[rshaffer61]

If it did and didn't stop then it repaired whatever it was.
Try this and see if it is located there:

If you want to see what was replaced, right click My Computer > manage, expand event viewer > system.

[Advertisements]

Looks like a couple hundred lines of this:

Attached Thumbnails

• 

[6stringer]

Looks like a couple hundred lines of this:

Attached Thumbnails

• 

[rshaffer61]

Lets try to get a better look at this.

• Please download the Event Viewer Tool by Vino Rosso VEW and save it to your Desktop:
• Double-click VEW.exe
• Under 'Select log to query', select (as appropriate):
  
  • Application
  • System
• Under 'Select type to list', select (as appropriate):
  
  • Error
  • Information
  • Warning

Then use the 'Date of events' or 'Number of events' as follows:

Either:

• Click the radio button for 'Number of events'
  Type 3 in the 1 to 20 box (or any number from 1 to 20)
  Then click the Run button.
  Notepad will open with the output log.
  
  
• Click the radio button for 'Date of events'
  In the From: boxes type today's date (presuming the crash happened today) 22 11 2010
  In the To: boxes type today's date (presuming the crash happened today) 22 11 2010
  Then click the Run button.
  Notepad will open with the output log.

Please post the Output log in your next reply

[6stringer]

Here are the scans

Attached Files

•  VEW date of events.txt   1007bytes   211 downloads
•  VEW number of events.txt   3.91KB   222 downloads

[rshaffer61]

Wow that was of little use for sure.
OK I'm going to go back to something you said earlier and see if that might help us. .
When we first started all this you said the issue doesn't happen when you are in safe mode.
This in itself would indicate a driver issue or a startup entry causing the problem.
So what I want to try is this:

Lets see what you have in your startup

Please click on
Start and then to Run
Type in msconfig and press Enter
Now click on Startups
Then uncheck everything and restart.
IMPORTANT! In case of laptop, make sure, you do NOT disable any keyboard, or touchpad entries.
If system runs the full scan now correctly and is running smoothly then we have a startup problem
Try going back into msconfig and check one item and reboot
Keep doing that till you have found the problem or all are finally checked.
Post back with the results

[6stringer]

I need to locate a wired usb mouse and keyboard. I'm afraid if I disable the wireless Logitech mouse & keyboard software that is running I won't be able to do anything you suggested.

Since we started all of this I have not been able to completely start in Safe Mode. It will load to a point where I have to click the mouse on the "Owner" icon which I cannot do because the wireless mouse is disabled.

[rshaffer61]

Does your system have connections for a standard PS2 KB and mouse?
Using them would guarantee it will work unless there is a problem with the MOBO itself.

[6stringer]

Yes, I have the std connections. I just don't happen to have the keyboard and mouse on hand. When I upgraded to wireless I got rid of my old equipment. I need a day or so to round up a KB and mouse.
Thank you for all of your time and patience.

[rshaffer61]

No problem and we will continue to monitor this topic for your return and hopefully successful resolution.

[6stringer]

Finally got a full scan of MalwareBytes!

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Database version: 5264

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/8/2010 6:00:48 AM
mbam-log-2010-12-08 (06-00-48).txt

Scan type: Full scan (A:\|C:\|D:\|E:\|F:\|)
Objects scanned: 282083
Time elapsed: 3 hour(s), 1 minute(s), 13 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\Owner\desktop\utilities\ProduKey.exe (PUP.PSWTool.ProductKey) -> Quarantined and deleted successfully.

[DonnaB]

6stringer and rshaffer61,

Oh that is wonderful!

I found the following concerning the entry that MBAM found, quarantined and deleted.

c:\documents and settings\Owner\desktop\utilities\ProduKey.exe (PUP.PSWTool.ProductKey)

PUP = potentially unsafe product
PSWTool.ProductKey = designed to access the passwords in your system.

I feel it would be in your best interest to go to our Malware and Spyware Cleaning Guide, run the scans and post in our Virus, Spyware, Malware Removal Forum.

This is a relatively new type of malware from what I found. And who knows what may be lurking behind the scenes that MBAM has not found.

If you do any kind of banking on that computer, please notify your financial institutions immediately and change all your passwords to your accounts using a different uninfected computer.

Donna

[rshaffer61]

I would have to agree with DonnaB here. Even though MBAM shows it took care of the problem, i would be nervous because of the potential of this infection to allow access to your stored passwords. I would follow her suggestion and have your system looked at deeper by our malware staff to make sure any remnants are indeed gone. Once they have declared you healthy then return here if your issue still is happening.

[6stringer]

OK thanks. I posted this in the virus forums and am waiting on someone there to respond.