MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Reply
 
Thread Tools Display Modes
  #1  
Old 05-13-12, 10:40
saucer saucer is offline
Private First Class
 
Join Date: May 2010
Posts: 32
Thanks: 12
Thanked 0 Times in 0 Posts
Default Frequent XP crashes especially using usb ports

I am suspicious this problem which began about a week ago is being caused by malware. It can happen just when surfing but always when new devices, including printer is switched on. System restore will not work, but rather seems to terminate abruptly and sometimes cause BSOD. If not malware I suppose it could be a corrupt driver somewhere. I would very much appreciate any advice. All the scan logs are attached to this and the other post Many thanks
Attached Files
File Type: txt log.txt (23.1 KB, 1 views)
File Type: txt mbam-log-2012-05-12 (15-26-13).txt (3.9 KB, 1 views)
File Type: zip MGlogs.zip (196.3 KB, 2 views)

Last edited by saucer; 05-13-12 at 10:45..
Reply With Quote
Sponsored links
  #2  
Old 05-13-12, 10:41
saucer saucer is offline
Private First Class
 
Join Date: May 2010
Posts: 32
Thanks: 12
Thanked 0 Times in 0 Posts
Default Re: Frequent XP crashes especially using usb ports

Here's the other logs
Attached Files
File Type: txt RRlog.txt (860 Bytes, 1 views)
File Type: log SUPERAntiSpyware Scan Log - 05-12-2012 - 11-35-59.log (2.1 KB, 1 views)
Reply With Quote
  #3  
Old 05-13-12, 10:59
saucer saucer is offline
Private First Class
 
Join Date: May 2010
Posts: 32
Thanks: 12
Thanked 0 Times in 0 Posts
Default Re: Frequent XP crashes especially using usb ports

And another thing...
My homepage and search engine is repeatedly defaulting to Findamo.com which I don't recall downloading
Reply With Quote
  #4  
Old 05-13-12, 11:08
saucer saucer is offline
Private First Class
 
Join Date: May 2010
Posts: 32
Thanks: 12
Thanked 0 Times in 0 Posts
Default Re: Frequent XP crashes especially using usb ports

Here is the Gooredfix log
Attached Files
File Type: txt GooredFix.txt (2.3 KB, 2 views)
Reply With Quote
  #5  
Old 05-14-12, 13:30
thisisu's Avatar
thisisu thisisu is offline
Malware Consultant
 
Join Date: Apr 2006
Location: Houston, TX
Posts: 8,162
Thanks: 269
Thanked 1,434 Times in 1,355 Posts
Default Re: Frequent XP crashes especially using usb ports

Hello saucer

Your logs are pretty clean for the most part but we'll remove that unwanted search engine and some other junk that does not belong.
I think the BSODs when you insert a USB device may be caused by faulty hardware.

From Add/Remove Programs (via Control Panel), please uninstall the below:
  • Ask Toolbar
  • Java(TM) 6 Update 31

Please download Disable/Remove Windows Messenger to your desktop.
  • Double-click MessengerDisable.exe to run it.
  • Place checkmarks in "Uninstall Windows Messenger" and "Hide Messenger from Outlook Express"
  • Click Apply
  • Click Exit


Fixing items using ComboFix
Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop.
If it is not on your desktop, the below will not work.
According to your logs you ran it from the Downloads folder so move it over to Desktop before proceeding. Or just download a new copy to the desktop.
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Open Notepad and copy/paste the text in the below code box into Notepad:
Code:
KillAll::
DirLook::
c:\documents and settings\All Users\Application Data\bProtector
Driver::
cerc6
FireFox::
FF - ProfilePath - c:\documents and settings\Pat McGuinness\Application Data\Mozilla\Firefox\Profiles\hi8zhxew.default\
FF - prefs.js: keyword.url - hxxp://www.findamo.com/search.html?ch=9&q={searchTerms}
Folder::
c:\program files\Ask.com
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\EG969UV6
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\EG969UV6(2)
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\JCQ15NXR
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\JDR0Z0V1
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\JDR0Z0V1(2)
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\M2GW4TJ8
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\M2GW4TJ8(2)
C:\Documents and Settings\All Users\Uniblue
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-
[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state]
"startup"=dword:00000000
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}]
Suspect::[137]
c:\windows\system32\protector.dll
Save this file as CFScript.txt to your desktop. So now you should have both CFScript.txt and ComboFix.exe on your desktop.
Now use your mouse to drag CFScript.txt on top of ComboFix.exe and then release.

This will launch ComboFix.
Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Allow ComboFix to update itself if prompted.
When ComboFix finishes, a log will be produced at C:\ComboFix.txt
Attach this log to your next message. (How to attach)

I want you to read and follow these instructions: TDSSKiller - How to run

Now install the current version of Sun Java from here.

Now run C:\MGtools\GetLogs.bat by double-clicking it.
This updates all of the logs inside MGlogs.zip.
When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)
__________________
Facebook . Twitter . Blog . VirusTotal
Reply With Quote
The Following User Says Thank You to thisisu For This Useful Post:
saucer (05-18-12)
Sponsored links
  #6  
Old 05-17-12, 07:54
saucer saucer is offline
Private First Class
 
Join Date: May 2010
Posts: 32
Thanks: 12
Thanked 0 Times in 0 Posts
Default Re: Frequent XP crashes especially using usb ports

Thank you very much for the help.

I am having a problem getting ComboFix to work. It will start but apparently hang/stall at the point of the screen message, ComboFix is starting....It may have run through the first time tried, but I couldnt find a log.

I have switched off all antivirus and firewall. The computer is running slow at the moment because, I assume, the original problem.

I have reinstalled Java and done the other two scans and the logs are included.
Ask Toobar didn't show up in Add/Remove Programs...but I seem to be back to my original homepage, so fingers crossed.

I am still having crashes when I connect devices to any usb ports so will look into possibel software/hardware problems.

Please let me know whether you think I should persist with combofix or whether the logs are ok as they are.

Thanks again
Attached Files
File Type: txt TDSSKiller.2.7.34.0_17.05.2012_12.17.24_log.txt (210.9 KB, 1 views)
File Type: zip MGlogs.zip (224.3 KB, 2 views)
Reply With Quote
  #7  
Old 05-17-12, 10:49
thisisu's Avatar
thisisu thisisu is offline
Malware Consultant
 
Join Date: Apr 2006
Location: Houston, TX
Posts: 8,162
Thanks: 269
Thanked 1,434 Times in 1,355 Posts
Default Re: Frequent XP crashes especially using usb ports

Re-scan with TDSSKiller using the "Detect TDLFS File System" parameter just like before.
This time if TDSS File System appears, delete it!
Then attach the latest TDSSKiller log. (How to attach)

Can you retry the CFScript while in Safe Mode with Networking?
See: How to start your computer in Safe mode with Networking

Now it looks like you are infected although I'm not convinced that is 100% of the problem with this computer.
__________________
Facebook . Twitter . Blog . VirusTotal

Last edited by thisisu; 05-17-12 at 11:00..
Reply With Quote
The Following User Says Thank You to thisisu For This Useful Post:
saucer (05-18-12)
  #8  
Old 05-17-12, 18:20
saucer saucer is offline
Private First Class
 
Join Date: May 2010
Posts: 32
Thanks: 12
Thanked 0 Times in 0 Posts
Default Re: Frequent XP crashes especially using usb ports

I cannot get ComboFix to start properly even in safe mode
I have re-scanned with TDSS and deleted TDLFS File System
Attached Files
File Type: txt TDSSKiller.2.7.35.0_17.05.2012_23.38.14_log.txt (213.3 KB, 2 views)
Reply With Quote
  #9  
Old 05-17-12, 18:28
thisisu's Avatar
thisisu thisisu is offline
Malware Consultant
 
Join Date: Apr 2006
Location: Houston, TX
Posts: 8,162
Thanks: 269
Thanked 1,434 Times in 1,355 Posts
Default Re: Frequent XP crashes especially using usb ports

Ok, let's try with another tool. You can run this fix from Safe Mode too for a higher chance of success.

Fix items using OTL by OldTimer

Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Copy the text in the code box below and paste it into the text-field.
Code:
:files
c:\program files\Ask.com /d
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\EG969UV6 /d
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\EG969UV6(2) /d
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\JCQ15NXR /d
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\JDR0Z0V1 /d
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\JDR0Z0V1(2) /d
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\M2GW4TJ8 /d
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\M2GW4TJ8(2) /d
C:\Documents and Settings\All Users\Uniblue /d
dir /s "c:\documents and settings\All Users\Application Data\bProtector" /c
:reg
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-
[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state]
"startup"=dword:00000000
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}]
:commands
[emptytemp]
[resethosts]
Now click the button.
If the fix needed a reboot please do it.
Click the OK button (upon reboot).
When OTL is finished, Notepad will open. Close Notepad.
A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
Attach this log to your next message. (How to attach)

__

Afterwards, please submit this file: c:\windows\system32\protector.dll to here.

__


Now run C:\MGtools\GetLogs.bat by double-clicking it.
This updates all of the logs inside MGlogs.zip.
When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)
__________________
Facebook . Twitter . Blog . VirusTotal
Reply With Quote
The Following User Says Thank You to thisisu For This Useful Post:
saucer (05-18-12)
  #10  
Old 05-18-12, 13:41
saucer saucer is offline
Private First Class
 
Join Date: May 2010
Posts: 32
Thanks: 12
Thanked 0 Times in 0 Posts
Default Re: Frequent XP crashes especially using usb ports

All done...OTL worked fine
Attached Files
File Type: log 05182012_184809.log (20.0 KB, 2 views)
File Type: zip MGlogs.zip (247.7 KB, 2 views)
Reply With Quote
Sponsored links
  #11  
Old 05-18-12, 14:39
thisisu's Avatar
thisisu thisisu is offline
Malware Consultant
 
Join Date: Apr 2006
Location: Houston, TX
Posts: 8,162
Thanks: 269
Thanked 1,434 Times in 1,355 Posts
Default Re: Frequent XP crashes especially using usb ports

Let's get rid of some additional items and then let me know how the system is running.

Fix items using OTL by OldTimer

Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Copy the text in the code box below and paste it into the text-field.
Code:
:processes
killallprocesses
:files
c:\windows\system32\protector.dll
C:\WINDOWS\Tasks\*.job /d
c:\documents and settings\All Users\Application Data\bProtector
dir /s "c:\documents and settings\All Users\Application Data\Trusteer" /c
:reg
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""
Now click the button.
If the fix needed a reboot please do it.
Click the OK button (upon reboot).
When OTL is finished, Notepad will open. Close Notepad.
A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
Attach this log to your next message. (How to attach)
__________________
Facebook . Twitter . Blog . VirusTotal
Reply With Quote
The Following User Says Thank You to thisisu For This Useful Post:
saucer (05-18-12)
  #12  
Old 05-18-12, 15:02
saucer saucer is offline
Private First Class
 
Join Date: May 2010
Posts: 32
Thanks: 12
Thanked 0 Times in 0 Posts
Default Re: Frequent XP crashes especially using usb ports

Here we go
Attached Files
File Type: log 05182012_205605.log (261.5 KB, 1 views)
Reply With Quote
  #13  
Old 05-18-12, 17:32
saucer saucer is offline
Private First Class
 
Join Date: May 2010
Posts: 32
Thanks: 12
Thanked 0 Times in 0 Posts
Default Re: Frequent XP crashes especially using usb ports

Unfortunately system still crashing as before...which probably points to the hardware problem you suggested...I am thinking XP reinstall now...would you agree?
Reply With Quote
  #14  
Old 05-18-12, 18:09
thisisu's Avatar
thisisu thisisu is offline
Malware Consultant
 
Join Date: Apr 2006
Location: Houston, TX
Posts: 8,162
Thanks: 269
Thanked 1,434 Times in 1,355 Posts
Default Re: Frequent XP crashes especially using usb ports

Quote:
Originally Posted by saucer View Post
Unfortunately system still crashing as before...which probably points to the hardware problem you suggested...I am thinking XP reinstall now...would you agree?
You know that reinstalling means that everything gets deleted (unless you back up the data before hand)?

While it may be a good idea to reinstall (keeping in mind that everything on the system will be removed!), this won't fix hardware related problems if they are present.
__________________
Facebook . Twitter . Blog . VirusTotal
Reply With Quote
The Following User Says Thank You to thisisu For This Useful Post:
saucer (05-21-12)
  #15  
Old 05-21-12, 13:21
saucer saucer is offline
Private First Class
 
Join Date: May 2010
Posts: 32
Thanks: 12
Thanked 0 Times in 0 Posts
Default Re: Frequent XP crashes especially using usb ports

I have the system backed up from a few weeks ago ( via Windows Backup) so shouldn't lose much.

This is probably a question for another forum but is there a less dramatic way of checking the hardware that you know of. I have used Everest and everything incl temperatures looks ok to me.

Anyway thank you so much for the help in effectively ruling malware as the main culprit
Reply With Quote
Sponsored links
  #16  
Old 05-21-12, 13:47
thisisu's Avatar
thisisu thisisu is offline
Malware Consultant
 
Join Date: Apr 2006
Location: Houston, TX
Posts: 8,162
Thanks: 269
Thanked 1,434 Times in 1,355 Posts
Default Re: Frequent XP crashes especially using usb ports

Quote:
Originally Posted by saucer View Post
This is probably a question for another forum but is there a less dramatic way of checking the hardware that you know of.
Hehe hard to say if it would be dramatic for you since I do not know your knowledge level on computers but a couple of things I'd do first would be to check for busted, bulging, or leaking capacitors on the motherboard. Also look for broken USB ports.

You can get more help on this in the Hardware forum.

Quote:
Originally Posted by saucer View Post
Anyway thank you so much for the help in effectively ruling malware as the main culprit
My pleasure. Be safe

If you are not having any other malware problems, it is time to do our final steps:
  1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
  2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
    • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
    • "%userprofile%\Desktop\combofix" /uninstall
      • Notes: The space between the combofix" and the /uninstall, it must be there.
      • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
  3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
  4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
  5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
  6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
  7. Go to add/remove programs and uninstall HijackThis if it present
  8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
    related to MGtools and some other items from our cleaning procedures.
  9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
    • Refer to the cleaning procedures pointed to by step 7 of the READ ME
      for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
    • Then reboot and Enable System Restore to create a new clean Restore Point.
  10. After doing the above, you should work through the below link:
__________________
Facebook . Twitter . Blog . VirusTotal
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Need help with frequent popups in IE msh93 Malware Removal 5 02-04-08 14:04
frequent disconnects? saraveza408 Hardware 2 10-24-06 20:16
Frequent lag-outs havok123 Hardware 0 07-14-05 14:40
Frequent popups catracha0929 Malware Removal 3 07-09-05 11:27
Frequent Error nino Software 3 07-05-05 16:27


All times are GMT -5. The time now is 22:06.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger