Elise Posted April 29, 2012 ID:547233 Share Posted April 29, 2012 Uncheck the Devices box and try again to run the full scan. Link to post Share on other sites More sharing options...
highlevel Posted April 29, 2012 Author ID:547236 Share Posted April 29, 2012 As soon as I started the scan... Instant crash. Link to post Share on other sites More sharing options...
Elise Posted April 29, 2012 ID:547239 Share Posted April 29, 2012 GMER can be pretty unstable. Please uncheck IAT/EAT as well. Link to post Share on other sites More sharing options...
highlevel Posted April 29, 2012 Author ID:547243 Share Posted April 29, 2012 5 seconds and crash.... Link to post Share on other sites More sharing options...
Elise Posted April 29, 2012 ID:547258 Share Posted April 29, 2012 Can you click the Save button after running the quick scan and post me the log? Link to post Share on other sites More sharing options...
highlevel Posted April 29, 2012 Author ID:547262 Share Posted April 29, 2012 Classic... now it won't even complete that scan when GMER starts. I'll try renaming it again. I tried again... "UPOS" (my new name for whatever this problem is) seems to have learned this one too. No go. It won't complete the scan at start up. Link to post Share on other sites More sharing options...
Elise Posted April 29, 2012 ID:547282 Share Posted April 29, 2012 Can you please try a clean boot and see if normal mode works after that? Link to post Share on other sites More sharing options...
highlevel Posted April 30, 2012 Author ID:547374 Share Posted April 30, 2012 I tried that the other day. Didn't work. I'll try it again now and see.Negative, no change. Link to post Share on other sites More sharing options...
Elise Posted April 30, 2012 ID:547382 Share Posted April 30, 2012 Can you uninstall service pack 3?: http://support.microsoft.com/kb/950249 Link to post Share on other sites More sharing options...
highlevel Posted April 30, 2012 Author ID:547467 Share Posted April 30, 2012 OK wait a mintue............... you are not going to believe this..............When I thought all was lost. I did a couple of things. Last night I was checking event viewer. I noticed the FAX process kept giving some error messages. So I uninstalled it. I still was having the same issues. I tried the clean boot again... and no joy. This morning I uninstalled Superantispyware, Malwarebytes, then Avast. I didn't realize that SAS was running in the back ground until I PAID ATTENTION and noticed the driver was loading at boot up.The system started just like normal... THAT IS NORMAL WINDOWS!!!! Even the Icons in the systray are visible (which haven't been for weeks). One problem occured during the Windows automatic updates... the computer did crash. It restarted and I am in normal windows again. I am currently on MS update site to see if I can get the latest updates installed. I tried this a while back and could not do it. I will post back in a while. Link to post Share on other sites More sharing options...
Elise Posted April 30, 2012 ID:547472 Share Posted April 30, 2012 I'm glad to hear that! It shouldn't happen but is not uncommon that a security program (or a combination) causes boot problems. After you install any available update you can reinstall them one at a time and see if the problem returns. Link to post Share on other sites More sharing options...
highlevel Posted April 30, 2012 Author ID:547478 Share Posted April 30, 2012 Hi again,OK... the computer is working in normal windows mode. I have no AV or Malware detector installed at the moment. I disabled Windows Update because when trying to load updates the computer restarts. I have gone to the Windows Update site 3 times to attempt to DL and install updates. I keep getting a "fail" on the update for the Microsoft.NET Framework 1.1 SP1 speicifically KB 2656370.Anyway... at least I'm back in.Suggestions?? Link to post Share on other sites More sharing options...
highlevel Posted April 30, 2012 Author ID:547481 Share Posted April 30, 2012 Well... I was going to install hijackthis to see about getting a log report so I could post it here. While on the DL site... the computer crashed. I still think I may be infected with a virus. Maybe it is allowing the system to run because the detectors are gone??? Reaching here but it is kind of wierd that I would be at that site and then crash. Link to post Share on other sites More sharing options...
Elise Posted April 30, 2012 ID:547494 Share Posted April 30, 2012 A HJT log is not helpful. Please rerun DDS instead and post me its log. Link to post Share on other sites More sharing options...
highlevel Posted April 30, 2012 Author ID:547496 Share Posted April 30, 2012 I was trying to get to this forum through the problem computer and it kept crashing. Each time I would search for a attempt to get to Malwarebytes. Finally got here and here is the HJT log.I will try to install and load MBs and see what happens.hijackthis.log Link to post Share on other sites More sharing options...
highlevel Posted April 30, 2012 Author ID:547499 Share Posted April 30, 2012 Oops, sorry.I am running a MBs scan to see how far I get.Will run requested DDS in a while. If the MBs scan runs through it will take about an hour... Link to post Share on other sites More sharing options...
Elise Posted April 30, 2012 ID:547502 Share Posted April 30, 2012 Okay, let me know how it went. Link to post Share on other sites More sharing options...
highlevel Posted April 30, 2012 Author ID:547535 Share Posted April 30, 2012 Well... I am far from out of the woods. At least there is some progress. The scan ran for almost an hour and then the system crashed. Once it restarted the MBs Icon showed up in the systray. As soon as I clicked on it the system crashed again. I was lucky enough to get back on and uninstall MBs again. Then I attempt to run the DDS and the system crashed and this time a BSOD showed with a different error message the IRQ not less or equal to. I then restarted and attempted to get on the forum but the system crashed again.Should I go back into safe mode and see if I can get the DDS to work from there? Link to post Share on other sites More sharing options...
highlevel Posted April 30, 2012 Author ID:547536 Share Posted April 30, 2012 Oh yeah... also since I turned off Automatic updates that little balloon window opens. As soon as I click on the the system crashes. Link to post Share on other sites More sharing options...
highlevel Posted April 30, 2012 Author ID:547538 Share Posted April 30, 2012 I tried DDS again. got the same BSOD. I will go back into safe mode but while I am here I can write the errors.Driver_IRQL_NOT_LESS_OR_EQUALTech Info***Stop: 0x000000D1 (0xE149c000,, 0x000000FF, 0x00000000, oxF787FA28)*** mbr.sys - Address F787FA28 base F787F000, DateStamp 4 cd665da Link to post Share on other sites More sharing options...
Elise Posted April 30, 2012 ID:547541 Share Posted April 30, 2012 Thats GMER's mbr checking utility (incorporated in DDS) causing a BSOD, which is not uncommon. To be sure we can do an offline dump of your MBR so we can exclude any infection there.Try this please. You will need a USB drive.Download GETxPUD.exe to the desktop of your clean computerRun GETxPUD.exeA new folder will appear on the desktop.Open the GETxPUD folder and click on the get&burn.batThe program will download xpud_0.9.2.iso, and upon finished will open BurnCDCC ready to burn the image.Click on Start and follow the prompts to burn the image to a CD.Remove the USB & CD and insert it in the sick computerBoot the Sick computer with the CD you just burnedThe computer must be set to boot from the CDGently tap F12 and choose to boot from the CDFollow the promptsA Welcome to xPUD screen will appearPress FileExpand mntsda1,2...usually corresponds to your HDDsdb1 is likely your USBClick on the folder that represents your USB drive (sdb1 ?)Press Tool at the topChoose Open TerminalType the following and press enter:dd if=/dev/sda of=mbr.bin bs=512 count=1Press EnterAfter it has finished a file will be located on your USB drive named mbr.binRemove the USB drive and insert it back in your working computer and navigate to mbr.bin, zip it up and attach it to your next reply.This will allow me to have a look at the MasterBootRecord of your drive and see if it is infected. Link to post Share on other sites More sharing options...
highlevel Posted April 30, 2012 Author ID:547542 Share Posted April 30, 2012 OK... I will have to check back in later. Have to leave for a while.I went into "safe mode" and got the DDS logsdds.txtattach.txt Link to post Share on other sites More sharing options...
Elise Posted April 30, 2012 ID:547545 Share Posted April 30, 2012 I see a few small things that need fixed in the DDS log, but lets first have a look at the MBR dump. Link to post Share on other sites More sharing options...
highlevel Posted April 30, 2012 Author ID:547612 Share Posted April 30, 2012 Hi,I get the start up screen where it asks for the language on the bottom of the screen it says "automatic boot in..." counts down and then shuts down and reboots to the same screen. There is also a line that says press [tab} to edit options. That doesn't work. ?? Link to post Share on other sites More sharing options...
highlevel Posted April 30, 2012 Author ID:547619 Share Posted April 30, 2012 It's not the disk... I just tried it in my NI computer and it worked.I can get into normal windows. If I even attempt to DL or install Avast the computer shuts down. If I just search for weather etc... it runs fine.This is... frustrating. Link to post Share on other sites More sharing options...
Recommended Posts