[dsfanning]

I seem to have acquired spyware and virus despite all the protection I use. Please help me get rid of it.

Logfile of HijackThis v1.99.1
Scan saved at 3:39:03 PM, on 12/16/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvctrl.exe
C:\WINDOWS\system32\mssearchnet.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Verizon\Internet Security Suite\Freedom.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\debbie\Local Settings\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
F2 - REG:system.ini: Shell=Explorer.exe,icaav42a.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\icaav42a.exe,C:\Documents and Settings\debbie\Application Data\Explorer\icaav42a.exe,C:\Documents and Settings\Michael Fanning\Application Data\Explorer\icaav42a.exe
O2 - BHO: HomepageBHO - {1ca480cd-c0e5-4548-874e-b85b17905b3a} - C:\WINDOWS\system32\hpD9BE.tmp
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\vzbb.dll (file missing)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Internet Security Suite] C:\Program Files\Verizon\Internet Security Suite\Freedom.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Internet Player] C:\WINDOWS\system32\icaav42a.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Internet Player] C:\WINDOWS\system32\icaav42a.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {044F59D1-EFED-547E-7312-11C86563523C} - http://66.230.175.129/1/gdnUS2047.exe
O16 - DPF: {10495090-6A8D-5944-3034-38EF02F624FE} - http://66.230.175.129/1/gdnUS1384.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {18A1C0BC-09F0-2B85-5C0D-291217163A99} - http://66.230.175.129/1/gdnUS1384.exe
O16 - DPF: {1E4C018B-061E-0AEE-7480-4F4E126EE5B2} - http://66.230.175.129/1/gdnUS2047.exe
O16 - DPF: {2ADF0A60-D6A9-5B4F-111D-4D8C491A4E08} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {2D2B2407-C883-287F-9DB7-44BE4B851C8E} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {2DDA3073-7EA2-3F02-AE44-66013B326B9E} - http://66.230.175.129/1/gdnUS2053.exe
O16 - DPF: {2F36D6AD-7680-68A3-B109-597A299E4AEF} - http://69.50.173.166/1/gdnUS1862.exe
O16 - DPF: {2F9AF29D-A746-2256-C542-3FB8756F8E39} - http://69.50.173.166/1/gdnUS1862.exe
O16 - DPF: {373579ED-0D7A-68FF-D4FF-28F81AB96B06} - http://85.255.115.227/1/gdnUS1402.exe
O16 - DPF: {3FE7E764-823E-11E2-86EF-7E022FE58C1B} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {405C9146-772A-5F04-CE4E-679567AFDAB2} - http://85.255.115.227/1/gdnUS1402.exe
O16 - DPF: {40F5460F-10A9-5265-3C3C-467A348247D7} - http://66.230.175.129/1/gdnUS2047.exe
O16 - DPF: {4E7BD74F-2B8D-469E-DEFA-EB76B1D5FA7D} - http://reciperewards.aavalue.com/RR/Toolbar/rr-toolbar.cab
O16 - DPF: {4E9B312E-096B-1A46-70CF-12983179CEE5} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,76/mcinsctl.cab
O16 - DPF: {596EF34F-3CEB-30DF-79D8-7F9051939B97} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {5A148EEA-7951-7EC7-8A84-58A031845C98} - http://85.255.115.227/1/gdnUS1402.exe
O16 - DPF: {5B23F375-CB76-2A47-F567-47226E5CCBA6} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {5BA1D36A-9E9A-3A17-8789-776C4FDB1D6D} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {5D0FB090-993E-234B-8F27-01C501DEB5C7} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {64086624-B509-1869-F1B9-1AFF63228403} - http://66.230.175.129/1/gdnUS2053.exe
O16 - DPF: {692757F3-C02E-66FA-1ACE-3C5167928619} - http://85.255.115.227/1/gdnUS1402.exe
O16 - DPF: {69C92B2F-8C0D-3BB8-0C8C-237A0D174CBF} - http://66.230.175.129/1/gdnUS2047.exe
O16 - DPF: {6EC8679D-C35A-3E2F-D9FF-227D550F1F51} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {7595487C-0AFB-5E23-D453-31474F9682EF} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {76CBF631-8508-4DE9-D750-285B2F1B5C3D} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {798C48A0-CFB6-711C-4171-3FCB44222F32} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {88B507F9-C6B2-45CC-AAB6-720A652DE11C} (TenOfTen Class) - http://download.verizon.net/sfp/Cabs/hst/webinstall/HstWebInstall.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,19/mcgdmgr.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www2.verizon.net/update/msnwebinstall/includes/vzWebIns.cab
O16 - DPF: {D06A22B4-6087-4D3D-B7AF-82B113E9ABD4} (CPostLaunch Object) - http://www2.verizon.net/update/msnwebinstall/includes/vzWebIns.CAB
O16 - DPF: {DB0474CC-8EF6-47FC-905B-23FC58A70817} (RegPropsCtrl Class) - http://download.verizon.net/sfp/Cabs/hst/webinstall/HstWebInstall.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4326/mcfscan.cab
O18 - Protocol: shell - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O21 - SSODL: Internet Themes - {6049DB70-424D-4AF5-A449-60448816303A} - C:\WINDOWS\system32\upnpowiz.dll (file missing)
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe

[GTO]

Hi, dsfanning. Welcome to 2-Spyware.com forums!

From your log I can see that your system is infected with SpyAxe and some kind of a trojan that regularly downloads malicious files from the Internet and reinfects your PC.

Please follow these steps in order to get rid of the infection:

1. Kill these processes:

C:\WINDOWS\system32\nvctrl.exe
C:\WINDOWS\system32\mssearchnet.exe

2. Use HijackThis to fix the following entries:

F2 - REG:system.ini: Shell=Explorer.exe,icaav42a.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\icaav42a.exe,C:\Documents and Settings\debbie\Application Data\Explorer\icaav42a.exe,C:\Documents and Settings\Michael Fanning\Application Data\Explorer\icaav42a.exe
O2 - BHO: HomepageBHO - {1ca480cd-c0e5-4548-874e-b85b17905b3a} - C:\WINDOWS\system32\hpD9BE.tmp
O4 - HKLM\..\Run: [Internet Player] C:\WINDOWS\system32\icaav42a.exe
O4 - HKCU\..\Run: [Internet Player] C:\WINDOWS\system32\icaav42a.exe
O16 - DPF: {044F59D1-EFED-547E-7312-11C86563523C} - http://66.230.175.129/1/gdnUS2047.exe
O16 - DPF: {10495090-6A8D-5944-3034-38EF02F624FE} - http://66.230.175.129/1/gdnUS1384.exe
O16 - DPF: {18A1C0BC-09F0-2B85-5C0D-291217163A99} - http://66.230.175.129/1/gdnUS1384.exe
O16 - DPF: {1E4C018B-061E-0AEE-7480-4F4E126EE5B2} - http://66.230.175.129/1/gdnUS2047.exe
O16 - DPF: {2ADF0A60-D6A9-5B4F-111D-4D8C491A4E08} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {2D2B2407-C883-287F-9DB7-44BE4B851C8E} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {2DDA3073-7EA2-3F02-AE44-66013B326B9E} - http://66.230.175.129/1/gdnUS2053.exe
O16 - DPF: {2F36D6AD-7680-68A3-B109-597A299E4AEF} - http://69.50.173.166/1/gdnUS1862.exe
O16 - DPF: {2F9AF29D-A746-2256-C542-3FB8756F8E39} - http://69.50.173.166/1/gdnUS1862.exe
O16 - DPF: {373579ED-0D7A-68FF-D4FF-28F81AB96B06} - http://85.255.115.227/1/gdnUS1402.exe
O16 - DPF: {3FE7E764-823E-11E2-86EF-7E022FE58C1B} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {405C9146-772A-5F04-CE4E-679567AFDAB2} - http://85.255.115.227/1/gdnUS1402.exe
O16 - DPF: {40F5460F-10A9-5265-3C3C-467A348247D7} - http://66.230.175.129/1/gdnUS2047.exe
O16 - DPF: {4E7BD74F-2B8D-469E-DEFA-EB76B1D5FA7D} - http://reciperewards.aavalue.com/RR/Toolbar/rr-toolbar.cab
O16 - DPF: {4E9B312E-096B-1A46-70CF-12983179CEE5} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,76/mcinsctl.cab
O16 - DPF: {596EF34F-3CEB-30DF-79D8-7F9051939B97} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {5A148EEA-7951-7EC7-8A84-58A031845C98} - http://85.255.115.227/1/gdnUS1402.exe
O16 - DPF: {5B23F375-CB76-2A47-F567-47226E5CCBA6} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {5BA1D36A-9E9A-3A17-8789-776C4FDB1D6D} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {5D0FB090-993E-234B-8F27-01C501DEB5C7} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {64086624-B509-1869-F1B9-1AFF63228403} - http://66.230.175.129/1/gdnUS2053.exe
O16 - DPF: {692757F3-C02E-66FA-1ACE-3C5167928619} - http://85.255.115.227/1/gdnUS1402.exe
O16 - DPF: {69C92B2F-8C0D-3BB8-0C8C-237A0D174CBF} - http://66.230.175.129/1/gdnUS2047.exe
O16 - DPF: {6EC8679D-C35A-3E2F-D9FF-227D550F1F51} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {7595487C-0AFB-5E23-D453-31474F9682EF} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {76CBF631-8508-4DE9-D750-285B2F1B5C3D} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {798C48A0-CFB6-711C-4171-3FCB44222F32} - http://66.230.175.129/1/gdnUS2161.exe
O21 - SSODL: Internet Themes - {6049DB70-424D-4AF5-A449-60448816303A} - C:\WINDOWS\system32\upnpowiz.dll (file missing)

3. Launch Internet Explorer.
* Within it click on the Tools menu and then select the Manage Add-ons entry.
* This should open the add-on manager. Find the HomePageBHO add-on, select it with your mouse or keyboard and then check the Disable option located below. Press OK. This should disable the SpyAxe-related malicious add-on.

5. Download the smitRem tool and upack its files.

4. Reboot your computer into Safe Mode. This step is very important!

5. Run the smitRem tool (the RunThis.bat file). This should delete ioctrl.dll and svchosts.dll files, which are responsible for displaying the system tray blinking icon and redirecting Internet Explorer to undesirable web sites.

6. Follow SpyAxe manual removal instructions. You have to find and delete all remaining SpyAxe files, folders and registry keys.

7. Delete the following files:

C:\WINDOWS\system32\icaav42a.exe
C:\WINDOWS\system32\hpD9BE.tmp

8. After you get done, restart your computer, run new HijackThis scan and post a fresh log here.

[dsfanning]

Thanks for your help !!
Here's my new log


Logfile of HijackThis v1.99.1
Scan saved at 9:19:50 AM, on 12/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Verizon\Internet Security Suite\Freedom.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\debbie\Local Settings\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cgi.verizon.net/bookmarks/bmredir.asp?region=all&bw=dsl&cd=6.1&bm=ho_search
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\vzbb.dll (file missing)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Internet Security Suite] C:\Program Files\Verizon\Internet Security Suite\Freedom.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2D2B2407-C883-287F-9DB7-44BE4B851C8E} - http://66.230.175.129/1/gdnUS2161.exe
O16 - DPF: {88B507F9-C6B2-45CC-AAB6-720A652DE11C} (TenOfTen Class) - http://download.verizon.net/sfp/Cabs/hst/webinstall/HstWebInstall.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,19/mcgdmgr.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www2.verizon.net/update/msnwebinstall/includes/vzWebIns.cab
O16 - DPF: {D06A22B4-6087-4D3D-B7AF-82B113E9ABD4} (CPostLaunch Object) - http://www2.verizon.net/update/msnwebinstall/includes/vzWebIns.CAB
O16 - DPF: {DB0474CC-8EF6-47FC-905B-23FC58A70817} (RegPropsCtrl Class) - http://download.verizon.net/sfp/Cabs/hst/webinstall/HstWebInstall.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4326/mcfscan.cab
O18 - Protocol: shell - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe

[GTO]

Congratulations! Your log looks clean from parasites.

However, there are two entries left that you should fix:

O16 - DPF: {2D2B2407-C883-287F-9DB7-44BE4B851C8E} - http://66.230.175.129/1/gdnUS2161.exe
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\vzbb.dll (file missing)