[Paul W.]

Hi,

 

I've been using Comodo Firewall and Anti-virus for about 3 or 4 weeks. I get blue screens of death quite often now, especially when I try to update, install, or even open a folder with anything Java related (specifically the Java update file).

 

Even in safe mode, I am unable to uninstall Comodo.

 

I would really appreciate any help leading to a resolution of these problems. Thanks very much.

 

 

HiJackThis log:

 

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:30:55 PM, on 1/24/2017
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\NEW\System32\smss.exe
C:\WINDOWS\NEW\system32\winlogon.exe
C:\WINDOWS\NEW\system32\services.exe
C:\WINDOWS\NEW\system32\lsass.exe
C:\WINDOWS\NEW\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\NEW\system32\svchost.exe
C:\WINDOWS\NEW\system32\svchost.exe
C:\WINDOWS\NEW\Explorer.EXE
C:\WINDOWS\NEW\system32\ctfmon.exe
C:\WINDOWS\NEW\system32\WLTRAY.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\WINDOWS\NEW\System32\DLA\DLACTRLW.EXE
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\NEW\V0250Mon.exe
C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
C:\Program Files\Logitech\Gaming Software\LWEMon.exe
C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe
C:\PROGRA~1\CYBERL~1\INSTAN~1\Win2K\IBurn.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\NEW\ehome\ehtray.exe
C:\Program Files\COMODO\Internet Security Essentials\vkise.exe
C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
C:\Program Files\COMODO\COMODO Cloud Antivirus\ccavsrv.exe
C:\Program Files\I8kfanGUI\I8kfanGUI.exe
C:\QuicklaunchShortCuts\Volumouse\volumouse.exe
C:\Program Files\Symmetricom\SymmTime\GeTTime.exe
C:\Program Files\TimeLeft3\TimeLeft.exe
C:\WINDOWS\NEW\system32\spoolsv.exe
C:\Program Files\COMODO\COMODO Cloud Antivirus\ccavsrv.exe
C:\WINDOWS\NEW\system32\cisvc.exe
C:\Program Files\GNU\GnuPG\dirmngr.exe
C:\WINDOWS\NEW\eHome\ehRecvr.exe
C:\WINDOWS\NEW\eHome\ehSched.exe
C:\WINDOWS\NEW\system32\inetsrv\inetinfo.exe
C:\Program Files\COMODO\Internet Security Essentials\isesrv.exe
C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1

\MSSQL\Binn\sqlservr.exe
C:\Program Files\PGP Corporation\PGP Desktop\RDDService.exe
C:\WINDOWS\NEW\system32\tcpsvcs.exe
C:\WINDOWS\NEW\System32\snmp.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\NEW\system32\svchost.exe
C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\NEW\System32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cis.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\WINDOWS\NEW\system32\cidaemon.exe
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\COMODO\COMODO Internet Security\CIS.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://encrypted.google.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-

001234567890} - C:\WINDOWS\NEW\System32

\DLA\DLASHX_W.DLL
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB

-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_111\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-

484f-8273-0445EE161910} - C:\Program Files\Common

Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-

BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_111

\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077}

- C:\Program Files\Common

Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common

Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI]

C:\WINDOWS\NEW\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C

-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\NEW\System32

\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program

Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [V0250Mon.exe]

C:\WINDOWS\NEW\V0250Mon.exe
O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative

Live! Cam\VideoFX\StartFX.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\NEW\IME\imjp8_1

\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\NEW\ime\imkr6_1

\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\NEW\system32

\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\NEW\system32

\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\NEW\system32

\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common

Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Start WingMan Profiler] C:\Program

Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program

Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program

Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [InstantBurn] C:\PROGRA~1\CYBERL~1

\INSTAN~1\Win2K\IBurn.exe
O4 - HKLM\..\Run: [UpdatePSTShortCut] "C:\Program

Files\CyberLink\Media Suite\MUITransfer\MUIStartMenu.exe"

"C:\Program Files\CyberLink\Media Suite" UpdateWithCreateOnce

"Software\CyberLink\PowerStarter"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\NEW\system32

\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\NEW\system32

\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\NEW\system32

\igfxpers.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32

\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common

Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common

Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\NEW\ehome\ehtray.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common

Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [InstallerLauncher] "C:\Program Files\Common

Files\Bitdefender\SetupInformation\{6F57816A-791A-4159-A75F-

CFD0C7EA4FBF}\setuplauncher.exe" /run:"C:\Program Files\Common

Files\Bitdefender\SetupInformation\{6F57816A-791A-4159-A75F-

CFD0C7EA4FBF}\Installer.exe"
O4 - HKLM\..\Run: [IseUI] C:\Program Files\COMODO\Internet Security

Essentials\vkise.exe
O4 - HKLM\..\Run: [COMODO Internet Security] C:\Program

Files\COMODO\COMODO Internet Security\cistray.exe
O4 - HKLM\..\Run: [CCAV] "C:\Program Files\COMODO\COMODO

Cloud Antivirus\ccavsrv.exe" -autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\NEW\system32

\ctfmon.exe
O4 - HKCU\..\Run: [i8kfangui] C:\Program

Files\I8kfanGUI\I8kfanGUI.exe /startup
O4 - HKCU\..\Run: [$Volumouse$]

"C:\QuicklaunchShortCuts\Volumouse\volumouse.exe" /nodlg
O4 - HKUS\S-1-5-21-1801674531-1770027372-725345543-1003\..\Run:

[ctfmon.exe] C:\WINDOWS\NEW\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-1801674531-1770027372-725345543-1003\..\Run:

[i8kfangui] C:\Program Files\I8kfanGUI\I8kfanGUI.exe /startup (User '?')
O4 - HKUS\S-1-5-21-1801674531-1770027372-725345543-1003\..\Run:

[$Volumouse$] "C:\QuicklaunchShortCuts\Volumouse\volumouse.exe"

/nodlg (User '?')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe]

C:\WINDOWS\NEW\system32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe]

C:\WINDOWS\NEW\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-21-1801674531-1770027372-725345543-1003 Startup:

TimeLeft.lnk = C:\Program Files\TimeLeft3\TimeLeft.exe (User '?')
O4 - Startup: TimeLeft.lnk = C:\Program Files\TimeLeft3\TimeLeft.exe
O4 - Global Startup: SymmTime.lnk = C:\Program

Files\Symmetricom\SymmTime\GeTTime.exe
O8 - Extra context menu item: Append Link Target to Existing PDF -

res://C:\Program Files\Common

Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLink

s.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program

Files\Common

Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF -

res://C:\Program Files\Common

Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLink

s.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program

Files\Common

Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-

f2ba38496583} - C:\WINDOWS\NEW\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-

4134-82b7-f2ba38496583} - C:\WINDOWS\NEW\Network

Diagnostic\xpnetdiag.exe
O15 - Trusted Zone: *.dell.com
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3}

(MUWebControl Class) -

http://update.micros.../en/x86/client/

muweb_site.cab?1411437095013
O16 - DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} -

http://support.dell....lSystemLite.CAB
O20 - AppInit_DLLs: PGPmapih.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program

Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: ccavsrv - COMODO - C:\Program

Files\COMODO\COMODO Cloud Antivirus\ccavsrv.exe
O23 - Service: ccavvirth - COMODO - C:\Program

Files\COMODO\COMODO Cloud Antivirus\ccavvirth.exe
O23 - Service: COMODO Internet Security Helper Service (CmdAgent) -

COMODO - C:\Program Files\COMODO\COMODO Internet

Security\cmdagent.exe
O23 - Service: COMODO Virtual Service Manager (cmdvirth) -

COMODO - C:\Program Files\COMODO\COMODO Internet

Security\cmdvirth.exe
O23 - Service: DirMngr - Unknown owner - C:\Program

Files\GNU\GnuPG\dirmngr.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. -

C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google

Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program

Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision

Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050

\Intel 32\IDriverT.exe
O23 - Service: isesrv - COMODO - C:\Program Files\COMODO\Internet

Security Essentials\isesrv.exe
O23 - Service: MBAMScheduler - Malwarebytes - C:\Program

Files\Malwarebytes Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes - C:\Program

Files\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla

Foundation - C:\Program Files\Mozilla Maintenance

Service\maintenanceservice.exe
O23 - Service: OpcEnum - OPC Foundation -

C:\WINDOWS\NEW\system32\Opcenum.exe
O23 - Service: PGP RDD Service - Symantec Corporation - C:\Program

Files\PGP Corporation\PGP Desktop\RDDService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown

owner - C:\WINDOWS\NEW\System32\WLTRYSVC.EXE

--
End of file - 10973 bytes
 

[Advertisements]

•  

Get FRST from

http://www.bleepingc...very-scan-tool/

You need to download the appropriate tool for your PC.  Appears you have a 32 bit system.

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer. 

Check the Addition.txt box

Press Scan button. 

It will produce a log called FRST.txt in the same directory the tool is run from.  

Please copy and paste log back here. 

It will generate another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply. 

[RKinner]

•  

Get FRST from

http://www.bleepingc...very-scan-tool/

You need to download the appropriate tool for your PC.  Appears you have a 32 bit system.

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer. 

Check the Addition.txt box

Press Scan button. 

It will produce a log called FRST.txt in the same directory the tool is run from.  

Please copy and paste log back here. 

It will generate another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply. 

[Paul W.]

Unfortunately, while running the scan, FRST closed down because of some error.

[RKinner]

1. Double-click My Computer, and then right-click the hard disk that you want to check. C:

2. Click Properties, and then click Tools.

3. Under Error-checking, click Check Now. A dialog box that shows the Check disk options is displayed,

4. Check both boxes and then click Start.

You will receive the following message:

The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer?

Click Yes to schedule the disk check, but don't restart yet.

 

Start, Run, eventvwr.msc, OK to bring up the Event Viewer.  Right click on System and Clear All Events, No (we don't want to save the old log), OK. Repeat for Application. 

 

Reboot. 

 

The disk check will run and will probably take an hour or more to finish.

 

 

1. Please download the Event Viewer Tool by Vino Rosso

http://images.malwar...om/vino/VEW.exe

and save it to your Desktop:

2. Double-click VEW.exe

3. Under 'Select log to query', select:

 

* System

4. Under 'Select type to list', select:

* Error

* Warning

 

 

Then use the 'Number of events' as follows:

 

 

1. Click the radio button for 'Number of events'

Type 20 in the 1 to 20 box

Then click the Run button.

Notepad will open with the output log.

 

 

Please post the Output log in your next reply then repeat but select Application. (Each time you run VEW it overwrites the log so copy the first one to a Reply or rename it before running it a second time.)

 

Then try FRST again

Ron

[Paul W.]

Here is a copy of the FRST error dialogue box.

Attached Thumbnails

• 

[RKinner]

Let's also see what is causing the BSODs

 

 

Download BlueScreenView

http://www.nirsoft.net/utils/blue_screen_view.html 

 

Double click on BlueScreenView.exe file to run the program.

When scanning is done, go Edit, Select All.

 

Go File, Save Selected Items, and save the report as BSOD.txt.

Open BSOD.txt in Notepad, copy all content, and paste it into your next reply.

[Paul W.]

I ran the disk scan without a hitch. But when I tried to run VEW, I got an error, then it closed.

Attached Thumbnails

• 

[Paul W.]

 

Let's also see what is causing the BSODs

 

 

Download BlueScreenView

http://www.nirsoft.net/utils/blue_screen_view.html 

 

Double click on BlueScreenView.exe file to run the program.

When scanning is done, go Edit, Select All.

 

Go File, Save Selected Items, and save the report as BSOD.txt.

Open BSOD.txt in Notepad, copy all content, and paste it into your next reply.

 

Bad link for BlueScreenView?

[RKinner]

The link should be:

http://www.nirsoft.net/utils/blue_screen_view.html

so perhaps the forum did something to it again.

 

VEW requires that you right click on it and Run As Admin.  If you don't you get the 70 error.

[Paul W.]

Using this file,

 

http://www.nirsoft.n...nview_setup.exe

 

I tried to install it twice, and both times I got the blue screen.

Attached Thumbnails

• 

[Paul W.]

I tried running VEW as Administrator, but was unable because username or password is incorrect. I tried using a blank password, but that didn't work.

[RKinner]

Can you boot into Safe Mode with Networking?

 

(Reboot and when you see the maker's logo, hear a beep or it talks about F8, start tapping the F8 key slowly.  Keep tapping until the Safe Mode Menu appears and choose Safe Mode with Networking.  With XP you should have a choice of logins - one of them is Administrator.  This normally has no password.  Try to log on with administrator.) 

 

If you get on that way then try to create a new user with admin rights:

 

1.

Open User Accounts in Control Panel.

2.

Click Create a new account.

3.

Type a name for the new user account, and then click Next.

4.

Click Computer administrator  and then click Create Account.

 

Then try to run vew.  

 

You can also try to reboot and login as the new user you have created.

 

Also minitolbox can sometimes read the event logs:

 

Please download MiniToolBox, save it to your desktop and run it.

 

Checkmark the following checkboxes:

Flush DNS

Report IE Proxy Settings

Reset IE Proxy Settings

Report FF Proxy Settings

Reset FF Proxy Settings

List content of Hosts

List IP configuration

List Winsock Entries

List last 10 Event Viewer Errors

List Installed Programs

List Devices

List Users, Partitions and Memory size.

List Minidump Files

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

 

Note: When using "Reset FF Proxy Settings" option Firefox should be closed.

[Paul W.]

It seems that I can't do much of anything now without getting the blue screen. Also, RESTORE POINT doesn't work, as well as DISK DEFRAGMENTATION. I'm not sure, but after Comodo was installed, things started going downhill. It may be something else. I don't know. I'm not even able to uninstall Comodo or other malware that is installed. Very strange indeed. I'm still trying to get the software to reset my windows password so I can run as Admin, but I keep getting the blue screens. I used to be able to run as Admin; but since Comodo, I can't. Thanks.

[Paul W.]

It seems that I can't do much of anything now without getting the blue screen. Also, RESTORE POINT doesn't work, as well as DISK DEFRAGMENTATION. I'm not sure, but after Comodo was installed, things started going downhill. It may be something else. I don't know. I'm not even able to uninstall Comodo or other malware that is installed. Very strange indeed. I'm still trying to get the software to reset my windows password so I can run as Admin, but I keep getting the blue screens. I used to be able to run as Admin; but since Comodo, I can't. Thanks.

[Paul W.]

It seems that I can't do much of anything now without getting the blue screen. Also, RESTORE POINT doesn't work, as well as DISK DEFRAGMENTATION. I'm not sure, but after Comodo was installed, things started going downhill. It may be something else. I don't know. I'm not even able to uninstall Comodo or other malware that is installed. Very strange indeed. I'm still trying to get the software to reset my windows password so I can run as Admin, but I keep getting the blue screens. I used to be able to run as Admin; but since Comodo, I can't. Thanks.