Black screen after Vista Login after MBAM personalAV cleaning

[ham213]

I'm running into an issue where MBAM removed PersonalAV from my machine, and after rebooting I log in to Vista and get a black screen (and occasionally a blue one).

It just hangs there after logging in.

I can still boot the machine in Safe Mode, but just not in the "normal" mode.

Any ideas of what to do next would be greatly appreciated

[ham213]

BUMP

I still have the same issue

Any assistance would be greatly appreciated . . .

I'm running into an issue where MBAM removed PersonalAV from my machine, and after rebooting I log in to Vista and get a black screen (and occasionally a blue one).

It just hangs there after logging in.

I can still boot the machine in Safe Mode, but just not in the "normal" mode.

Any ideas of what to do next would be greatly appreciated

[screen317]

Hi and welcome to Malwarebytes.

Nasty infection you have.

In Safe Mode With Networking, update MBAM, then run a Quick Scan and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post the one that is not minimized.

-screen317

[ham213]

Thank you for the reply!

This is the log for the first time we ran MBAM:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4313

Windows 6.0.6002 Service Pack 2 (Safe Mode)

Internet Explorer 8.0.6001.18928

7/14/2010 10:53:59 AM

mbam-log-2010-07-14 (10-53-59).txt

Scan type: Quick scan

Objects scanned: 166736

Time elapsed: 6 minute(s), 16 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 4

Registry Values Infected: 2

Registry Data Items Infected: 0

Folders Infected: 4

Files Infected: 3

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\Environment\avapp (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Environment\avuninst (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

C:\Program Files\Common Files\Uninstall\PersonalAV (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.

C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Program Files\PersonalAV (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.

C:\ProgramData\Microsoft\Windows\Start Menu\PersonalAV (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.

Files Infected:

C:\Program Files\Common Files\Uninstall\PersonalAV\Uninstall.lnk (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.

C:\ProgramData\Microsoft\Windows\Start Menu\PersonalAV\Personal Antivirus.lnk (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.

C:\ProgramData\Microsoft\Windows\Start Menu\PersonalAV\Uninstall.lnk (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.

And here is the log that I just ran:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4313

Windows 6.0.6002 Service Pack 2 (Safe Mode)

Internet Explorer 8.0.6001.18928

7/23/2010 10:50:41 AM

mbam-log-2010-07-23 (10-50-41).txt

Scan type: Quick scan

Objects scanned: 166733

Time elapsed: 6 minute(s), 5 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Here is the non-minimumized log from dds.scr:

DDS (Ver_10-03-17.01) - NTFSx86 NETWORK

Run by Donna at 10:58:41.85 on Fri 07/23/2010

Internet Explorer: 8.0.6001.18928

Microsoft

[screen317]

Hi,

Update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.
  

-screen317

[ham213]

Okay, I updated and ran MBAM and here's the log file:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4345

Windows 6.0.6002 Service Pack 2 (Safe Mode)

Internet Explorer 8.0.6001.18928

7/24/2010 11:17:58 PM

mbam-log-2010-07-24 (23-17-58).txt

Scan type: Quick scan

Objects scanned: 169204

Time elapsed: 6 minute(s), 13 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

I'll post the combofix log in just a moment . . .

Hi,

Update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.
  

-screen317

[ham213]

Okay, I cannot run combofix because despite disabling Windows Live OneCare per Microsoft's instructions: How To Disable OneCare

Combofix still says that it is running . . .

What now?

[screen317]

First, delete your copy of ComboFix and grab the latest version from here; put it on your Desktop.

Now navigate to Start --> Run, and enter this command exactly as shown:

"%userprofile%\desktop\ComboFix.exe" /killall

Press Enter; ComboFix should run normally now.

-screen317

[ham213]

Okay,here's the ComboFix.txt:

ComboFix 10-07-24.06 - Donna 07/26/2010 12:00:46.1.2 - x86 NETWORK

Microsoft

[screen317]

Hi,

Next, please use the Internet Explorer browser and click here to use the F-Secure Online Scanner.

• Click Start Scanning.
  
• You should get a notification bar (on top) to install the ActiveX control.
  
• Click on it and select to install the ActiveX.
  
• Once the ActiveX is installed, you should accept the License terms by clicking OK below to start the scan.
  
• In case you are having problems with installing the ActiveX/starting the scan, please read here.
  
• Click the Full System Scan button.
  
• It will start to download scanner components and databases. This can take a while.
  
• The main scan will start.
  
• Once the scan has finished scanning, click the Automatic cleaning (recommended) button
  
• It could be possible that your firewall gives an alert - allow it, because that's a connection you establish to submit infected files to F-Secure.
  
• The cleaning can take a while, so please be patient.
  
• Then click the Show report button and Copy/Paste what is present under results in your next reply.
  

Next, download my Security Check from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

Let me know how things are running now and what issues remain.

-screen317

[ham213]

I cannot complete the scan because it tells me that it does not have sufficient permissions to scan everything (code 65).

What should I do now?

[ham213]

I was able to run the quick scan, and it found 11 tracking cookies. Here's the report:

Scanning Report

Tuesday, July 27, 2010 12:15:35 - 12:29:23

Computer name: DONNA-PC

Scanning type: Quick scan

Target: System

--------------------------------------------------------------------------------

11 malware found

TrackingCookie.Questionmarket (spyware)

System (Disinfected)

TrackingCookie.Adinterax (spyware)

System (Disinfected)

TrackingCookie.Advertising (spyware)

System (Disinfected)

TrackingCookie.Atdmt (spyware)

System (Disinfected)

TrackingCookie.Doubleclick (spyware)

System (Disinfected)

TrackingCookie.Adbrite (spyware)

System (Disinfected)

TrackingCookie.Mediaplex (spyware)

System (Disinfected)

TrackingCookie.Tradedoubler (spyware)

System (Disinfected)

TrackingCookie.Statcounter (spyware)

System (Disinfected)

TrackingCookie.Atwola (spyware)

System (Disinfected)

TrackingCookie.Yieldmanager (spyware)

System (Disinfected)

--------------------------------------------------------------------------------

Statistics

Scanned:

Files: 3824

System: 3824

Not scanned: 0

Actions:

Disinfected: 11

Renamed: 0

Deleted: 0

Not cleaned: 0

Submitted: 0

I'll run the next suggested step in a few moments . . .

I cannot complete the scan because it tells me that it does not have sufficient permissions to scan everything (code 65).

What should I do now?

[ham213]

Here are the results of the Security Check:

Results of screen317's Security Check version 0.99.4

Windows Vista Service Pack 2 (UAC is enabled)

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Security Center service is not running! This report may not be accurate!

Windows Firewall Disabled!

Windows Live OneCare

Microsoft Windows OneCare Live v2.5.2900.24 Idcrl Install

Microsoft Windows Live OneCare Resources v2.5.2900.30

GTOneCare

Microsoft Windows OneCare Live v2.5.2900.30

Microsoft Windows OneCare Live AntiSpyware and AntiVirus

Norton 360

Antivirus up to date!

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

Java 6 Update 3

Out of date Java installed!

Adobe Flash Player 10.1.53.64

Adobe Reader 8.1.5

Out of date Adobe Reader installed!

````````````````````````````````

Process Check:

objlist.exe by Laurent

````````````````````````````````

DNS Vulnerability Check:

GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

[screen317]

Hi,

Navigate to Start --> Run, and type Combofix /uninstall in the box that appears. Click OK afterward. Notice the space between the X and the /uninstall

This uninstalls all of ComboFix's components.

Delete SecurityCheck.

After that, navigate to Start --> Control Panel --> Add or Remove Programs, and uninstall the following programs (if present):

Java

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!