Bootup will not finish

14 years ago

Having trouble with XP-SP3 desktop. Computer will start boot process---Windows welcome window, etc. and desktop wallpaper loads, then nothing further. No taskbar, no icons, so I really can't do anything. Shut down using power button and rebooted into Safe Mode. That works, so I then did a restore to yesterday which worked, but changed my desktop from classic view to XP, but that's minor. I took off the wallpaper and was finally able to reboot after doing all the MS updates. Even downloaded some e-mail. I decided to fix my display back to classic and also enlarge fonts from 96dpi to 120dpi, which required a restart. Same thing all over again. I watch the light for the HDD and see activity after the boot activity starts and even after the wallpaper comes up there is still some blinking of the yellow light. It comes to a stop and there it sits. I finally just shut down again by hitting the power button. Any ideas as to what might be causing this and how I can fix it?

Sort by:Oldest

Comments (36)

mikie_gw
14 years ago
last modified: 9 years ago
Just a quick guess .. Sounds like windows is updating - or trying to.
Ummm, when you did the restore, you eliminated the updates that were at lease partially installed... so it is trying to install them again.

2nd tues of the month is typical windows updates day ... or the following day.

Get back into your desktop and run windows updates.. and give them a chance to install.

I just did battle with a girls on a computer.. she couldnt wait for her updates to finish... much like yours sounds like. Her security essetials program had a version update.. the beta tester version.. was taking time on an xp computer to install/re-update defs and configure.
0
ravencajun Zone 8b TX
14 years ago
last modified: 9 years ago
yes it was big patch day Tuesday I had posted about it. When you do a system restore you remove those updates you had done. you might want to try doing the updates just a few at a time then reboot and do more so if one is the cause you can know, I would consider doing a system restore point before each batch also so you have a place you know you can revert to.

I have so far not seen any reports of problems from the updates on the forums but that does not mean it can't happen.

I think I would disable the wall paper till you are fully done with the updates too. Is this by any chance a new wallpaper?
0
Related Discussions
Got a problem
Q
Comments (18)
I've run MBAM. Here's the log. Also installed Avast. Haven't run it yet. Malwarebytes' Anti-Malware 1.33 Database version: 1675 Windows 5.1.2600 Service Pack 2 1/21/2009 9:34:04 PM mbam-log-2009-01-21 (21-34-04).txt Scan type: Full Scan (C:\:D:\:) Objects scanned: 87240 Time elapsed: 42 minute(s), 36 second(s) Memory Processes Infected: 0 Memory Modules Infected: 7 Registry Keys Infected: 42 Registry Values Infected: 5 Registry Data Items Infected: 4 Folders Infected: 6 Files Infected: 97 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: C:\WINDOWS\system32\tfpborxo.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\xxyxXQIX.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\ebazok.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\odcoar.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\ozaklo.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\vcaofw.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\gwmrlejv.dll (Trojan.Vundo.H) -> Delete on reboot. Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(0602185b-fd6d-4528-953d-ef635a987872) (Trojan.Vundo.H) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\(0602185b-fd6d-4528-953d-ef635a987872) (Trojan.Vundo.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(77ab5974-55a3-4737-9fd5-b93c64307f78) (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\(77ab5974-55a3-4737-9fd5-b93c64307f78) (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\(bcfcadab-c1b6-49db-97bd-47aad9cfbcba) (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\(833fb60a-13c0-4078-b34d-7ce7a2f11ee7) (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\(4fb0a396-c1fe-493e-bb58-5f1443a3f881) (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\(4fb0a396-c1fe-493e-bb58-5f1443a3f881) (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\(1ba861b6-3dd0-4922-890d-21291b317fe8) (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\(0602185b-fd6d-4528-953d-ef635a987872) (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\(77ab5974-55a3-4737-9fd5-b93c64307f78) (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\(9dd4258a-7138-49c4-8d34-587879a5c7a4) (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\(c3bcc488-1ae7-11d4-ab82-0010a4ec2338) (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\(6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c) (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\(5b4c3b43-49b6-42a7-a602-f7acdca0d409) (Adware.OneStepSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(9dd4258a-7138-49c4-8d34-587879a5c7a4) (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(b8c0220d-763d-49a4-95f4-61dfdec66ee6) (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(c3bcc488-1ae7-11d4-ab82-0010a4ec2338) (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(000000da-0786-4633-87c6-1aa7a4429ef1) (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\icheck (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1039a4b9 (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\(0e1230f8-ea50-42a9-983c-d22abc2eeb4c) (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\(0656a137-b161-cadd-9777-e37a75727e78) (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\11502311588515100851184273869642 (Rogue.Antivirus) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\xxyxxqix -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\xxyxxqix -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders (Trojan.Agent) -> Data: digeste.dll -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: C:\WINDOWS\mslagent (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\akl (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\system32\smp (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\Program Files\iCheck (Trojan.Agent) -> Quarantined and deleted successfully. C:\Program Files\GetModule (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Lee\Application Data\GetModule (Trojan.Agent) -> Quarantined and deleted successfully. Files Infected: C:\WINDOWS\system32\xxyxXQIX.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\XIQXxyxx.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\XIQXxyxx.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\rxgpfbhs.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\shbfpgxr.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\tfpborxo.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\oxrobpft.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\gwmrlejv.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\ebazok.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\odcoar.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\ozaklo.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\vcaofw.dll (Trojan.Vundo) -> Delete on reboot. C:\Documents and Settings\Lee\Local Settings\Temp\TDSS8690.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Lee\Local Settings\Temporary Internet Files\Content.IE5\1QBCIGR8\upd105320[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\Documents and Settings\Lee\Local Settings\Temporary Internet Files\Content.IE5\1QBCIGR8\index[1] (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Program Files\GetModule\GetModule32.exe (Adware.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore(052FFA65-6E8F-4958-9CC5-BC64FB6071A1)\RP343\A0023178.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore(052FFA65-6E8F-4958-9CC5-BC64FB6071A1)\RP343\A0024214.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\oywsvrto.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSScfgb.dll (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSnrsr.dll (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSoeqh.dll (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSriqp.dll (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\oducixko.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\wpv761229907443.cpx (Adware.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\digeste.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\cfuvrkap.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\chawnvcv.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\vgsdlxhp.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\mikwdshd.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\TDSSpaxt.sys (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\mslagent\2_mslagent.dll (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\WINDOWS\mslagent\mslagent.exe (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\WINDOWS\mslagent\uninstall.exe (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\akl\akl.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\Program Files\akl\akl.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\Program Files\akl\uninstall.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\Program Files\akl\unsetup.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\system32\smp\msrc.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\Program Files\iCheck\Uninstall.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSosvn.dat (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ieupdates.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\a.bat (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\base64.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\FVProtect.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\userconfig9x.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\winsystem.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\zip1.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\zip2.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\zip3.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\zipped.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ (Fake.Dropped.Malware) -> Delete on reboot. C:\WINDOWS\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\iTunesMusic.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\akttzn.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\anticipator.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\awtoolb.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\bsva-egihsg52.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\dpcproxy.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\h@tkeysh@@k.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\hoproxy.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\hxiwlgpm.dat (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\hxiwlgpm.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\msgp.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\msnbho.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\msvchost.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\mtr2.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\mwin32.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\netode.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\newsd32.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ps1.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\psof1.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\psoft1.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\regc64.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\regm64.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\Rundl1.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\sncntr.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ssurf022.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ssvchost.com (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ssvchost.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\sysreq.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\taack.dat (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\taack.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\thun.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\thun32.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\VBIEWER.OCX (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\vcatchpi.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\winlogonpc.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\winsystem.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\WINWGPX.EXE (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\vbsys2.dll (Trojan.Clicker) -> Quarantined and deleted successfully. C:\Documents and Settings\Lee\Local Settings\Temp\TDSS85a6.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSfpmp.dll (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSStkdv.log (Trojan.TDSS) -> Quarantined and deleted successfully.
...See More
Monitor won't stay on?
Q
Comments (11)
What kind of work did the computer shop do for you? By accident, because of my lack of knowledge, I did a Destructive Recovery when I was stuck on a black screen with white lettering I couldn't get out of. It brought me back to day one with problems that were fixed via Gateway phone support which is no longer. One being not able to do windows updates and a shut down time problem. They were supposed to see if they could fix that and do all updates for windows and the drivers. The computer (Win XPPRO) was brought in to find the cause of a sound that just started happening like a whirring speed up then down then steady starting after the computer is on for 7 minutes. They said the heat sync fan/fans are OK and unplugged my floppy drive thinking it was that when the floppy had been known to make a short noise when I first used it when I bought the computer back in 2004 but hadn't since. A noise like it may have been trying to read? That was not the noise I meant. Also is it possible the tech installed a new video card and disabled the onboard video in the BIOS? In this case you should see a different video connection lower down the rear of the tower which you would need to connect to. Is that the socket I plug my monitor into as I noticed I could not push it in all the way to hide the silver part I thought did before? Then screw each side tight. Is that it? If so, I bet they did but WHY? Before I brought it in, everything worked fine except because of the Recovery two problems came back that had been corrected by Gateway I wanted fixed again and I was concerned about a noise that recently appeared, me thinking it was my HD or the sync fan.
...See More
Slow bootup and one other problem
Q
Comments (8)
Here's the log: Logfile of Trend Micro HijackThis v2.0.3 (BETA) Scan saved at 3:04:34 PM, on 4/18/2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\Program Files\USB Safely Remove\USBSRService.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Tall Emu\Online Armor\OAcat.exe C:\Program Files\Tall Emu\Online Armor\oasrv.exe C:\Program Files\Alwil Software\Avast5\AvastSvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe C:\Program Files\Java\jre6\bin\jqs.exe c:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe C:\Program Files\Tall Emu\Online Armor\oaui.exe C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Secunia\PSI\psi.exe C:\Program Files\Tall Emu\Online Armor\OAhlp.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe C:\PROGRAM FILES\COMMON FILES\ACRONIS\SCHEDULE2\SCHEDHLP.EXE C:\PROGRAM FILES\ACRONIS\TRUEIMAGEHOME\TIMOUNTERMONITOR.EXE C:\PROGRAM FILES\ACRONIS\TRUEIMAGEHOME\TRUEIMAGEMONITOR.EXE C:\WINDOWS\system32\SearchProtocolHost.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.msnbc.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.net/s/search?r=minisearch R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.net/s/search?r=minisearch R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R3 - URLSearchHook: URLSearchHook Class - (37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8) - C:\Program Files\NetZero\SearchEnh1.dll O2 - BHO: LastPass Browser Helper Object - (95D9ECF5-2A4D-4550-BE49-70D42F71296E) - C:\Program Files\LastPass\LPBar.dll O2 - BHO: WOT Helper - (C920E44A-7F78-4E64-BDD7-A57026E7FEB7) - C:\Program Files\WOT\WOT.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - (DBC80044-A445-435b-BC74-9C25C1C588A9) - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - (E7E6F031-17CE-4C07-BC86-EABFE594F69C) - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: WOT - (71576546-354D-41c9-AAE8-31F2EC22BF0D) - C:\Program Files\WOT\WOT.dll O3 - Toolbar: LastPass Toolbar - (9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5) - C:\Program Files\LastPass\LPBar.dll O3 - Toolbar: ZeroBar - (F0F8ECBE-D460-4B34-B007-56A92E8F84A7) - C:\Program Files\NetZero\Toolbar.dll O3 - Toolbar: Copernic Desktop Search - Home Toolbar - (4A1C6093-14F9-44D7-860E-5D265CFCA9D9) - C:\Program Files\Copernic Desktop Search - Home\Toolbar\ToolbarContainer101000313.dll O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe" O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user') O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe O4 - Startup: WKCALREM.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: LastPass - file://C:\Program Files\LastPass\context.html?cmd=lastpass O8 - Extra context menu item: LastPass Fill Forms - file://C:\Program Files\LastPass\context.html?cmd=fillforms O9 - Extra button: Connection Help - (E2D4D26B-0180-43a4-B05F-462D6D54C789) - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Connection Help - (E2D4D26B-0180-43a4-B05F-462D6D54C789) - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: (no name) - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Connection Help - (E2D4D26B-0180-43a4-B05F-462D6D54C789) - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU) O9 - Extra 'Tools' menuitem: Connection Help - (E2D4D26B-0180-43a4-B05F-462D6D54C789) - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU) O16 - DPF: (0E5F0222-96B9-11D3-8997-00104BD12D94) (PCPitstop Utility) - http://utilities.pcpitstop.com/da/PCPitStop.CAB O16 - DPF: (6414512B-B978-451D-A0D8-FCFDF33E833C) (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1246730020218 O16 - DPF: (6F15128C-E66A-490C-B848-5000B5ABEEAC) (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab O16 - DPF: (C42B23DF-334C-4AD0-9AB4-91FF53D04239) (AbImporter Class) - file:///C:/Documents%20and%20Settings/HP_Administrator/Application%20Data/Smilebox/OzDesktopImporter.cab O16 - DPF: (E2883E8F-472F-4FB0-9522-AC9BF37916A7) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O16 - DPF: (FFB3A759-98B1-446F-BDA9-909C6EB18CC7) (PCPitstop Exam) - http://utilities.pcpitstop.com/da2/PCPitStop2.cab O17 - HKLM\System\CCS\Services\Tcpip\..\(FC452E2D-D290-415C-A487-EAF08B4CB7FB): NameServer = 192.168.0.1 O18 - Protocol: bwfile-8876480 - (9462A756-7B47-47BC-8C80-C34B9B80B32B) - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: wot - (C2A44D6B-CB9F-4663-88A6-DF2F26E4D952) - C:\Program Files\WOT\WOT.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL O22 - SharedTaskScheduler: Browseui preloader - (438755C2-A8BA-11D1-B96B-00A0C90312E1) - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - (8C7461EF-2B13-11d2-BE35-3078302C2030) - C:\WINDOWS\system32\browseui.dll O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Online Armor Helper Service (OAcat) - Unknown owner - C:\Program Files\Tall Emu\Online Armor\OAcat.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: Online Armor (SvcOnlineArmor) - Unknown owner - C:\Program Files\Tall Emu\Online Armor\oasrv.exe O23 - Service: USB Safely Remove Assistant (USBSafelyRemoveService) - Unknown owner - C:\Program Files\USB Safely Remove\USBSRService.exe -- End of file - 10612 bytes
...See More
Malicious Software Not Removed (Zbot.gen)
Q
Comments (21)
I guess this is why it's good not to put all one's eggs in one basket, but use different scans of each type when reasonable (i.e. using online AV scans in addition to using one's preferred full-time AV program). Re: the PC Mag article(s): FWIW, Rubenking praised MBAM -- and I use it myself ! -- but it didn't find the four trojans that the ESET scan did. And my own free Avira AV scan didn't find them either. I'm not sure where trojans fall category-wise: malware or viruses. Or something else. But whatever programs should find them (av or anti-malware), mine didn't. :-( Perhaps I should have also tried AVG just to see if its results would have been better, but I was naturally more concerned with getting rid of whatever was in my computer than with doing AV, anti-malware tests. ;-) So my (albeit limited) experience of having ESET find and remove 4 trojans that MBAM and Avira missed, at least makes me lean in the direction of trusting ESET for future supplementary AV scan purposes. And, of course, I'll try the Kaspersky Virus Removal Tool again if necessary. (Since I ran it after the ESET scan, I have no idea if it would have found and removed the 4 trojans as well. And I hope I never have cause to find out in the future !!)
...See More
DA_Mccoy
14 years ago
Bobbie,

My Vista system updated fine yesterday except for the Malware Tool. As usual I was downloading it separately, and it froze at 82%. Since the application automatically runs after downloading I cancelled for fear if the downloading did start up again it might have been corrupt.

Sharing just in case.

DA
0
grandms
Original Author
14 years ago
last modified: 9 years ago
The updates all downloaded and installed. It was AFTER the reboot required that this occurred. I shut down and tried repeatedly to reboot, but no joy. I even ran BelArc which showed all the updates installed.

I will now go and try a reboot once more and will let you know if it rebooted normally.
0
zep516
14 years ago
last modified: 9 years ago
Windows welcome window, etc. and desktop wallpaper loads, then nothing further. No taskbar, no icons,

Sounds like Explorer.exe is possibly corrupted , that controls the desktop icons task bar an more.

So are you saying you ran belarc in safe mode then, is that how you ran it??

You have other options at the windows advanced options menu besides safe mode.....

Still have issues try Last known good configuration

That will take you further back sometimes then a system restore.

No go there,

try Safe mode with command prompt at the command prompt type in chkdsk /r

Also,You can try:

In Safe mode, open the task manger and look for explorer.exe right click it and end task. Reboot. There is a way to recreate explorer.exe from the task manager too. In the task manger if ending the explore.exe does nothing, at the top click file click New Task and type in explore.exe

Anyway some things to try.
0
grandms
Original Author
14 years ago
last modified: 9 years ago
I did open task manager in Safe Mode but nothing running. Processes all 0 except for system idle 98-99. I had also already tried Last known good configuration and that did not work. Yes, Zep, I opened BelArc in Safe Mode and it showed all the updates as installed.

Here's where I am now. I did another system restore to Saturday, Dec. 11. I then went to Windows Update and installed the IE8 cumulative update which had already been downloaded. After this, got the message to restart, which I attempted to do, and the same thing happened again (stuck at wallpaper). So I then again booted up in Safe Mode and went back to Monday, Dec. 13. No updates have been done, and I think I'll just leave things as is for a day or so before attempting to install any of the updates. Oh, yes, my desktop is now in XP mode instead of Classic, but I'll leave that alone for now, also.

This really has me puzzled. The system restore took almost an hour to complete, and I don't remember that being the case when I used it previously. I'm going to run some scans now (Avast, Malwarbytes, SuperAntispyware).
0
grandms
Original Author
14 years ago
last modified: 9 years ago
I ran scans with Avast and SuperAntispyware and nothing other than tracking cookies. Updated Malwarebytes to run a scan, and this required a restart, which brought me right back to the same problem. I notice that after the wallpaper appears, there is some activity with the HDD light flashing, but this slows down and then only one blink every 15-20 seconds. Yesterday I left it like this for several hours and nothing further loaded.

Zep, I will try Safe Mode with Command Prompt tomorrow and run the Chkdsk. If that doesn't work, I'll also try using Task Manager in Safe Mode and see what I can do. I may need more help there. It may be afternoon tomorrow before I can get back to this.
0
fruitjarfla
14 years ago
last modified: 9 years ago
"I took off the wallpaper and was finally able to reboot after doing all the MS updates." Try disabling wallpaper before booting. Another -- disable virus and firewall from startup programs, shutdown, then boot. Not yet? Try disabling any other non-essentials from startup.
0
PKponder TX Z7B
14 years ago
last modified: 9 years ago
Sounds like a corrupted profile to me, notice how we all have different ideas? :-) You may need to create a dummy administrator profile in safe mode, then boot into that in normal mode...if it loads, then your issue is a corrupted profile. You'll have to copy all of your documents and desktop icons to the new profile if that is the case.

Pam
0
grandms
Original Author
14 years ago
last modified: 9 years ago
Zep, my friend, once again to the rescue! Safe Mode w/command prompt did not work because chkdsk will not run without a reboot, and that could not happen. In Safe Mode I opened Task Manager and saw explorer.exe at the top of the processes. Right click brought up dire warnings, but I gritted my teach and ended the process. Rebooted, and all came up. Still at the XP desktop rather than Classic mode, and updates still want to be done. Now, dare I start installing these updates one at a time or not? I'm almost afraid to do anything that requires a reboot. I won't do anything else that requires rebooting until someone braver than I says, "Go ahead."
0
ravencajun Zone 8b TX
14 years ago
last modified: 9 years ago
you need to try the second part of zeps suggestion to recreate explorer.exe.

hit Ctrl-Alt-Del and open task manger,click on File at top,
and hit new task(run) and type explorer.exe and run it
0
grandms
Original Author
14 years ago
last modified: 9 years ago
Okay, Raven. I did that, and it brought up My Documents as the task running in addition to my browser open to this site. Is that all, now? Will it be safe to begin the installation of the MS updates?
0
ravencajun Zone 8b TX
14 years ago
last modified: 9 years ago
did it bring back your icons etc? Lets try to get this fixed before you try doing your updates.

just to make sure this is not something simple have you tried
1. Right-click the desktop.
2. Point to Arrange Icons By.
3. Click Show Desktop Icons.
0
grandms
Original Author
14 years ago
last modified: 9 years ago
Yes, all my icons are back and taskbar is back along with quick launch. I also changed desktop back to Classic mode. So far, so good.
0
ravencajun Zone 8b TX
14 years ago
last modified: 9 years ago
ok good then I would break down your updates to just a few at a time, I would also create a restore point before each group that way if one of the updates causes a problem you know exactly what restore point to use and can skip that update. Wait till last to do the malware tool update since it takes a while to run.

After you are all done I would update malwarebytes and run a full scan again just to be safe.
0
grandms
Original Author
14 years ago
last modified: 9 years ago
Thanks so much Raven, Zep and everyone else.

Pam, I'm glad it was not the problem you suggested. That would have required some work.
0
grandms
Original Author
14 years ago
last modified: 9 years ago
Well, I thought the problem was solved, but it is not. I ran Malwarebytes, which found 9 problems. I selected all to be taken care of, and the log seemed to indicate that. However, a restart is required afterwards, and the same old thing happened. I could not get past the wallpaper screen.

I went back into Safe Mode and repeated the steps with Task Manager to no avail. This time I did a system restore back to Friday, Dec. 10, and am currently using the computer with those settings. However, I still haven't done any of the MS December updates (they are downloaded but not installed). I can't decide whether to shut down tonight or just leave the computer running. I changed the power settings from standby and hibernate to "never" with only the monitor shutting off after a period of time. I thought maybe those settings might be causing a problem. Can you see that I'm grasping at straws now?
0
zep516
14 years ago
last modified: 9 years ago
Did you run the chkdsk /r thing?

Also when you boot to the advanced options menu where safe mode is, do you have a repair option there?

It's always possible it may be the drive too...
0
zep516
14 years ago
last modified: 9 years ago
Wait if it's running in safe mode then the drive would not be a problem, maybe a start up program or something. What programs start up with windows, anti virus and firewalls are most likely programs to cause issues...

It's all guesses here
0
grandms
Original Author
14 years ago
last modified: 9 years ago
I could not run chkdsk /r because "a file was in use" and it would run on next boot up. Of course, I could not boot up, so have not been able to run chkdsk.

Not sure whether I have a repair option or not. Will look for that if I have to boot into SM again.

Please, this is a replacement drive that I just installed several months ago. WD replaced under warranty, and that one was a replacement for the original Seagate drive, which died after about five years. HDD Health shows the operating temperature as 38C and health as 100%.

Is there a way to force chkdsk to run without a boot up first?
0
ravencajun Zone 8b TX
14 years ago
last modified: 9 years ago
ok well my guess is that it is definitely the infection causing this problem, when you reverted back to an old restore point you went back to one that was infected.
We need to see the log of what malwarebytes found to know what it is we are dealing with. Open malwarebytes and at the top click on log and see if it has the log from that scan and if so copy and paste it here.

you may just need to go to LzD and ask them to help you with this.
0
grandms
Original Author
14 years ago
last modified: 9 years ago
Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Database version: 5328

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/16/2010 2:40:06 PM
mbam-log-2010-12-16 (14-40-06).txt

Scan type: Full scan (C:\:)
Objects scanned: 262149
Time elapsed: 32 minute(s), 57 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 3
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 9

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\bak_XMLLookup (Hijacker.XMLLookup) -> Value: bak_XMLLookup -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\bak_Application (Hijacker.Application) -> Value: bak_Application -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\bak_intl (Hijacker.intl) -> Value: bak_intl -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\XMLLookup (Hijacker.XMLLookup) -> Bad: (http://www.helpmeopen.com/?n=app&l=%04x&ext=%s) Good: (http://shell.windows.com/fileassoc/fileassoc.asp?LangID=%04x&Ext=%s) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\Application (Hijacker.Application) -> Bad: (http://www.helpmeopen.com/?n=app&l=%04x&ext=%s) Good: (http://shell.windows.com/fileassoc/%04x/xml/redir.asp?Ext=%s) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\intl (Hijacker.intl) -> Bad: (http://www.helpmeopen.com/?n=app&l=%04x&ext=%s) Good: (http://shell.windows.com/fileassoc/fileassoc.asp?LangID=%04x&Ext=%s) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\hp_administrator\my documents\downloads\nirsoft_package_1.06.09\NirSoft\astlog.exe (HackTool.Asterisk) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrator\my documents\downloads\nirsoft_package_1.06.09\NirSoft\chromepass.exe (Tool.PasswordViewer) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrator\my documents\downloads\nirsoft_package_1.06.09\NirSoft\dialupass.exe (Hacktool.Dialupass) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrator\my documents\downloads\nirsoft_package_1.06.09\NirSoft\iepv.exe (PUP.PSW.Passview) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrator\my documents\downloads\nirsoft_package_1.06.09\NirSoft\mspass.exe (PUP.PSW.MessenPass) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrator\my documents\downloads\nirsoft_package_1.06.09\NirSoft\passwordfox.exe (PUP.PSW.PassFox) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrator\my documents\downloads\nirsoft_package_1.06.09\NirSoft\produkey-x64.exe (PUP.PSWTool.ProductKey) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrator\my documents\downloads\nirsoft_package_1.06.09\NirSoft\produkey.exe (PUP.PSWTool.ProductKey) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrator\my documents\downloads\nirsoft_package_1.06.09\NirSoft\rdpv.exe (Password.Tool) -> Quarantined and deleted successfully.
0
grandms
Original Author
14 years ago
last modified: 9 years ago
Here are my startup programs:

WinPatrol
Avast5
ProcessLassoManagement
ProcessGovernor
OnlineArmorGUI
GoogleUpdate
HDDHealth
SecuniaPSI
0
zep516
14 years ago
last modified: 9 years ago
Yes take it to landzdown forum.
0
grandms
Original Author
14 years ago
last modified: 9 years ago
Could you post the link for me?
0
bob414
14 years ago
last modified: 9 years ago
Here's the link: analysis and malware removal.
0
bbbluz ~ DonnaB
14 years ago
last modified: 9 years ago
Hi grandms,

Here's the link below for the Analysis and Malware Removal Forum at LandzDown.

Did you install a program called NirSoft?

That is similar to this:
c:\documents and settings\Owner\desktop\utilities\ProduKey.exe (PUP.PSWTool.ProductKey)

PUP = potentially unsafe product
PSWTool.ProductKey = designed to access the passwords in your system.

The above was found to be a keylogger which is a password stealer that was found on a computer at another forum where I frequent. Malware will rename itself to hinder removal of.

Just curious as to if you had installed the program as I asked above.

Donna

Here is a link that might be useful: LandzDown
0
grandms
Original Author
14 years ago
last modified: 9 years ago
I do not recall downloading any NIRSOFT software. I could tell from the Malwarebytes log that it was all connected to that. I went ahead and registered at LansDown before I saw your post, but I did not know how to link to this post. However, I used the same topic and referred to it in my post, so hopefully someone there will be able to link to this.

Bedtime now, so I hope tomorrow brings a better day.
0
ravencajun Zone 8b TX
14 years ago
last modified: 9 years ago
the nirsoft product does often show up as infection but it is part of the product as is noted on their site.
password recovery tools
0
PKponder TX Z7B
14 years ago
last modified: 9 years ago
Hi grandms,
I know recreating a Windows profile sounds like a lot of work, but in reality only takes a bit of time. You can start copying your files and walk away while it's working. I probably do that 5 times times each day at work and it's easier (much easier) than reinstalling Windows. I'm glad you are getting help at Lanzdown ;-)

Pam
0
grandms
Original Author
14 years ago
last modified: 9 years ago
Raven, are you saying that what showed up in Malwarebytes as malicious is a false positive? I may very well have downloaded something from Nirsoft, as the name does seem familiar, but I do not recall doing so.

I'm off to visit Lanzdown now and see what the response may be to my post there.
0
ravencajun Zone 8b TX
14 years ago
last modified: 9 years ago
yes I have used many of the nirsoft utilities which will show as a false positive, the situation is that the technology they have to use to allow you to find your lost keys on your own pc are very similar to the technology that is used in trojan/virus to steal your info, the difference is that with the nirsoft tools no info is sent to anyone it does not connect to the internet it is just for you to use on your pc and capture the info you lost.
They make tools to find your wireless password, your router password, your outlook info, windows key, many many useful tools. when used by the pc user on their own pc they are then not malicious.

I do not know if all of what is showing in Malwarebytes is just nirsoft products but part of it looks as if it is.
That is why it list it as a PUP potentially unsafe product not as a Trojan. It is not a keylogger a keylogger is dangerous and sends out the info it captures to some one through an internet connection, nirsoft just finds it and gives it to you. I have used them and know many others that use their utilities. But if you no longer need the program the best thing to do is just after using it remove it so none of your AV programs will alert on it.
0
grandms
Original Author
14 years ago
last modified: 9 years ago
I cannot find anything by Nirsoft listed in Control Panel Add/Delete, nor is the company shown at all in the programs listed in Revo Uninstaller.

But I've changed all my passwords with any financial sites I use and will do whatever Corrine instructs me to do. Thankfully I have another computer where I could do the password changes.
0
grandms
Original Author
14 years ago
last modified: 9 years ago
Here I am. After much time and many scans and the wonderful help of Corrine at LanzDown, my computer is booting up normally. Lots of stuff removed, and some seemed to be just bits and pieces of things. I think I will always use Revo Uninstaller when uninstalling any program or application, so all the "junk" will not be left behind. While watching the scans, I realize I have lots of downloads that are old that I should delete, so I'll be slowly doing that work. I guess the next task is getting the December MS updates installed.

Thank you to everyone here, and a big hug to Corrine at LanzDown.
0
ravencajun Zone 8b TX
14 years ago
last modified: 9 years ago
I am glad you got it all done. LzD staff is wonderful so many great people working behind the scenes to help people, amazing folks.
0
grandms
Original Author
14 years ago
last modified: 9 years ago
I posted too soon. After posting here and downloading some e-mail, I installed 2 MS updates pertaining to IE8. This required a restart. When I tried to restart, the same thing happened all over again, so I don't know what to think.
0

Bootup will not finish

Comments (36)

Related Discussions

grandmsOriginal Author

grandmsOriginal Author

grandmsOriginal Author

grandmsOriginal Author

grandmsOriginal Author

grandmsOriginal Author

grandmsOriginal Author

grandmsOriginal Author

grandmsOriginal Author

grandmsOriginal Author

grandmsOriginal Author

grandmsOriginal Author

grandmsOriginal Author

grandmsOriginal Author

grandmsOriginal Author

grandmsOriginal Author

grandmsOriginal Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

grandms
Original Author

grandms
Original Author

grandms
Original Author

grandms
Original Author

grandms
Original Author

grandms
Original Author

grandms
Original Author

grandms
Original Author

grandms
Original Author

grandms
Original Author

grandms
Original Author

grandms
Original Author

grandms
Original Author

grandms
Original Author

grandms
Original Author

grandms
Original Author

grandms
Original Author