[Demian32]

This PC is getting one or multiple blue screens, at first primarily when opening Internet Explorer 6.0 SP1 or Outlook 2000 SR1. Also when shutting down. Occasionally it will just reboot, not necessarlly associated with any particular application.

I followed the instructions prior to post as well as the following:
I have updated both and windows 98 SE.
Norton AntiVirus is up to date and scanned.
Windows SCANDISC and disc defrag.
Windows disk cleanup.


Activescan came up with: Virus:Application/Restart No disinfected C:\WINDOWS\SYSTEM\Tools\Restart.exe I deleted this file.

Thank you in advance for your time and assistance.

Demian



Logfile of HijackThis v1.99.1
Scan saved at 05:45:44 PM, on 6/16/2005
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\NOVELL\CLIENT32\NWRECMSG.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\IWP\NPFMNTOR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
c:\windows\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\RUNSERVICE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\COMMON FILES\INTUIT\QUICKBOOKS\QBUPDATE\QBUPDATE.EXE
C:\PROGRAM FILES\ADOBE\ACROBAT 4.0\DISTILLR\ACROTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SNDSRVC.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\WINWORD.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\MY DOCUMENTS\TECH\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.favaca.org/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CriticalUpdate] c:\windows\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE
O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [NPFMonitor] c:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [LicCtrl] runservice.exe
O4 - Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = favaca.org
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 216.173.160.6,216.173.160.20

[Advertisements]

I am begining to recognize simmilar symptoms on another PC on the network leading me to believe this is a virus vs. just Mal ware.

Any advice would be appreicated!

Thanks

[Demian32]

I am begining to recognize simmilar symptoms on another PC on the network leading me to believe this is a virus vs. just Mal ware.

Any advice would be appreicated!

Thanks

[Metallica]

Hi Demian,

I don't see any obvious malware running.

Can you post some of the errors you get.

One thing you can always try:
Click Start, point to Programs, point to Accessories, point to System Tools, click System Information, and then click System File Checker on the Tools menu.
Click the following option: Scan For Altered Files

That will establish if there is a file-infecting virus at work.

Regards,

[Demian32]

wow, yeah, there are several files

mfcuia32.dll
setupx.dll
mfc30.dll

still going....

can i restore from the cab / windows files?

[Demian32]

mfcans32.dll
and
mfco30.dll

were the last of 5 total files.

Errors:

Basicly it is windows blue sreens, page defauls at x location. I will post exact text.

also

Black screen with cursor only. no responce to keyboard. - hard reboot.

Perhaps the 5 restored files will be able to solve this? I imagine that I will need to identify if this was a virus and other files that may be affected?

[Metallica]

Replacing the files will probably be enough.

If you click Extract One File From Installation Disk, you can specify the file you want to extract.
You can find some info howto here:
http://service1.syma...001011114021106

Regards,

[Demian32]

I have replaced the files and I am testing the two systems affected. The second had 12 files.

Thank you for your help.

[Metallica]

No problem. Keep me posted.

[Demian32]

It looks like that did it. I realy appreciate yoru help! Thank you! I will keep the SFC in mind for the future.

Best regards,

Demian

[Metallica]

My pleasure.

Please have a look at my site for some tips on how to remove and prevent spyware.

Regards,