Confused with results of scan!

Viruses and worms
1

Hi,
I’m confused with these results.

C:\WINDOWS\SYSTEM32\sre.dll[UPX] [E] UPX archive is corrupted. (42132)
C:\WINDOWS\nvsvwc.exe[UPX] [E] UPX archive is corrupted. (42132)
C:\WINDOWS\WIN386.SWP [E] The process cannot access the file because (32)
C:\WINDOWS\hbcl.exe[UPX] [E] UPX archive is corrupted. (42132)

I have been getting some of these corrupted file results since July. When I chase them down individually on my computer and scan them they come back as clean.
How do I repair the corrupted files?
What does this mean?
C:\WINDOWS\WIN386.SWP [E] The process cannot access the file because (32)
Any education you can provide is greatly appreciated.
Thanks Jim

2

Will this info help in figuring out whats going on?
StartupList report, 9/22/05, 11:25:46 AM
StartupList version: 1.52
Started from : C:\PROGRAM FILES\STARTUPLIST.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)

  • Using default options
    ==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\WINWORD.EXE
C:\PROGRAM FILES\AMERICA ONLINE 7.0\WAOL.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\PROGRAM FILES\STARTUPLIST.EXE

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
SystemTray = SysTray.Exe
avast! Web Scanner = C:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
ashMaiSv = C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

avast! = C:\Program Files\Alwil Software\Avast4\ashServ.exe

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll

C:\WINDOWS\WININIT.BAK listing:
(Created 17/9/2005, 8:5:46)

[Rename]
NUL=C:\WINDOWS\TEMPOR~1\CONTENT.IE5\INDEX.DAT
NUL=C:\WINDOWS\COOKIES\INDEX.DAT

Enumerating Browser Helper Objects:

(no name) - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

Enumerating Download Program Files:

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL

End of report, 3,380 bytes
Report generated in 1.569 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

3

Oh and whats this I’m A llama or not a llama stuff???

4

There is nothing strange about Avast unable to scan certain files.
This has been explained many times before on this board.
Please use the search option before asking.

Avast can not scan files if:

  • they are encrypted in a unknow encryption form
  • they are password protected.
5

Click on the Profile buttom on the top of this page and customize your forum settings… 8)

6

The C:\WINDOWS\WIN386.SWP is I believe the windows swap file in earlier versions of windows, 98 in your case (I think it was usually in the C: folder though) and as such is protected and quite possibly also very large.

See - http://www.computerhope.com/issues/ch000358.htm

7

Thanks for the reply’s.
I will look into the link re/ the swap file.
I am aware of the files avast can’t scan due to password protection etc. I didn’t list those75 or so files that are quarantined by ad aware etc. I was hoping someone would be familiar with the UPX files (what is is ) and if corrupted how to fix if necessary.

re/my profile I was joking, but I don’t recall setting myself as a llama.
Thanks again. JB

8
I was hoping someone would be familiar with the UPX files (what is is ) and if corrupted how to fix if necessary.

UPX is a way of further compressing a file, typically .exe files, I have used it to compress my firefox.exe file which is 6.4MB down to 2.7MB which means it loads quicker. However unless you have the original file which you can compress again, I doubt that there is anything you can do with a corrupt UPX file. For the most part I follow follow the advice given previously, ignore it. If it were a problem when and if that file was in use it would show up.

The default setting in the profile has everyone as a Llama, for the most part it prompt people to change it ;D

9

Thanks David that explains it . I appreciate the heads up.
JB

10

Your welcome.