Problems with restarting (rebooting) computer

Discussion in 'Malware Help (A Specialist Will Reply)' started by flasunshine, Mar 31, 2006.

  1. flasunshine

    flasunshine Private E-2

    Hi! Back again to my favorite guys!

    About a week ago, my husband was working on our desktop computer and experienced a session of non-stop, repeated Norton mail virus checks. They kept popping up one after the other, but it only happened when logged into his profile on the computer. We finally got them to stop. Shortly after that, I experienced a problem with restarting the computer; simply put, it wouldn't restart, it just went to a blank screen with a cursor blinking at the top. After I cntl-alt-deleted two times, I got a message that the computer couldn't be rebooted and that I needed to mark this checkpoint and contact Dell. I was able to get it to reboot by turning it off and leaving it powered off for a few minutes. I did some virus/spyware cleanup, and it seemed to be ok until last night. It has acted 'quirky' ever since (sound coming and going, slower startup, etc.) and last night I tried to restart and had the same problem reoccur to the point where I got the same error message AND a message that said "keyboard" failure. The only way I was able to get to reboot was to go into startup mode and then enter the computer from there. I'm a'feared I've got a virus/malware problem, so here I am!

    Here is what I have done so far. All scans were done in regular mode, as I haven't turned the computer off since last night for fear I wouldn't be able to get it to boot up again.

    I have run ALL the scans on the READ & RUN ME FIRST stick thread. I have attached the bitdefender log, the pandascan log, and the Hijack this log.

    I am running a Dell Dimension 4550 with a Pentium 4 and 512 RAM. with Microsoft Windows XP Home edition Version 2002, service pack 2.

    Any help with what this problem might be will be greatly appreciated.
     

    Attached Files:

    flasunshine, Mar 31, 2006
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You seem to have each user account on the PC infected. You really should clean each user account. You should run all steps accept step 6 on all other user accounts.

    Goto Add/Remove programs and uninstall Viewpoint Manager and Viewpoint Player or similar as requested in step 0 of the READ ME.

    Did you install some kind of URL bookmarking program? Is that what the below is?
    C:\Documents and Settings\Leslie\Desktop\remark.exe

    Now copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure viewing of hidden files is enabled (per the tutorial).
    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    Is the below hotsheet.com URL the expected Start Page? If so, skip the RO line.
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotsheet.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
    O4 - HKCU\..\Run: [LDM] \Program\
    O16 - DPF: {09C6CAC0-936E-40A0-BC26-707480103DC3} (shizmoo Class) - http://www.uproar.com/applets/activex/shizmoo/flipside_web18.cab
    O18 - Protocol: bw+0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw+0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: bwg0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwg0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0s - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: offline-8876480 - {40C80076-B5C6-474B-93A1-2F61CE8BA787} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete:
    C:\Documents and Settings\AJ\Local Settings\Temp\conscorr.inf <--- delete all files in this Temp folder
    C:\Documents and Settings\AJ\Local Settings\Temp\conscorr.ini
    C:\Documents and Settings\Alan\Local Settings\Temp\alchem.inf <--- delete all files in this Temp folder
    C:\Documents and Settings\Alan\Local Settings\Temp\alchem.ini
    C:\Documents and Settings\Alan\Local Settings\Temp\conscorr.inf
    C:\Documents and Settings\Alan\Local Settings\Temp\conscorr.ini
    C:\Documents and Settings\Alan\Local Settings\Temp\Cookies\alan@kinghost[2].txt
    C:\Documents and Settings\Alan\Local Settings\Temp\THI2FAA.tmp\twaintec.inf
    C:\Documents and Settings\Alan\Local Settings\Temp\THI3210.tmp\twaintec.inf
    C:\Documents and Settings\Alan\Local Settings\Temp\THI8.tmp\localNrd.inf
    C:\Documents and Settings\Leslie\Application Data\tvmknwrd.dll
    C:\Documents and Settings\Ryan.FAMILY\Local Settings\Temp\conscorr.inf <--- delete all files in this Temp folder
    C:\Documents and Settings\Ryan.FAMILY\Local Settings\Temp\conscorr.ini
    C:\WINDOWS\SYSTEM32\downloader_mind_silent.exe
    C:\WINDOWS\SYSTEM32\Agent.dll
    C:\WINDOWS\SYSTEM32\stlb2.xml
    C:\WINDOWS\SYSTEM32\sub.dll
    C:\WINDOWS\SYSTEM\rules.dat
    C:\WINDOWS\sepsd.bin
    C:\PROGRAM FILES\dialers <--- delete this folder or file
    C:\PROGRAM FILES\COMMON FILES\midaddle <--- delete this folder
    C:\TEMP\FLEOK <--- delete this folder or file

    The below may be demo games some one downloaded. But they appear to have adware! Consider deleting them unless really needed.
    C:\Downloads\MLBPlayballSetup-dm[1].exe
    C:\Downloads\tw2Setup-dm[1].exe
    C:\Downloads\WordJongInstall-dm[1].exe

    If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

    Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
    Now run Ccleaner (installed while running the READ ME FIRST).

    Now reboot in normal mode and post a new HJT log.

    Make sure you tell me how things are working now.

    Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.
     
    chaslang, Mar 31, 2006
    #2

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds