab:
- Make sure the "Perform Full Scan" option is selected.
- Then click on the Scan button.
[*]If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
[*]The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
[*]When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
[*]Click OK to close the message box and continue with the removal process.
[*]Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
[*]Make sure that everything is checked, and click Remove Selected.
[*]When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
[*]The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
[*]Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Step 3

Download OTL to your desktop.
if you have problems, try this download link:
OTL
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check

.

http://img.photobucket.com/albums/v708/starbuck50/new/newOtl2.png

netsvcs
msconfig
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
CREATERESTOREPOINT

right click in the Custom Scans/Fixes window (under the blue bar) and choose Paste.

http://img.photobucket.com/albums/v708/starbuck50/new%20forum/scan-fix.png
.
Click the Run Scan button.

http://img.photobucket.com/albums/v708/starbuck50/runscan.png
Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them with your next reply.

In your next reply, please submit:

MBAM scan report

Both reports from OTL

Thanks.

mij · March 24, 2010

Ok will do as I now have the pc here, but I am occupied until tomorrow afternoon.

I'll get back asap.

Cheers

jim

Starbuck · March 25, 2010

No problem Jim

Just post the reports when you have them.

Now you have the pc there, it'll make life a lot easier.

mij · March 26, 2010

No problem Jim
Just post the reports when you have them.
Now you have the pc there, it'll make life a lot easier.

Hmmmm, I now realize I should have brought his cable from computer to router with me. A new one is in the post and will be with me Monday.

Ok I hope I can do this then.

cheers

jim

Starbuck · March 26, 2010

Hi Jim,

if this is malware related, the malware will still be there on Monday...... so will i.

Just post when you are ready, then the good guys will take on the bad guys. :)

mij · March 29, 2010

Hi Jim,

if this is malware related, the malware will still be there on Monday...... so will i.
Just post when you are ready, then the good guys will take on the bad guys. :)

Ok, I have carried out the directions and all went OK - I think.

Here are the reports, there is rather a lot to them.

Hmmm Unfortunately that report is too long for a single reply. I will split it into three, hopefully I can find the join in the document. The first is the malware bytes report

Malwarebytes' Anti-Malware 1.44

Database version: 3929

Windows 6.0.6002 Service Pack 2

Internet Explorer 7.0.6002.18005

29/03/2010 22:10:44

mbam-log-2010-03-29 (22-10-44).txt

Scan type: Full Scan (C:\|)

Objects scanned: 334047

Time elapsed: 38 minute(s), 24 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

OTL Txt

OTL logfile created on: 29/03/2010 22:23:02 - Run 1

OTL by OldTimer - Version 3.1.37.3 Folder = C:\Users\novatech 01\Desktop

64bit-Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6002.18005)

Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 40.00% Memory free

8.00 Gb Paging File | 6.00 Gb Available in Paging File | 71.00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 464.76 Gb Total Space | 332.93 Gb Free Space | 71.63% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: NOVATECH01

Current User Name: novatech 01

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Include 64bit Scans

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Windows\SysWow64\hasplms.exe File not found

PRC - C:\Users\novatech 01\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe (Autodesk)

PRC - C:\Program Files (x86)\IPEVO\Control Center\IPEVO Control Center.exe (IPEVO)

PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)

PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)

PRC - C:\Program Files (x86)\Remote Access Host\RemoteAH.exe (Pro-SoftNet Corp.)

PRC - C:\Program Files (x86)\Remote Access Host\RemoteAHC.exe (Pro Softnet Corp)

PRC - C:\Program Files (x86)\Internet Explorer\ieuser.exe (Microsoft Corporation)

PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)

PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)

PRC - C:\Program Files\ASUS\EPU\EPU.exe ()

PRC - C:\Program Files\ASUS\TurboV\TurboV.exe ()

PRC - C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe ()

PRC - C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_64server.exe ()

PRC - C:\Program Files (x86)\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe ()

PRC - C:\Program Files (x86)\Remote Access Host\RemoteAM.exe ()

PRC - C:\Program Files (x86)\Remote Access Host\RemotePCM.exe ()

mij · March 29, 2010