PC Boots to a white screen

[ShooMoe]

Hello good folks

I have a HP and it only boots to a white screen. I tried booting to safe mode and it quickly restarts. I tried restoring to back and it will not go through. I can only opt to this white screen. I am able to see my mouse and as a cursor and able to move it. If I let it sit it goes to sleep and I can easily wake it. But it keeps going back to the white screen.

Any help will be appreciated.

Thanks

[MrCharlie]

EDIT: bleepingcomputer is down right now......you won't be able to download Farbar Recovery Scan Tool.

 

 

Welcome to the forum, here's how we deal with that malware:

• Please download Farbar Recovery Scan Tool and save it to a flash drive.
  
  Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  
  Plug the flash drive into the infected PC.
• If you are using Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt to enter System Recovery Command prompt.
  
  If you are using Vista or Windows 7 enter System Recovery Options.
  
  To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.
  Note: In case you can not enter System Recovery Options by using F8 method, you can use Windows installation disc, or make a repair disc. Any Windows installation disc or a repair disc made on another computer can be used.
  To make a repair disk on Windows 7 consult: http://www.sevenforums.com/tutorials/2083-system-repair-disc-create.html
  
  
  To enter System Recovery Options by using Windows installation disc:
  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.
• On the System Recovery Options menu you will get the following options:
  • •  
    • Startup Repair
      System Restore
      Windows Complete PC Restore
      Windows Memory Diagnostic Tool
      Command Prompt
      
      Select Command Prompt
      
      Once in the Command Prompt:
  • In the command window type in notepad and press Enter.
  • The notepad opens. Under File menu select Open.
  • Select "Computer" and find your flash drive letter and close the notepad.
  • In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter
    Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run.
  • When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

MrC

[ShooMoe]

Thanks for the help. Here are my findings!

 

(((((((((((((((start))))))))))))))))))))))))

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013
Ran by SYSTEM on MININT-LCA8REQ on 14-10-2013 19:55:21
Running from G:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet002
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [beatsOSDApp] - C:\Program Files\IDT\WDM\beats64.exe [37888 2010-10-21] (Hewlett-Packard )
HKLM\...\Run: [hpsysdrv] - c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM\...\Run: [Trend Micro Titanium] - C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe [1304296 2012-12-18] (Trend Micro Inc.)
HKLM\...\Run: [sysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1424896 2011-10-23] (IDT, Inc.)
HKLM\...\Run: [Trend Micro Client Framework] - C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [213824 2012-02-27] (Trend Micro Inc.)
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$a0eac9f0e2853151e4e67ad9c5f7bba6\n. ATTENTION! ====> ZeroAccess?
HKLM-x32\...\Run: [startCCC] - c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-06-29] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.)
HKLM-x32\...\Run: [sunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1391272 2012-01-03] (Ask)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-04-03] (Adobe Systems Incorporated)
HKU\Owner\...\Run: [Facebook Update] - C:\Users\Owner\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-11] (Facebook Inc.)
HKU\Owner\...\Run: [GoogleChrome] - C:\Users\Owner\AppData\Local\Temp\eoox23.exe <===== ATTENTION
HKU\Owner\...\Run: [skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18642024 2013-02-28] (Skype Technologies S.A.)
HKU\Owner\...\Run: [DisplaySwitch] - "C:\ProgramData\SystemRoot.exe"
HKU\Owner\...\Winlogon: [shell] explorer.exe,C:\Users\Owner\AppData\Roaming\skype.dat [146944 2011-11-16] (AutoRix Software LLC) <==== ATTENTION
Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Officejet Pro 8600 (Network).lnk
ShortcutTarget: Monitor Ink Alerts - HP Officejet Pro 8600 (Network).lnk -> C:\Program Files\HP\HP Officejet Pro 8600\bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Services (Whitelisted) =================

S2 DTSRVC; C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe [129840 2011-06-17] (Portrait Displays, Inc.)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
S2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-05-05] (PDF Complete Inc)
S2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 -ad [x]

==================== Drivers (Whitelisted) ====================

S3 CH375_A64; C:\Windows\System32\Drivers\CH375W64.SYS [29056 2011-03-13] (www.winchiphead.com)
S3 FintekCIR; C:\Windows\system32\drivers\FintekCIR.sys [30248 2009-11-12] (Fintek)
S3 NWVoltron; C:\Windows\system32\drivers\NWVoltron.sys [28440 2011-06-23] ()
S3 NWWakeFilterV; C:\Windows\system32\drivers\NWWakeFilterV.sys [16152 2011-06-23] (n/a)
S1 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [107048 2012-09-24] (Trend Micro Inc.)
S1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [173504 2012-09-24] (Trend Micro Inc.)
S1 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [77184 2012-09-24] (Trend Micro Inc.)
S1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [105744 2011-08-02] (Trend Micro Inc.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-14 19:55 - 2013-10-14 19:55 - 00000000 ____D C:\FRST

==================== One Month Modified Files and Folders =======

2013-10-14 19:55 - 2013-10-14 19:55 - 00000000 ____D C:\FRST
2013-10-10 20:12 - 2013-05-26 15:50 - 00000004 _____ C:\Users\Owner\AppData\Roaming\skype.ini
2013-10-10 20:12 - 2012-07-09 05:51 - 00000896 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-10 20:11 - 2012-07-25 13:56 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-10 18:37 - 2011-11-02 20:18 - 01161101 _____ C:\Windows\WindowsUpdate.log
2013-10-10 18:27 - 2012-07-07 11:47 - 00000928 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-279019278-1262103249-3010780096-1000UA.job
2013-10-10 18:27 - 2012-07-07 11:47 - 00000906 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-279019278-1262103249-3010780096-1000Core.job
2013-10-10 17:11 - 2012-02-10 06:38 - 00000000 ____D C:\ProgramData\Recovery
2013-10-10 17:01 - 2011-11-02 20:41 - 00000000 ____D C:\ProgramData\PDFC
2013-10-10 16:19 - 2011-11-02 20:28 - 00000000 ____D C:\ProgramData\RoxioNow
2013-10-10 16:19 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration
2013-10-10 13:19 - 2009-07-13 20:45 - 00024608 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-10 13:19 - 2009-07-13 20:45 - 00024608 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-10 13:12 - 2012-07-09 05:51 - 00000892 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-10 13:12 - 2012-02-10 22:12 - 00000000 ____D C:\Users\Owner\AppData\Local\CrashDumps
2013-10-10 13:12 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-10 13:11 - 2009-07-13 20:51 - 00056103 _____ C:\Windows\setupact.log
2013-10-10 12:20 - 2012-02-09 17:10 - 00000000 ____D C:\users\Owner

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-279019278-1262103249-3010780096-1000\$a0eac9f0e2853151e4e67ad9c5f7bba6

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$a0eac9f0e2853151e4e67ad9c5f7bba6

Files to move or delete:
====================
C:\Users\Owner\AppData\Roaming\skype.dat
C:\Users\Owner\AppData\Roaming\skype.ini


Some content of TEMP:
====================
C:\Users\Owner\AppData\Local\Temp\2338928758046480261307.exe
C:\Users\Owner\AppData\Local\Temp\ApnStub.exe
C:\Users\Owner\AppData\Local\Temp\Extract.exe
C:\Users\Owner\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\Owner\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Owner\AppData\Local\Temp\installhelper.dll
C:\Users\Owner\AppData\Local\Temp\po.exe
C:\Users\Owner\AppData\Local\Temp\r.exe
C:\Users\Owner\AppData\Local\Temp\Resource.exe
C:\Users\Owner\AppData\Local\Temp\SetupDataMngr_Searchqu.exe
C:\Users\Owner\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Owner\AppData\Local\Temp\Soft32_Stub_5741(83).exe
C:\Users\Owner\AppData\Local\Temp\Soft32_Stub_5741.exe
C:\Users\Owner\AppData\Local\Temp\sp54931.exe
C:\Users\Owner\AppData\Local\Temp\SP58084.exe
C:\Users\Owner\AppData\Local\Temp\sp58915.exe
C:\Users\Owner\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Owner\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\Owner\AppData\Local\Temp\{C2908403-F6F2-4D60-B366-BEF176D0A31E}-GoogleUpdateSetup.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
C:\Program Files\Windows Defender\mpsvc.dll => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

8
Restore point made on: 2013-06-05 16:52:43
Restore point made on: 2013-06-13 15:11:50
Restore point made on: 2013-06-13 23:00:55
Restore point made on: 2013-06-19 23:00:31
Restore point made on: 2013-07-14 10:41:08
Restore point made on: 2013-07-14 23:00:26
Restore point made on: 2013-08-29 23:00:32
Restore point made on: 2013-10-10 12:01:53

==================== Memory info ===========================

Percentage of memory in use: 25%
Total physical RAM: 3570.78 MB
Available physical RAM: 2652.91 MB
Total Pagefile: 3568.98 MB
Available Pagefile: 2653.9 MB
Total Virtual: 8192 MB
Available Virtual: 8191.87 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:916.7 GB) (Free:856.76 GB) NTFS
Drive e: (HP_RECOVERY) (Fixed) (Total:14.71 GB) (Free:1.82 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive g: (LaCie) (Removable) (Total:7.52 GB) (Free:0.02 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.12 GB) (Free:0.12 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: E8C4994D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=917 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 8 GB) (Disk ID: 2C6B7369)
No partition Table on disk 1.


LastRegBack: 2013-08-30 13:43

==================== End Of Log ============================

 

(((((((((((((((((((end)))))))))))))))))))))

[MrCharlie]

Please read the following information first.

 

You're infected with Rootkit.ZeroAccess, a BackDoor Trojan.

BACKDOOR WARNING

------------------------------

One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

http://www.dslreports.com/faq/10451

When Should I Format, How Should I Reinstall

http://www.dslreports.com/faq/10063

I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.

I would change all my passwords and keep a close eye on all your sensitive accounts.

Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

-----------------------------------------

Please download the attached fixlist.txt and copy it to your flashdrive.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options. (as you did before)

Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

See if the computer boots normally now and if so..........run MBAR

If not...rescan with FRST and post the new log

Download Malwarebytes Anti-Rootkit from HERE

• Unzip the contents to a folder in a convenient location.
• Open the folder where the contents were unzipped and run mbar.exe
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
• Wait while the system shuts down and the cleanup process is performed.
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
• When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.

Just run fixdamage.exe.

Verify that they are now functioning normally.

MrC

[ShooMoe]

Thank you Mr. C! That worked, You are awesome. I REALLY appreciate it!

[MrCharlie]

Did you run Malwarebytes Anti-Rootkit??

MrC

[ShooMoe]

Mr C,

 

Here is the report that I got. I did run MAR. until I got a clean.. I then ran a copy of MalwareBytesAM I found over 500 plus virus.. I clicked and cleaned them all. Here is the report from MAR...

 

I will run MBAM until i come back clean.. do you think I need to do anything further?

 

Thanks again!

 

Jason

mbar-log-2013-10-16 (15-07-17).txt

[MrCharlie]

Well Done, lets run ComboFix to clear up any leftovers.

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

[ShooMoe]

Here is the combo fix text.

 

thanks

 

log_comboFix.txt.txt

[ShooMoe]

sorry wrong file..i think.

 

try this one

 

Thanks

 

ComboFix.txt

[MrCharlie]

Looks Good......

Lets clean out any adware now: (this will require a reboot so save all your work)

Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.

  Vista/Windows 7/8 users right-click and select Run As Administrator

• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• When it's done you'll see: Pending: Please uncheck elements you don't want removed.
• Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
• Look over the log especially under Files/Folders for any program you want to save.
• If there's a program you may want to save, just uncheck it from AdwCleaner.
• If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
• If you're ready to clean it all up.....click the Clean button.
• After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.
• Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
• To restore an item that has been deleted:
• Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Then..................

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how computer is running now, MrC

[MrCharlie]

How are we doing??

Do you still need help or can I close this post??

MrC

[ShooMoe]

I think we are good. thank you once again!

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!