What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] PC shots down

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My pc, sometimes, Shots down without warning and windows internet explorer often goes down. I even fast formated the Hard Drive in witch the OS is installed but it didn't work. Could you please help me? ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/12/16 03:40 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ——————- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xF7012000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF7B95000 Size: 8192 File Visible: No Signed: - Status: - Name: rootrepeal[1].sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal[1].sys Address: 0xF665C000 Size: 49152 File Visible: No Signed: - Status: - ==EOF== DDS (Ver_09-06-26.01) - NTFSx86 NETWORK Run by [removed] at 3:32:12,26 on 16-12-2009 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.608 [GMT 0:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\system32\svchost.exe -k netsvcs svchost.exe C:\Program Files\AVG\AVG9\avgchsvx.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Mail\wlmail.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Sérgio & Neny\Local Settings\Temporary Internet Files\Content.IE5\WXTLSQJX\dds[1].scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.pt/ uSearch Page = hxxp://search.live.com mSearchAssistant = hxxp://search.live.com/sphome.aspx BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 5.0\reader\activex\AcroIEHelper.ocx BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll BHO: Programa Auxiliar de Início de Sessão do Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll uRun: [RemoteCenter] c:\program files\creative\mediasource\remotecontrol\RCMan.EXE uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [CTSysVol] c:\program files\creative\sbaudigy2zs\surround mixer\CTSysVol.exe /r mRun: [CTDVDDET] c:\program files\creative\sbaudigy2zs\dvdaudio\CTDVDDet.EXE mRun: [SBDrvDet] c:\program files\creative\sb drive det\SBDrvDet.exe /r mRun: [UpdReg] c:\windows\UpdReg.EXE mRun: [CTXFIREG] CTxfiReg.exe mRun: [CTHelper] CTHELPER.EXE mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe" mRun: [PWCam] c:\program files\common files\pwc3800\PWCam.exe mRun: [BigDogPath] c:\windows\VM_STI.EXE PLEOMAX PWC-3800 mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\srgio&~1\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE IE: E&xportar para o Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15109/CTPID.cab TCP: {7E185F6F-F74A-49EE-9D21-50812CFE9E84} = 194.79.69.222,195.23.129.126 Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll Notify: AtiExtEvent - Ati2evxx.dll Notify: avgrsstarter - avgrsstx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ============= SERVICES / DRIVERS =============== R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-10-20 360584] S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-10-20 333192] S1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-10-20 28424] S2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2009-11-13 285392] S2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-10-21 54752] S2 PfDetNT;PfDetNT;c:\windows\system32\drivers\pfmodnt.sys [2009-6-23 15896] S2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-5-19 240512] S3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\system32\drivers\COMMONFX.sys [2009-6-23 99352] S3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.sys [2009-6-23 99352] S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\common files\creative labs shared\service\CTAELicensing.exe [2009-10-22 79360] S3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\system32\drivers\CTAUDFX.sys [2009-6-23 555032] S3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.sys [2009-6-23 555032] S3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\system32\drivers\CTERFXFX.sys [2009-6-23 100888] S3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.sys [2009-6-23 100888] S3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\system32\drivers\CTSBLFX.sys [2009-6-23 566296] S3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.sys [2009-6-23 566296] S3 fsssvc;Serviço Segurança Familiar do Windows Live;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864] S3 ZSMC302;PLEOMAX PWC-3800;c:\windows\system32\drivers\usbvm302.sys [2009-11-4 90968] =============== Created Last 30 ================ 2009-12-16 03:24 218,112 a——- C:\HijackThis.exe 2009-12-14 21:20 –d—– C:\Assalto.Ao.Metro.1.2.3.2009.DVDRip.x264-NYDIC 2009-12-09 04:10 3,250 a——- c:\windows\system32\wbem\Outlook_01ca78857e6e5968.mof 2009-12-03 18:46 23,040 a——- C:\Guião de Musicas preto.doc 2009-12-03 18:39 24,576 a——- C:\Guião de Musicas 2009.doc 2009-11-30 17:47 –d-hr– c:\documents and settings\sérgio & neny\Recent 2009-11-27 01:08 –d—– c:\program files\eMule 2009-11-21 20:09 –d—– c:\docume~1\srgio&~1\applic~1\LimeWire 2009-11-21 20:07 73,728 a——- c:\windows\system32\javacpl.cpl 2009-11-21 20:07 411,368 a——- c:\windows\system32\deploytk.dll 2009-11-21 20:06 –d—– c:\program files\LimeWire 2009-11-21 19:16 –d—– c:\docume~1\srgio&~1\applic~1\Desktopicon 2009-11-21 19:16 –d—– c:\program files\VDOWNLOADER 2009-11-16 19:24 –d—– c:\program files\SubSync 2009-11-16 19:23 249,856 ——– c:\windows\Setup1.exe 2009-11-16 19:23 73,216 a——- c:\windows\ST6UNST.EXE 2009-11-16 04:13 –d—– c:\program files\Ask.com 2009-11-16 04:12 –d—– c:\program files\uTorrent 2009-11-16 04:08 –d—– c:\docume~1\srgio&~1\applic~1\uTorrent 2009-11-16 04:01 –d—– c:\program files\BT Next Evolution ==================== Find3M ==================== 2009-12-16 03:28 3,932,160 a——- c:\documents and settings\sérgio & neny\NTUSER.DAT 2009-12-16 01:51 94,208 a——- c:\windows\DUMP6e3a.tmp 2009-11-13 02:13 360,584 a——- c:\windows\system32\drivers\avgtdix.sys 2009-11-13 02:13 333,192 a——- c:\windows\system32\drivers\avgldx86.sys 2009-11-13 02:13 12,464 a——- c:\windows\system32\avgrsstx.dll 2009-10-29 07:45 916,480 a——- c:\windows\system32\wininet.dll 2009-10-27 18:00 85,504 a——- c:\windows\system32\ff_vfw.dll 2009-10-22 22:14 444,952 a——- c:\windows\system32\wrap_oal.dll 2009-10-22 22:14 109,080 a——- c:\windows\system32\OpenAL32.dll 2009-10-22 20:03 86,327 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat 2009-10-21 05:38 75,776 a——- c:\windows\system32\strmfilt.dll 2009-10-21 05:38 25,088 a——- c:\windows\system32\httpapi.dll 2009-10-20 19:31 21,640 a——- c:\windows\system32\emptyregdb.dat 2009-10-20 16:20 265,728 a——- c:\windows\system32\drivers\http.sys 2009-10-13 10:30 270,336 a——- c:\windows\system32\oakley.dll 2009-10-12 13:38 149,504 a——- c:\windows\system32\rastls.dll 2009-10-12 13:38 79,872 a——- c:\windows\system32\raschap.dll 2009-09-25 05:56 662,016 a——- c:\windows\system32\SET11E.tmp 2009-09-25 05:56 1,506,304 a——- c:\windows\system32\SET121.tmp 2009-09-25 05:56 624,640 a——- c:\windows\system32\SET11F.tmp 2009-09-25 05:56 473,600 a——- c:\windows\system32\SET120.tmp 2009-09-25 05:56 3,063,296 a——- c:\windows\system32\SET126.tmp 2009-09-25 05:56 449,024 a——- c:\windows\system32\SET125.tmp 2009-09-25 05:56 39,424 a——- c:\windows\system32\SET122.tmp 2009-09-25 05:56 251,392 a——- c:\windows\system32\SET129.tmp 2009-09-25 05:56 1,023,488 a——- c:\windows\system32\SET12E.tmp 2009-09-25 05:56 357,888 a——- c:\windows\system32\SET12B.tmp 2009-09-25 05:56 205,312 a——- c:\windows\system32\SET12A.tmp 2009-09-25 05:48 81,920 ——– c:\windows\system32\ieencode.dll 2009-09-18 09:33 352,768 a——- c:\windows\system32\SET130.tmp ============= FINISH: 3:32:41,70 ===============

Attachments:

Post #2
[external image: Posted Image]

DO NOT use any TOOLS such as Combofix, Vundofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.


The issues with your computer that you list, doesn't appear to be related to Malware/Spyware/Virus but we can have a look.


Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.


Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
[external image: Posted Image]
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.


Please don't attach the scans / logs, use "copy/paste". .

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI