PC Crash 2. Try

Bert24 · September 4, 2011

Hi D-Fred,

I want to apologize to you, because I didn´t answered to your support.

The PC is now running well after your support.

The random shutdowns were due to a software collision of different Antivirus Programms(and Firewall) like Norton , Spybot, Malwarebytes etc.

Further more I did a forced Windows update with "wsusoffline" "UpdateInstaller.exe"

Yours sincerely

Bernie

Bert24 · September 5, 2011

Hi D-Fred,

today I had a random shutdown an the PC was only able to start after I pulled out the power cable. :angry:

Eset(atteched) has found something ,yesterday.

What should I do next ?

Thank for your support !

Bernie

D-FRED-BROWN · September 5, 2011

Glad to hear things are better

The random shutdown sounds like a power/battery issue to me- I don't think its malware related.

Let's run a deep scan to see if there's anything concerning:

Download the latest version of Kaspersky Virus Removal Tool

Close all other applications and double-click and run the installer.
When the Kaspersky Virus Removal Tool starts, to the right of Security Level click Recommended, and select Settings.
In the window that opens (Autoscan), in the Scope tab place a checkmark to the left of Parse email formats.
Click the Additional tab and click to place a checkmark to the left of Deep scan, and click OK.
Select all the scanable items except for CD-ROM drives and click the Start scan button.
If malware is detected, place a checkmark in the Apply to all box, and click the Delete button (or Disinfect if the button is active).
After the scan finishes, if any threat remains in the Scan window (Red exclamation point), click the Neutralize all button
In the window that opens, place a checkmark in the Apply to all box, and click the Delete button (or Disinfect if the button is active).
If advised that a special disinfection procedure is required which demands system reboot: click the Ok button to close the window.
In the Scan window click the Reports button and select Save to file.
Name the report AVPT.txt, and save it to the Desktop.
Close AVPTool.
You will be prompted if you want to uninstall the program; click Yes.
You will then be prompted that to complete the uninstallation, the computer must be restarted. Select Yes to restart the system.
Copy and paste the first part of the report (Detected) that you saved in your next reply.

Bert24 · September 6, 2011

Hello D -Fred,

I can´t install the Kaspersky Removal Tool.

First time the pc shut down while installing.

At second time a message appaered , have a look at it.

As I tryed Kaspersky in safe mode, the pc shows the same behavior.

When I started in safe mode I recognized a "new feature".

I attached some pictures of the problems.

The last message on the black screen was: "Press enter to continue loading SPTD.sys"

D-FRED-BROWN · September 7, 2011

Please download WVCheck from Artellos.com.

Double click WVCheck.exe. (If you downloaded the zipped version you will need to extract it.)
As indicated by the prompt, This program can take a while depending on your hard drive space.
Once the program is done, copy the contents of the notepad file as a reply.

Bert24 · September 8, 2011

Hi D-Fred,

here ist the log file:

Windows Validation Check

Version: 1.9.12.5

Log Created On: 0724_08-09-2011

-----------------------

Windows Information

-----------------------

Windows Version: Windows XP Service Pack 3

Windows Mode: Normal

Systemroot Path: C:\WINDOWS

WVCheck's Auto Update Check

-----------------------

Auto-Update Option: Download updates automatically, but ask me when I want to install them.

-----------------------

Last Success Time for Update Detection: 2011-09-08 05:11:52

Last Success Time for Update Download: 2011-09-08 05:13:39

Last Success Time for Update Installation: 2011-09-08 05:18:42

WVCheck's Registry Check Check

-----------------------

Antiwpa: Not Found

-----------------------

Chew7Hale: Not Found

-----------------------

WVCheck's File Dump

-----------------------

WVCheck found no known bad files.

WVCheck's Dir Dump

-----------------------

WVCheck found no known bad directories.

WVCheck's Missing File Check

-----------------------

WVCheck found no missing Windows files.

WVCheck's MBAM Quarantine Check

-----------------------

There were no bad files quarantined by MBAM.

WVCheck's HOSTS File Check

-----------------------

WVCheck found no bad lines in the hosts file.

WVCheck's MD5 Check

EXPERIMENTAL!!

-----------------------

user32.dll - b0050cc5340e3a0760dd8b417ff7aebd

-------- End of File, program close at 0724_08-09-2011 --------

What do think ? :huh:

D-FRED-BROWN · September 8, 2011

My sincerest apologies for the delay,

Let's try ComboFix:

Please download ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

***IMPORTANT: save ComboFix to your Desktop***

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please go here to see a list of programs that should be disabled.

**Note: Do not mouseclick ComboFix's window while it's running. That may cause it to stall**

Please include the C:\ComboFix.txt in your next reply for further review.

Also, please let me know if any problems still remain.

Bert24 · September 9, 2011

Hi D-Fred,

the log file is atteched.

Please have a look on it. :blink:

Thank you.

Bernie

Combofix.zip

Bert24 · September 9, 2011

Hi D-Fred,

here is al log from an other account with Antimalware:

Malwarebytes' Anti-Malware 1.51.1.1800

www.malwarebytes.org

Datenbank Version: 7674

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

09.09.2011 15:38:01

mbam-log-2011-09-09 (15-38-01).txt

Art des Suchlaufs: Quick-Scan

Durchsuchte Objekte: 155578

Laufzeit: 6 Minute(n), 18 Sekunde(n)

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 1

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0

Infizierte Speicherprozesse: