system reboot on virus scan

fishtank · Apr 23, 2007

Hello. I have been having similar problems as the person on this thread.
I followed the instructions on READ&RUN1st very carefully.
cclean- worked.
spybot- worked fine, got rid of a buttload of crud.
counterspy- reboot halfway through scan
bitdefend- reboot
panda-reboot
getrun- error message
shownew-worked, but seemed to stall. I waited a 1/2 hr, but that log was all I got.
hijack- log posted.

notes*
-I first discovered the problem when I recently tried to install security software (ezarmor) from my roadrunner account. The software would start to load, and the comp would reboot, and was caught in that loop.
-I cannot disable system resore
-This wordpad document is open on desktop upon reboot:
[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787
- My comp is a HP pavilion 304w running XP. In December I installed a new hard drive and kept the old as a slave. Would the slave be infected also?
Any help would be much appreciated.

chaslang · Apr 24, 2007

Welcome to Major Geeks!

fishtank said: ↑

getrun- error message
Click to expand...

Please be specific. Tell me the exact word for word error message.

Are you referring to this?

Error: The system was unable to find the specified registry key or value
Click to expand...

If so, just ignore it and wait for the program to finish running. That message is just an indication that a particular registry key we are checking for is missing. It is not important. A notepad window should popup with the runkeys.txt log in it when the scan is finished.

fishtank said: ↑

shownew-worked, but seemed to stall. I waited a 1/2 hr, but that log was all I got.[/quote You're right! It seems to have not completed. There may be a problem accessing your registry which may also be the reason for having problems with GetRunKey since it is primarily accessing the registry.

fishtank said: ↑

-I cannot disable system resore
Click to expand...

You should not be trying to do that anyway. It may be needed to fix your problem by restoring to a date before the problems started.

fishtank said: ↑

--This wordpad document is open on desktop upon reboot:
[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787
- My comp is a HP pavilion 304w running XP. In December I installed a new hard drive and kept the old as a slave. Would the slave be infected also?
Any help would be much appreciated.
Click to expand...

This is not malware! I don't know if your slave would be infected at this point. In fact I don't even know for a fact that your main drive is infected. Well let me reword that! You show signs of left overs from infections, but they don't look active. However note that the only two logs posted at this time are not giving me enough information to really know what its going on. See if you can get the below to run.

Now please download F-Secure's BlacklightBeta

Download fsbl.exe and save it to the Desktop.

Once saved... double click fsbl.exe to install the program.

Click accept agreement and Click scan

This application may trigger a warning from your antivirus. Let the driver load. Wait for it to finish.

If it displays any items...don't do anything with them yet. Just hit exit (close)

It will drop a log on Desktop that starts with fsbl....big number

Please attach the BlackLight log.

Click to expand...

Log in or Sign up

system reboot on virus scan

fishtank Private E-2

Attached Files:

newfiles.txt

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member