Blank pop up box, locked machine

Discussion in 'Malware Help (A Specialist Will Reply)' started by jojov, Apr 8, 2005.

  1. jojov

    jojov Private E-2

    I'm using 3 spyware tools but am still plagued by a plain white box that comes up after I've left my machine idle for a few hours. It appears to have a button that would say "close" but it is also blank. The PC is non-responsive despite mouse movement. Only a hard pwr off gets me out of trouble each time.

    Windows 98se, PII MMX 800 Mhz.

    Any suggestions? I have a HiJack This log available if requested.

    Thanks,

    Joe
     
  2. jowolf359

    jowolf359 Private E-2

    Welcome to the forum! That HJT log would help, post it as an attachment. And make sure it is the days you post it, and run the scan from the HJT folder in program files, not the desktop, please.
     
  3. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    HJT is not the first step in removing Malware. We have guidelines that MUST be followed first.

    jojov,

    First, please follow ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

    After doing ALL of the above if you still have a problem:


    http://www.majorgeeks.com/images/grenade.gif Download HijackThis 1.99.1

    http://www.majorgeeks.com/images/grenade.gif Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

    http://www.majorgeeks.com/images/grenade.gif Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

    http://www.majorgeeks.com/images/grenade.gifBefore running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

    http://www.majorgeeks.com/images/grenade.gifRun HijackThis and save your log file.

    http://www.majorgeeks.com/images/grenade.gif Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

    http://www.majorgeeks.com/images/grenade.gifNeed help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting
     
  4. jojov

    jojov Private E-2

    I shall run through the standard cleanup routine mentioned in this thread. I'll see if problems continue afterward and will post a follow-up. Thank you both for your replies.

    ...joe
     
  5. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    After you do all of the steps in the READ ME post a current HJT log to confirm your clean.

    Bj
     
  6. jojov

    jojov Private E-2

    Hello,

    I ran through all the tools again (as I did b4 posting) but changed one thing. The TeaTimer in SpyBot started to show up as creating page fault memory errors after this round of scanning. I turned TeaTimer off and let the machine set for a couple days to replicate the issue. THAT problem nor the original problem have returned (probably related). I may be out of the woods.

    Per BJG's suggestion, I am posting a fresh HJT log (as attachment) for one last look.

    Thank you both for your assistance.

    - jojov
     

    Attached Files:

  7. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Scan with HijackThis and Check the Boxes for the following:

    R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)

    O4 - Startup: Shortcut to Cookie Cleanup.bat.pif = C:\MYDOCU~1\BATCHF~1\COOKIE~1.BAT

    O16 - DPF: {C74190B6-8589-11D1-B16A-00C0F0283628} (Microsoft TreeView Control 6.0 (SP4)) - http://sipnet.stateindustrial.com/CAB Files/mscomctl.cab
    O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab

    Make sure All Browser Windows are Closed when you Click FIX.

    NEXT:
    Run CCleaner

    FINAL STEP

    Reset Web Settings & Default Security Settings:


    To Reset Web Settings:
    Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

    If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


    To Default Security Settings:
    Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.
     
  8. jojov

    jojov Private E-2

    I've done as you suggested and ran another HJT log to confirm the issues you decribed were, in fact, gone. All looks good.

    Thanks again for all your help.
     
  9. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    So everything is ok at the moment, no further problems?
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds