Member Panel

ash182

Hey, im on Xp professional. And my other pc now wont even boot. It comes up with a blue screen (not blue screen of death btw) with a load of information, and this error.

Technical Information:

*** STOP 0x0000007E? 0xc0000005, 0x81EB47D8, 0xF8940150, 0xF894CE50.

It will boot up in safe mode, but its terrible u cant see the bar at the bottom now, and its in 640X480 when it was 1024x768 before.

I'm pritty sure this is a virus, or spyware. Someone help my pc is getting worse!

joe5

Hya Ash182 , welcome to PCHF.

Did anything change before this happend? software or hardware?

Try to remove all usb devices , and also try to uninstall and reinstall youre videodrivers to see if that helps.

Incase its indeed a virus or spyware then try to follow these instructions:

http://www.pchelpforum.com/forum/index.php?topic=2206.0

ash182

Well, a few nights ago. It just restarted itself randomly. I think it could be spyware or a virus. Every time i loaded up the pc, it would get to the logon screen. When you logged on, after about 30 secs it would restart itself. I did a few scans, deleted some suspicious files via safe mode. But it still restarted itself. Now it wont even load into windows (except in safe mode).

joe5

Try the instructions i posted and then please post the Ewido and Hijackthis log.

PS, do you remember what files you deleted and how/with what?

ash182

ok. The hijack this log is up. I only deleted suspicious files.

joe5

Ill have a look at youre log and be right back. Legit files can also look suspicious sometimes , it could help if you remember what they where.

joe5

Before using Hijack This Can you please do this for me:

Download KillBox by Option^Explicit from HERE

Show hidden files and folders:

For XP:

1.On the Tools menu in Windows Explorer, click Folder Options.
2.Click the View tab.
3.Under Hidden files and folders, click Show hidden files and folders.
4.If you see a warning message, click Yes.
5.Click Apply.
6.Click OK.

Then disable system restore to prevent re-infection.
(if you have/use it.)
(you can turn it back on when youre pc is clean).

How to disable system restore:

WinXP.

Click the Start button.
Right-click My Computer, and then click Properties.
On the System Restore tab, check Turn off System Restore or Turn off System Restore on all drives.

Then click Start>Run and type in: services.msc
Click OK
In the Services window find:

Command Service

Select/highlight and right click the entry, and choose: Properties
On the General tab, under Service Status click the Stop button
Beside: Startup Type, in the drop menu, select: Disabled
Click Apply, then OK
Open HJT and click config > misc tools > ?delete an NT service?
Copy and past:

cmdService

Click OK.

Then start hjt and fix these entry's:

O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file)
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O16 - DPF: {B7E76C25-791F-432E-BDB7-748D01A93FC2} (VacPro.int_ver30) - http://advnt01.com/dialer/int_ver30.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{1DF650AF-61E9-40C6-8865-4F84C8F08AFB}: NameServer = 85.255.113.138,85.255.112.16
O17 - HKLM\System\CCS\Services\Tcpip\..\{B22C445A-9AB8-48FF-9C9F-1EF1573A91B9}: NameServer = 85.255.113.138,85.255.112.16
O17 - HKLM\System\CCS\Services\Tcpip\..\{B53BA201-AF29-4738-A5EC-61FD7A87A81E}: NameServer = 85.255.113.138,85.255.112.16
O17 - HKLM\System\CS1\Services\Tcpip\..\{1DF650AF-61E9-40C6-8865-4F84C8F08AFB}: NameServer = 85.255.113.138,85.255.112.16
O17 - HKLM\System\CS2\Services\Tcpip\..\{1DF650AF-61E9-40C6-8865-4F84C8F08AFB}: NameServer = 85.255.113.138,85.255.112.16
O17 - HKLM\System\CS3\Services\Tcpip\..\{1DF650AF-61E9-40C6-8865-4F84C8F08AFB}: NameServer = 85.255.113.138,85.255.112.16
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: repairs.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\YVNo\command.exe (file missing)

and delete the files in bold.

Also delete this file:

C:\Windows\System32\wuauclt.dll

and do a search for this file and delete it to:

IE2CLTR.DLL

After that do a search for this file:

repairs.dll

and remember the location.

Double click on Killbox.exe and then check the delete on reboot button.

Enter the filepath and filename that you just looked up into the Full path of "file to delete" box

Click the red circle with the white x and allow your computer to reboot.

A malicious .DLL file is disrupting the LSP chain on your computer. We need to get rid of it.
Please download LSPFix from here.
Disconnect from the internet and run the LSPFix.exe that you have just downloaded.
Check the I know what I'm doing box.
In the Keep box you should see one or more instances of newdotnet6_38.dll
Select every instance of newdotnet6_38.dll and move each one to the Remove box by clicking the >> button.
When you are done click Finish>>.

When youre done see if you can boot in normal mode and run a new hjt scan and post the log again please.

Member Panel

Sponsors and Ads

Noticeboard