Unexpected Restarts during virus scanning

The other night, I was running a virus scan (for the first time in a while, which is bad). I left the laptop alone and went to do some things around the house. When I came back, it had been scanning for 25 minutes and was close to being finished. I went away to do something else, and when I came back a few minutes later, I was at the log in screen.

I decided to let it go for the time being, since there were some things I had to work on.

When I tried to finish scanning today, my laptop restarted on me. A blue screen flashed briefly, and the laptop was restarting. It took a minute and half for it to boot up, much longer than usual. I decided to see if I could do a system restore, and that didn't work. The same blue screen (or at least I think the same blue screen) flashed by and the laptop restarted again.

Oh, and just so you know, I'm using the virus scan that was available through my University: VirusScan Enterprise 8.0.0

Other than the long start-up, everything seems to be working okay. I'm just worried that these things are a sign of a much bigger problem. (Which I'm pretty sure they are.)

Any suggestions would be greatly appreciated.

Edit: I'm on a Toshiba Satellite A55 that's running Windows XP.

 

I just tried to run Ad-Aware, and right in the middle of scanning, I got this message: Delayed Write Failed - Windows was unable to save al the data for the file C:\$Mft. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.

When I clicked "Ok" in that window, a bubble popped up in the system tray that said the same thing, except it was for the file C:\WINDOWS\system32.

I messed up my laptop, didn't I?

If more information is needed, I'll try to get it! ^^

 

Hi Yukimi

Download and install the below:

Best free cleaners:

DCleaner http://www.majorgeeks.com/DCleaner_d4790.html
when run check all boxes run twice

ATF-Cleaner http://www.atribune.org/content/view/25/2/
when run check select all run twice or more until nothing else found

CCleaner get the slim version http://www.ccleaner.com/download/builds.aspx
Click bottom right Run Cleaner twice
then in left panel click issues then below Scan for issues run twice or until no more found

Update your Adaware
Update you Virus scanner

Then reboot to "safe" mode.
Reboot tap F8 key repeatedly while coming back up do this during the black screen before window begins, on menu choose Safe Mode "not safe mode with networking ".

Run the above in the order as above also

After this get back so be can run a HiJack scan.

Mike

 

Yay! Thanks for the help and quick reply. ^_^

I did all of those things, now all that's left is the HiJack scan.

That I'm not sure how to do...

 

Hello Yukimi and welcome to the Board,

Download and run HijackThis:

Download from here http://radiosplace.com/ latest version 1.99.1

Download it to it's own folder, for example create a folder C:\HijackThis

unzip (double click on zipped folder)

click on the execute

click on Do a system scan and save a logfile and save to the folder you just created

copy resultant .txt file and paste into your next post

Regards - Charles

 

Okay, here's the HijackThis file.

Thanks for the help.

-----

Logfile of HijackThis v1.99.1
Scan saved at 10:30:10 PM, on 1/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
C:\WINDOWS\system32\svchost.exe
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\system32\00THotkey.exe
C:\WINDOWS\system32\TFNF5.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\toshiba\ivp\ism\pinger.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Sayomi-chan\My Documents\hijackthis\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://www.toshibadirect.com/dpdstart
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32

\dla\tfswshx.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program

Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program

files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [TPSODDCtl] TPSODDCtl.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming

Utility\SmoothView.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"

-osboot
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail

Notifier\gnotify.exe
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE"

/STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common

Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common

Files\Network Associates\TalkBack\tbmon.exe "
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3

\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software

Update\HPWuSchd2.exe "
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008

\GoogleToolbarNotifier.exe
O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft

Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0

\Reader\reader_sl.exe
O4 - Global Startup: Metamail Trust Manager.lnk = C:\Program Files\Metamail Inc\Metamail

Tray\Metamail Trust Manager.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10

\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Global Startup: Wireless-G Notebook Adapter.lnk = C:\Program Files\Linksys\Wireless-G

Notebook Adapter\Gcc.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2

\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2

\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32

\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -

http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1

\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1

\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32

\WPDShServiceObj.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32

\acs.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program

Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. -

C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program

Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. -

C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. -

C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. -

C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook

Adapter\NICServ.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe

 

Morning Yukimi

You are clean.

I would suggest a defrag.

Run the cleanups that I referred in my first post above every 10 days or 2 weeks. Or immediately if you suspect problems. And especially if others use you computer.

If you want you may add the below to your bi-weekly cleanup.

Download install and run http://www.xblock.com/download/xclean_micro.exe

This is an advanced cleaner that goes after (not everything) but only the worst most prolific and damaging malware and some viri.

Delete ALL it finds no exceptions, if after cleaning an incident, it advises a reboot, say no during the process, but do so when the program ends before continuing with next step below.

Many finds with this program, then reboot to Safe Mode and run it again. I use this as preclean first before SpyBot and AdAware.

Mike

 

Thank you for the help.

The problem seems to have gotten worse, though. I left my laptop alone for a few minutes, and it restarted on it's own. After I logged in, I had to let it sit alone for a few minutes again, and when I came back, I saw a blue error screen flash and it restarted.

I downloaded the X-cleaner, and was running it when it found a thing called "Switchdialer." It asked if I wanted to create a system restore point, and I chose to do so. However, as soon as I did, the whole computer froze.

Is there anything else I should do?

[edit] I just remembered something! A few nights ago, before all these problems started, my computer downloaded an update (automatically) and it was one of the updates where you have to click on something to install it. (As in, "There are updates waiting for your computer! Click here to install. ") So I did that, and I remember it saying something about SP3 (although there's a good chance my memory is wrong). I installed it, and everything seemed fine...until now that is... One of the things it wanted me to do is to install IE7 (or whatever the latest version is, I forget). I declined that...

Maybe this is what went wrong... >.o;;

 

Hi Yukimi

Then if you remember this being after an update we need to restore to before that happend.

The HJT log was surprisingly clean.

Go to start run
type exactly as below

%SystemRoot%\system32\restore\rstrui.exe

choose Restore my computer to an earlier time

Choose a date before this update that noticed seemed to be the cause and click next.

finish restore and reboot

Now that we have set the computer back we could have put back other bad things that were there at that time.

So once it boots back up. Reboot

SAFE MODE is very important here. The instructions are above to enter safe mode.

So reboot to safe mode.

Run these in this order.

DCleaner - when run check all boxes run twice

ATF-Cleaner - when run check select all run twice or more until nothing else found

CCleaner - Click bottom right Run Cleaner twice
then in left panel click issues then below Scan for issues run twice or until no more found

xclean_micro.exe - This is an advanced cleaner that goes after (not everything) but only the worst most prolific and damaging malware and some viri.

Delete ALL it finds no exceptions, if after cleaning an incident, it advises a reboot, say no during the process, but do so when the program ends before continuing with next step below.

Then reboot to normal mode and send us a new HJT log. This is needed as the restore changed things.

If you cannot find these new programs after the restore then you will have to follow the original instructions and download them again.

But I reinterate after downloading you must run all but HJT in Safe mode.

Return to normal mode after running all the others then get us a new HJT log.

Mike

 

I'm sorry! You went through the trouble of typing all that, and I had to reset everything on my laptop. I tried to start it up this morning, and it wouldn't load Windows XP. It said that a .dll file was missing, and to re-install it. So...I insert the Recovery disc and let it rewrite everything.

I'm going to download those cleaners you mentioned so that my laptop will hopefully survive a little longer.

Thank you for the help.

 

Oh Yukimi

I am so sorry.

Your problem actually may be hardware. But if not what you had was pretty well hidden.

This is a problem if you wait too long.

The below is for everyone not just you Yukimi. That is what this BBS is all about learning and informing. And letting ME VENT!

1. Everyone with important data should first backup documents, emails and other data while it is working.

2. Don't ignore what seems to be only a nuisance as it can get worse very quickly.

GET ON IT.

Imagine it like this, Windows has all kinds of gate guards and security built in. We add Virus scanners firewalls etc.

Windows internet (although these things can come from CD floppy etc) is basically an invitation system.

If we request something all our guards try to check every thing and they do pretty good.

But sometimes we bring things in the back or side door sneaking by the guard so to speak. Sometimes they are just smart enough to slip in.

So finally a Crook gets in takes control starts turning off systems and disabling things.

Now that he is on the inside he can invite others so starts inviting his friends, crooks don't have many good (non crook ) friends.

Once in, they are a gang and it is vandalism time, steal things, trash the place for fun.

If we had nipped him in bud before he gained an army, we would have had a chance.

DO NOT IGNORE OBVIOUS VIRUS SPY/ADWARE PROBLEMS.

DO NOT JUST THINK IT WILL NOT GET WORSE. IT WILL!!!!

Mike

 

It's okay. I'm trying to do everything I can and I am trying to learn...

I re-downloaded McAfee VirusScan, and I set it to scan "All Fixed Disks." It's been running for about 30 minutes, and has come across three items that it could not scan because they were encrypted.

Two of them are CMNDIS.VBS One is in a folder located C:\Documents and Settings\All Users\Application Dat\McAfee.com\Agent\News\valert.ui , and the other is located in C:\Documents and Settings\Sayomi\Local Settings\Temporary Internet Files\Content.IE5\E7IADM3\valert[1].ui

There's also an AGNTCONS.VBS in C:\Program Files\McAfee.com\Agent\Uninst\screm.ui

Should I worry about these?

 

Whoa!!

When you finished the above did you still have personal files, in My Documents and where your email messages still there.

If you you did, you did a type of repair install and did not

If so then we are right back where we started... or ended??

Let us know before continuing!

Mike

 

Ahhh....I did not know there was a difference...I was trying to watch my words. ^^;

I didn't have anything personal on the laptop when it started up after I inserted the recovery disk. (I had managed to salvage a good majority of my files last night, which is great.) Everything was as if I had just bought it. I had to re-download the programs mentioned in a previous post, and was able to get through a Virus scan and a Spyware scan without a blue screen.

Everything seems to be functioning fine, now. It doesn't take a minute and 45 seconds to get from the loading screen to the login screen, and my mouse movements aren't sticky.

 

OK! But!!!!!!!!!!!!!!!!!!!!!!!

At the first sign of trouble.

Print entire thread start at top and do the steps from the beginning USING SAFE MODE!!!!

In fact print it now so you can do the steps without even loging on here.

Then post a new HJT log in this post.

See, once before you told me all was well.

Mike

 

Done! It's all printed out, and I shall put it with all my other laptop stuff.

Thank you so much for your help!