Frequent XP crashes especially using usb ports

[saucer]

I am suspicious this problem which began about a week ago is being caused by malware. It can happen just when surfing but always when new devices, including printer is switched on. System restore will not work, but rather seems to terminate abruptly and sometimes cause BSOD. If not malware I suppose it could be a corrupt driver somewhere. I would very much appreciate any advice. All the scan logs are attached to this and the other post Many thanks

[saucer]

Here's the other logs

[saucer]

And another thing...
My homepage and search engine is repeatedly defaulting to Findamo.com which I don't recall downloading

[saucer]

Here is the Gooredfix log

[thisisu]

Hello saucer

Your logs are pretty clean for the most part but we'll remove that unwanted search engine and some other junk that does not belong.
I think the BSODs when you insert a USB device may be caused by faulty hardware.

From Add/Remove Programs (via Control Panel), please uninstall the below:

• Ask Toolbar
• Java(TM) 6 Update 31

Please download Disable/Remove Windows Messenger to your desktop.

• Double-click MessengerDisable.exe to run it.
• Place checkmarks in "Uninstall Windows Messenger" and "Hide Messenger from Outlook Express"
• Click Apply
• Click Exit

Fixing items using ComboFix
Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop.
If it is not on your desktop, the below will not work.
According to your logs you ran it from the Downloads folder so move it over to Desktop before proceeding. Or just download a new copy to the desktop.
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Open Notepad and copy/paste the text in the below code box into Notepad:

KillAll::
DirLook::
c:\documents and settings\All Users\Application Data\bProtector
Driver::
cerc6
FireFox::
FF - ProfilePath - c:\documents and settings\Pat McGuinness\Application Data\Mozilla\Firefox\Profiles\hi8zhxew.default\
FF - prefs.js: keyword.url - hxxp://www.findamo.com/search.html?ch=9&q={searchTerms}
Folder::
c:\program files\Ask.com
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\EG969UV6
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\EG969UV6(2)
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\JCQ15NXR
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\JDR0Z0V1
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\JDR0Z0V1(2)
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\M2GW4TJ8
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\M2GW4TJ8(2)
C:\Documents and Settings\All Users\Uniblue
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-
[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state]
"startup"=dword:00000000
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}]
Suspect::[137]
c:\windows\system32\protector.dll

Save this file as CFScript.txt to your desktop. So now you should have both CFScript.txt and ComboFix.exe on your desktop.
Now use your mouse to drag CFScript.txt on top of ComboFix.exe and then release.

This will launch ComboFix.
Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Allow ComboFix to update itself if prompted.
When ComboFix finishes, a log will be produced at C:\ComboFix.txt
Attach this log to your next message. (How to attach)

I want you to read and follow these instructions: TDSSKiller - How to run

Now install the current version of Sun Java from here.

Now run C:\MGtools\GetLogs.bat by double-clicking it.
This updates all of the logs inside MGlogs.zip.
When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)

[saucer]

Thank you very much for the help.

I am having a problem getting ComboFix to work. It will start but apparently hang/stall at the point of the screen message, ComboFix is starting....It may have run through the first time tried, but I couldnt find a log.

I have switched off all antivirus and firewall. The computer is running slow at the moment because, I assume, the original problem.

I have reinstalled Java and done the other two scans and the logs are included.
Ask Toobar didn't show up in Add/Remove Programs...but I seem to be back to my original homepage, so fingers crossed.

I am still having crashes when I connect devices to any usb ports so will look into possibel software/hardware problems.

Please let me know whether you think I should persist with combofix or whether the logs are ok as they are.

Thanks again

[thisisu]

Re-scan with TDSSKiller using the "Detect TDLFS File System" parameter just like before.
This time if TDSS File System appears, delete it!
Then attach the latest TDSSKiller log. (How to attach)

Can you retry the CFScript while in Safe Mode with Networking?
See: How to start your computer in Safe mode with Networking

Now it looks like you are infected although I'm not convinced that is 100% of the problem with this computer.

[saucer]

I cannot get ComboFix to start properly even in safe mode
I have re-scanned with TDSS and deleted TDLFS File System

[thisisu]

Ok, let's try with another tool. You can run this fix from Safe Mode too for a higher chance of success.

Fix items using OTL by OldTimer

Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Copy the text in the code box below and paste it into the text-field.

:files
c:\program files\Ask.com /d
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\EG969UV6 /d
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\EG969UV6(2) /d
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\JCQ15NXR /d
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\JDR0Z0V1 /d
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\JDR0Z0V1(2) /d
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\M2GW4TJ8 /d
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\M2GW4TJ8(2) /d
C:\Documents and Settings\All Users\Uniblue /d
dir /s "c:\documents and settings\All Users\Application Data\bProtector" /c
:reg
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-
[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state]
"startup"=dword:00000000
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}]
:commands
[emptytemp]
[resethosts]

Now click the button.
If the fix needed a reboot please do it.
Click the OK button (upon reboot).
When OTL is finished, Notepad will open. Close Notepad.
A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
Attach this log to your next message. (How to attach)

__

Afterwards, please submit this file: c:\windows\system32\protector.dll to here.

__


Now run C:\MGtools\GetLogs.bat by double-clicking it.
This updates all of the logs inside MGlogs.zip.
When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)

[saucer]

All done...OTL worked fine

[thisisu]

Let's get rid of some additional items and then let me know how the system is running.

Fix items using OTL by OldTimer

Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Copy the text in the code box below and paste it into the text-field.

:processes
killallprocesses
:files
c:\windows\system32\protector.dll
C:\WINDOWS\Tasks\*.job /d
c:\documents and settings\All Users\Application Data\bProtector
dir /s "c:\documents and settings\All Users\Application Data\Trusteer" /c
:reg
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""

Now click the button.
If the fix needed a reboot please do it.
Click the OK button (upon reboot).
When OTL is finished, Notepad will open. Close Notepad.
A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
Attach this log to your next message. (How to attach)

[saucer]

Here we go

[saucer]

Unfortunately system still crashing as before...which probably points to the hardware problem you suggested...I am thinking XP reinstall now...would you agree?

[thisisu]

Originally Posted by saucer

Unfortunately system still crashing as before...which probably points to the hardware problem you suggested...I am thinking XP reinstall now...would you agree?

You know that reinstalling means that everything gets deleted (unless you back up the data before hand)?

While it may be a good idea to reinstall (keeping in mind that everything on the system will be removed!), this won't fix hardware related problems if they are present.

[saucer]

I have the system backed up from a few weeks ago ( via Windows Backup) so shouldn't lose much.

This is probably a question for another forum but is there a less dramatic way of checking the hardware that you know of. I have used Everest and everything incl temperatures looks ok to me.

Anyway thank you so much for the help in effectively ruling malware as the main culprit

[thisisu]

Originally Posted by saucer

This is probably a question for another forum but is there a less dramatic way of checking the hardware that you know of.

Hehe hard to say if it would be dramatic for you since I do not know your knowledge level on computers but a couple of things I'd do first would be to check for busted, bulging, or leaking capacitors on the motherboard. Also look for broken USB ports.

You can get more help on this in the Hardware forum.

Originally Posted by saucer

Anyway thank you so much for the help in effectively ruling malware as the main culprit

My pleasure. Be safe

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work through the below link:
    • How to Protect yourself from malware!