• Welcome to TechPowerUp Forums, Guest! Please check out our forum guidelines for info related to our community.

Help Please - wfspkbhw.dll

paulktreg

New Member
Joined
Aug 5, 2008
Messages
9 (0.00/day)
Likes
0
#1
Anybody help?

To cut a long story short I was looking for software on the internet for a particular project and may of hit something "dodgy". Kaspersky kicked in and I let it do its stuff but didn't really pay any attention to the particulars. It rebooted to complete its mission and I now get :

RUNDLL
Error Loading
c:\WINDOWS\system32\wfspkbhw.dll
The specified module could not be loaded

Searched t'internet for wfspkbhw.dll but no hits!?

Can anybody point me in the right direction? Can anybody recommend a good free registry cleaner?

EDIT: Before anybody jumps to the wrong conclusion, it wasn't pron, I was after graph drawing software.

Regards

Paul
 
Last edited:
Joined
Mar 15, 2008
Messages
401 (0.11/day)
Likes
12
Location
California USA
System Name MSI
Processor Intel 4790k@ stock for now
Motherboard MSI z97 gaming 7
Cooling H100i
Memory 16 gb of patriot viperx ddr3 1866
Video Card(s) GTX 970
Storage Crucial c300 128g, wd cavier black 1tb, seagate baracuda 2gb (for storage)
Display(s) 30" dell 3007
Case Haf x 942
Audio Device(s) ac 1150 onboard sound
Power Supply Roswell 1200
Software Windows pro 8.1
#2
try dll-files.com its an excellent database for dll files
 

panchoman

Sold my stars!
Joined
Jul 16, 2007
Messages
9,595 (2.50/day)
Likes
1,148
Processor Amd Athlon X2 4600+ Windsor(90nm) EE(65W) @2.9-3.0 @1.45
Motherboard Biostar Tforce [Nvidia] 550
Cooling Thermaltake Blue Orb-- bunch of other fans here and there....
Memory 2 gigs (2x1gb) of patriot ddr2 800 @ 4-4-4-12-2t
Video Card(s) Sapphire X1950pro Pci-E x16 @stock@stock on stock
Storage Seagate 7200.11 250gb Drive, WD raptors (30/40) in Raid 0
Display(s) ANCIENT 15" sony lcd, bought it when it was like 500 bucks
Case Apevia X-plorer blue/black
Audio Device(s) Onboard- Why get an sound card when you can hum??
Power Supply Antec NeoHe 550-manufactured by seasonic -replacement to the discontinued smart power series
Software Windows XP pro SP2 -- vista is still crap
#3
give me a trendmicro hijackthis! log file. i've been through this before, and i know how to get rid of it..
 

panchoman

Sold my stars!
Joined
Jul 16, 2007
Messages
9,595 (2.50/day)
Likes
1,148
Processor Amd Athlon X2 4600+ Windsor(90nm) EE(65W) @2.9-3.0 @1.45
Motherboard Biostar Tforce [Nvidia] 550
Cooling Thermaltake Blue Orb-- bunch of other fans here and there....
Memory 2 gigs (2x1gb) of patriot ddr2 800 @ 4-4-4-12-2t
Video Card(s) Sapphire X1950pro Pci-E x16 @stock@stock on stock
Storage Seagate 7200.11 250gb Drive, WD raptors (30/40) in Raid 0
Display(s) ANCIENT 15" sony lcd, bought it when it was like 500 bucks
Case Apevia X-plorer blue/black
Audio Device(s) Onboard- Why get an sound card when you can hum??
Power Supply Antec NeoHe 550-manufactured by seasonic -replacement to the discontinued smart power series
Software Windows XP pro SP2 -- vista is still crap
#5
its malware.. a program downloads and installed dll files with random gibberish names and puts them in the system32 folder and launchs them as an app by using the command line to open rundll32.exe.
 
Joined
Mar 15, 2008
Messages
401 (0.11/day)
Likes
12
Location
California USA
System Name MSI
Processor Intel 4790k@ stock for now
Motherboard MSI z97 gaming 7
Cooling H100i
Memory 16 gb of patriot viperx ddr3 1866
Video Card(s) GTX 970
Storage Crucial c300 128g, wd cavier black 1tb, seagate baracuda 2gb (for storage)
Display(s) 30" dell 3007
Case Haf x 942
Audio Device(s) ac 1150 onboard sound
Power Supply Roswell 1200
Software Windows pro 8.1
#6
man i'm fackin retarded i didn't really read the post next time i'll try harder loosing sleep, must go to bed:confused:
 

paulktreg

New Member
Joined
Aug 5, 2008
Messages
9 (0.00/day)
Likes
0
#7
I'll try running Spybot, Ad Aware and Kaspersky full scans this evening and see where that leaves me.

Could still do with something to clean the registry. Any recommendations?

Regards

Paul
 

panchoman

Sold my stars!
Joined
Jul 16, 2007
Messages
9,595 (2.50/day)
Likes
1,148
Processor Amd Athlon X2 4600+ Windsor(90nm) EE(65W) @2.9-3.0 @1.45
Motherboard Biostar Tforce [Nvidia] 550
Cooling Thermaltake Blue Orb-- bunch of other fans here and there....
Memory 2 gigs (2x1gb) of patriot ddr2 800 @ 4-4-4-12-2t
Video Card(s) Sapphire X1950pro Pci-E x16 @stock@stock on stock
Storage Seagate 7200.11 250gb Drive, WD raptors (30/40) in Raid 0
Display(s) ANCIENT 15" sony lcd, bought it when it was like 500 bucks
Case Apevia X-plorer blue/black
Audio Device(s) Onboard- Why get an sound card when you can hum??
Power Supply Antec NeoHe 550-manufactured by seasonic -replacement to the discontinued smart power series
Software Windows XP pro SP2 -- vista is still crap
#8
download trendmicro's hijackthis! and run a scan and post the log file here.. i tried those exact 3 when it happend to me and they didn't work..
 

paulktreg

New Member
Joined
Aug 5, 2008
Messages
9 (0.00/day)
Likes
0
#9
download trendmicro's hijackthis! and run a scan and post the log file here.. i tried those exact 3 when it happend to me and they didn't work..
Log file included. I have to be honest it doesn't mean a great deal to me. What are you looking for and how does it help?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:32:21, on 08/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
D:\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SkyTel.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0D2.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
D:\Cyberlink\PowerDVD\PDVDServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Intelligent\Common\RaUI.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
c:\progra~1\common~1\instal~1\update~1\isuspm.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\agent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: FireShot - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} - C:\Documents and Settings\Paul\Application Data\Mozilla\Firefox\Profiles\ro9wcmep.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\fsaddin-0.55.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0D2.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [RemoteControl] D:\Cyberlink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [{67546e69-e3d7-a9e5-b3ef-d1ab19c6ab13}] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\{36f62c4b-3d0c-82ca-4ee4-e6387ef0ec33}.dll" DllStart
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Intelligent Wireless Utility.lnk = C:\Program Files\Intelligent\Common\RaUI.exe
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: FireShot menu - {A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {9E265649-6E0E-4EEA-9F49-DAE0801440CF} (WebDiginet Control) - http://84.85.200.143/WebDiginet.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 10225 bytes

(If the above file is longer than rules permit I apologise.)

Regards

Paul
 
Joined
Dec 5, 2007
Messages
5,073 (1.37/day)
Likes
1,817
System Name Addison Clark / HTPC
Processor I7 7700k @ 5GHZ 1.35v / I7 6700k
Motherboard Asus Z270 ITX / Asrock Z270 Taichi
Cooling Custom loop for CPU and GPU / Be Quiet Dark Knight
Memory Corsair 16GB DDR4-3600 / G.Skill 16GB DDR4 - 2400
Video Card(s) Zotac 1080 TI F.E. under EK block / Asus Turbo GTX 1080 w/ Corsair H55
Storage Plextor M8Pe 1TB M.2 / 256GB and 512GB WD Black NVME's
Display(s) Asus 28" 4K / Samsung 55" 1080p
Case Corsair 380T / Silverstone GD10
Audio Device(s) Creative Omni USB / Onboard Realtek
Power Supply EVGA G3 Supernova 1KW / Rosewill 750W
Mouse G.Skill 780
Keyboard MS Sidewinder x4 / Logitech K400 combo
Software Win 10 Pro / Windows 8.1 w MCE and Win 10 Pro
#10

paulktreg

New Member
Joined
Aug 5, 2008
Messages
9 (0.00/day)
Likes
0
#11
Try MalwareBytes. Awesome utility for, you guessed it, malware! http://www.malwarebytes.org/
Installed and run. Picked up 39 items that Spybot and Ad-Aware missed. I am not getting any messages at boot so lets hope the problems solved.

I still feel a little uneasy about what's found its way onto my PC so I may do a new clean install as it's been a while since I last did it. The next problem is do I put XP Pro back on or do I install my as yet unused Vista Ultimate. Decisions, decisions!

Many thanks for your help guys it's appreciated.

Regards

Paul
 
Joined
Dec 5, 2007
Messages
5,073 (1.37/day)
Likes
1,817
System Name Addison Clark / HTPC
Processor I7 7700k @ 5GHZ 1.35v / I7 6700k
Motherboard Asus Z270 ITX / Asrock Z270 Taichi
Cooling Custom loop for CPU and GPU / Be Quiet Dark Knight
Memory Corsair 16GB DDR4-3600 / G.Skill 16GB DDR4 - 2400
Video Card(s) Zotac 1080 TI F.E. under EK block / Asus Turbo GTX 1080 w/ Corsair H55
Storage Plextor M8Pe 1TB M.2 / 256GB and 512GB WD Black NVME's
Display(s) Asus 28" 4K / Samsung 55" 1080p
Case Corsair 380T / Silverstone GD10
Audio Device(s) Creative Omni USB / Onboard Realtek
Power Supply EVGA G3 Supernova 1KW / Rosewill 750W
Mouse G.Skill 780
Keyboard MS Sidewinder x4 / Logitech K400 combo
Software Win 10 Pro / Windows 8.1 w MCE and Win 10 Pro
#12
Is it Vista Ultimate x64? If so then HELL YA throw it on. Do you need all of the HD space for one OS? You could partition your drive into two halves and install XP first then install Vista to the other.