comp won't display anything past windows loading screen. can load in safe mode

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Tork, Sep 3, 2006.

  1. Tork

    Tork Private E-2

    The computer loads normally but as soon as the windows loading screen disappears the screen stays blank.

    It will boot it in safe mode, and i have run adaware, spybot and malicious software removal all to no avail.

    Also, when booted in safe mode with networking i cannot view the network connections or connect to the local network.

    The user profile box opens but is just a white box below the title bar.

    Any help would be greatly appreciated
     
  2. Tork

    Tork Private E-2

    added HJT log

    can't run bd or pandascan because am unable to connect to the net.
    haven't run getrunkey or shownew because i can't boot into normal mode as suggested in the readme thread
     

    Attached Files:

  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: added HJT log

    Based on only a HijackThis log, all I can give you is the below which may or may not help.
    Make sure viewing of hidden files is enabled (per the tutorial).

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - Default URLSearchHook is missing
    O4 - HKLM\..\Run: [SP-SampleReports] spsr.exe
    O4 - HKLM\..\RunOnce: [bte] dfmo.exe

    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete
    :
    C:\Windows\System32\spsr.exe (also look for and delete C:\Windows\spsr.exe )
    C:\Windows\System32\dfmo.exe (also look for and delete C:\Windows\dfmo.exe )
    If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

    Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
    Now run Ccleaner (installed while running the READ ME FIRST)
    .

    Now we need to Reset Web Settings:
    1. If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
    2. Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
    3. If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.
    Note for IE 7 users: You need to select Internet Options then the Advanced tab and then Reset Internet Explorer Settings!


    Now reboot in normal mode

    If you can now boot properly, run all steps in the READ ME from beginning to end.

    Attach a new HJT log (and all other logs from the READ ME if you can run it). Attach a ShowNew log even if it has to be from safe mode.


    Make sure you tell me how things are working now.

    Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.
     
  4. Tork

    Tork Private E-2

    I ran through those steps but am still unable to load in normal mode.

    I could not find these files in either location.
    C:\Windows\System32\spsr.exe (also look for and delete C:\Windows\spsr.exe )
    C:\Windows\System32\dfmo.exe (also look for and delete C:\Windows\dfmo.exe )

    posted HJT and newfiles logs, both still from safe mode.
     

    Attached Files:

  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: added HJT log

    You should rename HijackThis.exe as requested in step 7 of the READ ME otherwise somethings could be hiding. Right now you show now signs of malware. I would suggest completely uninstalling your Symantec Security Suite and see what happens. It seems to be broken anyway.


    I would have HJT fix the below lines though:
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
    O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
     
  6. Tork

    Tork Private E-2

    renamed hjt and removed those entries, new log attached.

    norton won't allow removal in safe mode, the uninstaller exits saying restart in safe mode.
     

    Attached Files:

  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your HJT log is clean!

    Perhaps the below will remove it for you:

    Norton Removal Tool (SymNRT)


    If that does not work, then give this a try:

    Your Uninstaller! 2006
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds