Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Application/Reboot


  • Please log in to reply

#1
Demian32

Demian32

    New Member

  • Member
  • Pip
  • 7 posts
This PC is getting one or multiple blue screens, at first primarily when opening Internet Explorer 6.0 SP1 or Outlook 2000 SR1. Also when shutting down. Occasionally it will just reboot, not necessarlly associated with any particular application.

I followed the instructions prior to post as well as the following:
I have updated both and windows 98 SE.
Norton AntiVirus is up to date and scanned.
Windows SCANDISC and disc defrag.
Windows disk cleanup.


Activescan came up with: Virus:Application/Restart No disinfected C:\WINDOWS\SYSTEM\Tools\Restart.exe I deleted this file.

Thank you in advance for your time and assistance.

Demian



Logfile of HijackThis v1.99.1
Scan saved at 05:45:44 PM, on 6/16/2005
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\NOVELL\CLIENT32\NWRECMSG.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\IWP\NPFMNTOR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
c:\windows\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\RUNSERVICE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\COMMON FILES\INTUIT\QUICKBOOKS\QBUPDATE\QBUPDATE.EXE
C:\PROGRAM FILES\ADOBE\ACROBAT 4.0\DISTILLR\ACROTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SNDSRVC.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\WINWORD.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\MY DOCUMENTS\TECH\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.favaca.org/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CriticalUpdate] c:\windows\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE
O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [NPFMonitor] c:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [LicCtrl] runservice.exe
O4 - Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = favaca.org
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 216.173.160.6,216.173.160.20
  • 0

Advertisements


#2
Demian32

Demian32

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
I am begining to recognize simmilar symptoms on another PC on the network leading me to believe this is a virus vs. just Mal ware.

Any advice would be appreicated!

Thanks
  • 0

#3
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,671 posts
Hi Demian,

I don't see any obvious malware running.

Can you post some of the errors you get.

One thing you can always try:
Click Start, point to Programs, point to Accessories, point to System Tools, click System Information, and then click System File Checker on the Tools menu.
Click the following option: Scan For Altered Files

That will establish if there is a file-infecting virus at work.

Regards,
  • 0

#4
Demian32

Demian32

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
wow, yeah, there are several files

mfcuia32.dll
setupx.dll
mfc30.dll

still going....

can i restore from the cab / windows files?
  • 0

#5
Demian32

Demian32

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
mfcans32.dll
and
mfco30.dll

were the last of 5 total files.

Errors:

Basicly it is windows blue sreens, page defauls at x location. I will post exact text.

also

Black screen with cursor only. no responce to keyboard. - hard reboot.

Perhaps the 5 restored files will be able to solve this? I imagine that I will need to identify if this was a virus and other files that may be affected?
  • 0

#6
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,671 posts
Replacing the files will probably be enough.

If you click Extract One File From Installation Disk, you can specify the file you want to extract.
You can find some info howto here:
http://service1.syma...001011114021106

Regards,
  • 0

#7
Demian32

Demian32

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
I have replaced the files and I am testing the two systems affected. The second had 12 files.

Thank you for your help.
  • 0

#8
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,671 posts
No problem. Keep me posted. :tazz:
  • 0

#9
Demian32

Demian32

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
It looks like that did it. I realy appreciate yoru help! Thank you! I will keep the SFC in mind for the future.

Best regards,

Demian
  • 0

#10
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,671 posts
My pleasure. :tazz:

Please have a look at my site for some tips on how to remove and prevent spyware.

Regards,
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP