ZLH.EXE and NVC problem

Discussion in 'Malware Help (A Specialist Will Reply)' started by F-man, Dec 3, 2005.

  1. F-man

    F-man Private E-2

    Hello.

    Yesterday I was playing Civ4, and suddenly the computer shuts down. When I started it again, it came up with 2 error messages;
    "ZLH.EXE has encountered a problem and needs to close"
    and
    "NVC On Access virus scanner has encountered a problem and needs to close".

    I also noteced that my virus program (Norman Virus Control) wasn't running. I then followed all the steps in the "READ & RUN ME FIRST Before Asking for Support" manual, and I still have the same problem.

    If I try to start my virus program (Norman) now, I get the massage; "NVCOD.EXE has encountered a problem and needs to close". I tryed to reinstall it, but nothing seems to help.

    Tried to add the log from bitdefender, but I'm only abel to attach 2 files.

    If someone care to take a look, I would realy appriciate it :)


    F-man
     

    Attached Files:

  2. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Sacn with HijackThis and fix the following:
    Follow the directions in the following thread:
    Running Spy Sweeper
     
  3. F-man

    F-man Private E-2

    Done and done. :)

    I havn't tried restart my computer yet, so I don't know if this fixed it.


    F
     

    Attached Files:

  4. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Your HijackThis log isn't showing any infections.

    I want to take a deeper look.

    Please run Panda Online Scan. After the scan attach the log to your next post. Also please follow the below:

    1 - Please EXTRACT all files from Qoologic Tool to its own folder - C:\Program Files\QoologicFinder . Then, DoubleClick Find-Qoologic.bat to run the tool. It should produce a log - Please attach that with your next post!

    2 - Please EXTRACT all the files form RKFiles Tool to its own folder named C:\Program Files\RKTOOL. Then, Please boot to SAFE MODE and DoubleClick rkfiles.bat to run the tool. Let it run and then, when it finishes, look for a log at C:\Log.txt and please attach that log.

    Now come back here and post all three logs as attachments
     
  5. F-man

    F-man Private E-2

    Done. But I still get the messages when I start the computer. And now I get a 3. message on the start-up;
    "NIP.EXE has encountered a problem and needs to close"

    Can't post Panda scan, it's coming on my next post.
     

    Attached Files:

  6. F-man

    F-man Private E-2

    I also get a message from Microsoft Outlook now, where it says something about he can't send the message (e-mail), and I need to run Microsoft Outlook and make it the standard e-mail client.

    The message is in norwegian, cind of difficult to translate.

    Can't seem to find the log from Panda, so I'll run it once more.
     
  7. F-man

    F-man Private E-2

    There, I found it. This is the orginale file.
     

    Attached Files:

  8. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    If Panda found anything there should be a 'See Report' button you can click.

    The Qoologic and RKFiles logs, didn't show anything that needs to be dealt with.

    Run CCleaner before doing the below.

    Download WinPFind

    Extract it to the root folder of drive C ( C:\ ). This will create a folder called WinPFind in the C:\ folder. Inside C:\WinPFind is a file called WinPFind.exe. Double-click on this file to launch the program. Once it is launched, click on the Start Scan button and wait for it to finish. This program will scan large amounts of files on your computer for known patterns so please be patient while it works as it can take a while, upwards to 30 minutes or more.

    When it is done, it will show the results of the scan. Click on the Copy to Clipboard button and then paste the contents of the log in your clipboard. Then save it to a file using notepad and upload the text file here as an attachment.
     
  9. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Uninstall Altnet if possible.

    In Safe Mode open Windows Exlporer and delete:

    D:\Program Files\Altnet <---- Delete the Folder
     
  10. F-man

    F-man Private E-2

    Done.

    And have deleted Altnet in safe mode.

    I still get the error messages.


    And thank you so much for your time, you're a life saver :)


    F
     

    Attached Files:

  11. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Your logs are clean. You may have to uninstall Norman then reinstall, too fix that error message.

    ZLH.exe is a component belonging to Norman Virus Control's Internet security software. Short for Zanda's Little Helper, supporting component of the Norman Virus Control general agent named Zanda. This program is important for the stable and secure running of your computer and should not be terminated.
     
  12. F-man

    F-man Private E-2

    Yes I uninstalled and then reinstall Norman, and it seems to be working fine now. :-D I just thought it was strange that it suddenly should just crash up like that, and I was worried it was some kind of deadly and spooky virus ;-)

    Thank you ever so much once again. Now I can finaly sleep well at night ;-)


    F-man
     
  13. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Your system appears to be clean.

    Glad, Norman is working again.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds