Computer restarting itself

[Dave_Lethal]

This is crazy...I'm still getting the same popups, and today I was looking at my bank account online and the computer restarted itself!!! The screen went blank and next thing I know it's booting up. I've never seen anything like this before...something is seriously wrong with my pc.

Here is a HJT log file...Even though HJT doesn't seem to be helping my problem.
I ran spybot, adaware, AVG, TDS-3, Stinger, and CWShredder, and none of these programs are working. Any help would be hugely appreciated.

Logfile of HijackThis v1.98.2
Scan saved at 11:28:12 PM, on 12/7/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\rundll32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE
C:\PROGRA~1\YAHOO!\browser\ycommon.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\default\Desktop\Programs\HiJackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VBundleOuterDL] C:\Program Files\VBouncer\BundleOuter.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE"
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM32\SHDOCVW.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: Big Shot Roulette TM by pogo -
O16 - DPF: Bridge by pogo -
O16 - DPF: Buckaroo Blackjack TM by pogo -
O16 - DPF: Chess by pogo -
O16 - DPF: Command and Conquer Comanche by pogo -
O16 - DPF: Dice Derby by pogo -
O16 - DPF: Euchre by pogo -
O16 - DPF: Fortune Bingo by pogo -
O16 - DPF: High Stakes Pool by pogo -
O16 - DPF: Its Outta Here 2 by pogo -
O16 - DPF: Jungle Gin by pogo -
O16 - DPF: Mah Jong Garden by pogo -
O16 - DPF: Multiline Slots by pogo -
O16 - DPF: Pebble Beach 3 Hole Challenge by pogo -
O16 - DPF: Pebble Beach Golf by pogo -
O16 - DPF: Perfect Pair Solitaire by pogo -
O16 - DPF: Perfect Passer by pogo -
O16 - DPF: Phlinx by pogo -
O16 - DPF: Pirate's Gold by pogo -
O16 - DPF: Pop Fu by pogo -
O16 - DPF: Quick Shot by pogo -
O16 - DPF: Showbiz Slots 2 by pogo -
O16 - DPF: Squelchies by pogo -
O16 - DPF: Sweet Tooth TM by pogo -
O16 - DPF: Tank Hunter by pogo -
O16 - DPF: Texas Hold'em Poker by pogo -
O16 - DPF: The Sims Pinball by pogo -
O16 - DPF: Top Down Baseball Challenge by pogo -
O16 - DPF: Tri-Peaks by pogo -
O16 - DPF: Tumble Bees by pogo -
O16 - DPF: Vert Skater by pogo -
O16 - DPF: Word Whomp Whackdown by pogo -
O16 - DPF: World Class Solitaire by pogo -
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/c ... pote_x.cab
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {36C66BBD-E667-4DAD-9682-58050E7C9FDC} -
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} -

The 01's will not go away.
Some step by step help on how I can fully clean my PC would be great, even though I've tried everything under the sun. Thanks.

[PCguy]

I think I got this one finally.

Download this:

http://www.downloads.subratam.org/VX2Finder.exe

Make sure ALL PROGRAMS (IE included) are not running. Start it up, and then under the Verion list, tick all the versions you see.

Click on the *click to find VX2.BetterInternet* button.
Put checks beside all files found and click the "Delete these Files",

You will need to reboot for one or more of them, so do so immediately.
When you reboot, use the VX2Finder again (should be no files found).

Click these button's in this order.
"find VX2.BetterInternet", there should be no files found.
"UserAgent$" (dont be alarmed it will be rebuilt)
"Guardian.reg"
Then Click "Restore Policy"
This will repair the Debug privilege for Administrators that was removed by Look2Me.


You will need to Reboot for the changes to Apply
Run Vx2Finder(26) once more and click on the "find VX2.BetterInternet" button. Then click *make log*.
Post it here with a fresh HijackThis log please.

[liljim]

Edit:Follow PCGuy's fix first..(we posted at the same time):)


Hey Dave

It seems theres a new type of infection on the lose.You are an unfortunate victom of whatever it is.So far there's no handy little tool to remove it and none of the spyware or antivirus programs are picking it up.Were going to have to try something new..I need you to download a program called .

Create a folder to put it in,then run it.

Click "Run Locate.com"
then Continue
then "Make a log of what was found"
It will create a log named "log.txt" in the same folder .
Paste the contents of that log here

Now,here's the catch.You have to make sure your system doesnt reboot from the time you run the scan until after we find and remove what needs to be..If you do have infected files in this log,they will rename themselves on a reboot which would cause this fix not to work.

[Dave_Lethal]

Ok, I think my reboot problem was just a one-time fluke.

Here's what I've done so far.

I booted into safe mode with networking enabled...
I ran Adaware SE Personal, CWShredder, VX2Finder, TDS-3, Spybot S&D, Spyblaster, AVERT Stinger, Kill2Me, About:Blaster, LSPFix, and HJT.

I've been trying to fix the problem for days, with little success.

After hours of searching the internet for problems, I ran across a certain forum with someone else who had the exact same problem. I found that there were at least 15 dll files in my System32 folder that were created on 12/9 (the date I noticed the infection). There were also a couple exe files from that date as well. I deleted EVERYTHING from that day after, because it seems whatever I was infected with was generating dll's daily. There were 3 dll's that I couldn't delete, even in safe mode, so I left them on.

After I restarted, I noticed my internet connection was broken. One of the infected files I deleted was a LSP. HijackThis told me to run LSPFix, which I did, and it fixed 20 files.

Now my internet is up and running, and all those files are deleted except 3. I still get the occasional popup from some "spyware" company. Also, the redirect 01 entries on HJT are still showing up, but I haven't been redirected in awhile.

Whatever this monster is that I was infected with is driving me up the wall. At least now my pc seems somewhat stable, although I would like to get rid of this horrible infection for good.

If anyone has any suggestions, let me know. And a warning to all....DON'T VISIT ANY SITES THAT YOU DON'T KNOW, at least until someone has this thing figured out.

[Dave_Lethal]

And I have the VX2 log at home, if you still need to see it. There wasn't any infection there. Adaware SE deleted those, I believe. It finds nothing now.

I can post the VX2 log and a new HJT log when I get home from work tonight.

And I will download that program too, thanks pinkflower.

[lilpinkflower]

*hears name mentioned* hehe

Which program ?



lilpink x

[liljim]

Surely i wasnt mistaken for lilpink was i?

Try what i posted up there,im pretty confident that we can get it out that way.We can remove the dll's that dont want to be through command prompt if necessary but i need a logfile before i can recommend doing that.

[Dave_Lethal]

lol, sorry liljim, I was rushing, and your names are somewhat similar.

Anyway, I'm having yet ANOTHER problem connecting to certain websites (I cannot connect to this website, and I couldn't connect to the one to download DLLCompare) so I had to use my rooommates PC and transfer everything.

And my internet connection is VERY SLOW and very annoying.

It took an hour but it's finally done. Here's the log file for VX2 Finder:

Log for VX2.BetterInternet File Finder (msg126)

Files Found---

Additional Files---

Keys Under Notify---
App Management
AtiExtEvent
crypt32chain
cryptnet
cscdll
ScCertProp
Schedule
sclgntfy
SensLogn
termsrv
wlballoon


Guardian Key--- is called:

User Agent String---
{54404C35-FAED-4CAA-9702-01E089F27F64}

And for DLLCompare, I found it odd that it only found 1 thing:

* DLLCompare Log version(1.0.0.125)
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________

C:\WINDOWS\SYSTEM32\lv4s09~1.dll Thu Dec 9 2004 11:26:38p ..S.R 222,582 217.36 K
________________________________________________

1,360 items found: 1,360 files (1 H/S), 0 directories.
Total of file sizes: 285,193,057 bytes 271.98 M

Administrator Account = True

--------------------End log---------------------

I'm about ready to take in my PC for repair...that's how bad it sucks. I've never had a problem like this before.

[liljim]

Ok,Find and Delete

C:\WINDOWS\SYSTEM32\lv4s09~1.dll

If it does not want to delete,Go to start,run,type cmd and press enter.
You should get the following prompt (except with your username,not mine )

C:\Documents and Settings\Liljim>
Type cd .. (include the ..) press enter

Prompt will change too:
C:\Documents and Settings>
Type cd .. again (include the ..)

Prompt will change too:
C:\>

Type cd windows
Prompt will change too:
C:\WINDOWS>

Type cd system32
Prompt will change too:
C:\WINDOWS\system32>

At this point you need to open the task mamager (ctrl,alt,del)
Go to processes and end task on explorer.exe
Dont close task manager
Go back to the command prompt and type DEL lv4s09~1.dll

Go back to the task manager,click file>new task
Type explorer.exe ,click new task.

That particular file should be gone now,

Once its gone give us another hijack log.

Do Not Reboot if you can help it

[Dave_Lethal]

Too late. I shut down the PC to go to bed last night, and when I came back this morning the file was not found.

I ran the scan again, and I'm assuming I just do the same thing, but with these files in place of the old one?

* DLLCompare Log version(1.0.0.125)
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________

C:\WINDOWS\SYSTEM32\unrsdpia.dll Fri Dec 10 2004 1:03:50p ..S.R 222,956 217.73 K
C:\WINDOWS\SYSTEM32\lvl809~1.dll Fri Dec 10 2004 1:03:50p ..S.R 223,795 218.55 K
C:\WINDOWS\SYSTEM32\m4po0e~1.dll Fri Dec 10 2004 12:06:04a ..S.R 222,956 217.73 K
________________________________________________

1,360 items found: 1,360 files (3 H/S), 0 directories.
Total of file sizes: 285,194,644 bytes 271.98 M

Administrator Account = True

--------------------End log---------------------

[Dave_Lethal]

I tried exactly as you said, but the command window said all 3 files could not be found. I ran explorer.exe again and ran DLLCompare again. It found the same 3 files. I tried again, with no success. As I was typing this response, my browser attempted a redirect, and the computer restarted itself again!

I am now running in Safe Mode with networking enabled. Even in safe mode, when I opened my browser, I was instantly redirected to the a-d-w-a-r-e site.

What in the world is going on??

[liljim]

I definatly believe these are the files causing the problems,can you see the files from within windows?

[liljim]

Get me another hijack log too,lets see if those dll's are in the registry.

[Dave_Lethal]

[Dave_Lethal]

Here it is

Logfile of HijackThis v1.98.2
Scan saved at 6:07:45 PM, on 12/10/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\default\Desktop\Programs\HiJackThis\HijackThis.exe

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [VBundleOuterDL] C:\Program Files\VBouncer\BundleOuter.EXE
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE"
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM32\SHDOCVW.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: Big Shot Roulette TM by pogo -
O16 - DPF: Bridge by pogo -
O16 - DPF: Buckaroo Blackjack TM by pogo -
O16 - DPF: Chess by pogo -
O16 - DPF: Command and Conquer Comanche by pogo -
O16 - DPF: Dice Derby by pogo -
O16 - DPF: Euchre by pogo -
O16 - DPF: Fortune Bingo by pogo -
O16 - DPF: High Stakes Pool by pogo -
O16 - DPF: Its Outta Here 2 by pogo -
O16 - DPF: Jungle Gin by pogo -
O16 - DPF: Mah Jong Garden by pogo -
O16 - DPF: Multiline Slots by pogo -
O16 - DPF: Pebble Beach 3 Hole Challenge by pogo -
O16 - DPF: Pebble Beach Golf by pogo -
O16 - DPF: Perfect Pair Solitaire by pogo -
O16 - DPF: Perfect Passer by pogo -
O16 - DPF: Phlinx by pogo -
O16 - DPF: Pirate's Gold by pogo -
O16 - DPF: Pop Fu by pogo -
O16 - DPF: Quick Shot by pogo -
O16 - DPF: Showbiz Slots 2 by pogo -
O16 - DPF: Squelchies by pogo -
O16 - DPF: Sweet Tooth TM by pogo -
O16 - DPF: Tank Hunter by pogo -
O16 - DPF: Texas Hold'em Poker by pogo -
O16 - DPF: The Sims Pinball by pogo -
O16 - DPF: Top Down Baseball Challenge by pogo -
O16 - DPF: Tri-Peaks by pogo -
O16 - DPF: Tumble Bees by pogo -
O16 - DPF: Vert Skater by pogo -
O16 - DPF: Word Whomp Whackdown by pogo -
O16 - DPF: World Class Solitaire by pogo -
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/c ... pote_x.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} -