[Resolved] Screen freezes

Due, in part, to the large numbers of HJT logs being posted, there are four things that you need to be aware of.

1) If you have already posted this log at another forum, you need to post here that you have done so and this topic will be closed.
Multiple posting not only ties up valuable resources, but could also result is some unpleasant side-effects for your system if you follow two sets of instructions at the same time.
If, during research, an identical log is identified at another forum, this thread will be closed.

2) If you don't post a meaningful reply to any of my posts within five days, this thread will be closed. Due to limited free time I can only have so many open threads at any one time and if yours isn't active, somebody else's will be.
If, by omission, the thread hasn't be closed after five days and you post, it will just serve as a reminder to me to close it.
Please note that "I just dropped in to say Hi!" isn't a meaningful reply!

3) Malware removal is a tricky business, and malware writers don't tend to worry about the damage their creations do, so it is advisable to back-up all important files BEFORE we start. Although most cases have a successful conclusion, on occasion things don't go according to plan and it is better to be prepared for the worst.

4) Back-ups can get lost or damaged, so make two if the files are that important to you!

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pay a visit to the ESET Online Scanner.

• Click the ESET Online Scanner button, read the info in the new window, check the appropriate box and click Start.
• Accept the ActiveX download, and allow it to install.
• Once this has been completed, you will see the Computer Scan settings page - ensure that you uncheck the "Remove found threats" box and then click Start.
• The virus signature database will now need to be downloaded, so don't forget to instruct your firewall to permit it if it asks.
• The above will take a little time, so now is a good time to fire up the kettle and open the biccies.
• Once the scan has completed you will be shown the results - assuming that the scanner has found anything.
• Click List of found threats and then Export to text file… and save the log somewhere convenient.
• You can then close out the scanner - don't bother uninstalling it as you may need to use it again.
• Please post the contents of this file in your next reply, or let me know that nothing was identified.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Download Sec-Info2.zip from here and save it to your Desktop. You will need to extract the file.

Right click on the zipped folder and from the menu that appears, click on Extract All…
In the 'Extraction Wizard' window that opens, click on Next> and in the next window that appears, click on Next> again.
In the final window, click on Finish

You should now see a folder with a file in it - double click Sec-info2.vbs to run it.
Once you have been informed that the script has completed, a text file called Sec-Info.txt should be created in the same folder - you may need to wait a couple of seconds for it to appear..
Please copy and paste the contents of the text file into your next reply and then you can delete both of the folders and their contents.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Run HJT and click on Open the Misc Tools section.

• Click Open Uninstall Manager…
• Click Save list… and save it to your Desktop.
• Copy and paste the file uninstall_list.txt into your next reply.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Download RootRepeal from one of the locations below and save it to your Desktop:
Location 1
Location 2
Location 3

• Double click RootRepeal.exe to fire up the tool and OK any Windows confirmation if necessary.
• Ensure that the Report Tab is selected at the bottom.
• Click the Scan button, check ALL the boxes in the window that appears and then click OK.
• Check the box next to your main hard drive - usually C: and click OK
• Put the kettle on and perhaps open a packet of biscuits - the scan will take some time.
• Once the scan has completed a Notepad window will open with the results in.
• These results will also be saved to the root of your main drive as \RootRepeal report date time.txt

Let me have a copy of the contents in your next reply.

ESET Online Scanner reported nothing found. Sec-Info.txt: Script run: 1/3/2010 07:23:08 AM ~~~~~~~~~~~~~~~~~~~~~~~~ Company Name: ALWIL Software AV Name: avast! antivirus 4.8.1229 [VPS 091230-0] Version Number: 4.8.1229 On-Access Scanning Enabled: No Product up-to-date: Yes ~~~~~~~~~~~~~~~~~~~~~~~~ Company Name: COMODO Firewall Name: COMODO Firewall Pro Version Number: 3.0 Enabled: No ~~~~~~~~~~~~~~~~~~~~~~~~ The Windows Firewall is disabled. ~~~~~~~~~~~~~~~~~~~~~~~~ The Security Center Anti-Virus Alerts are enabled. The Security Center Firewall Alerts are enabled. ~~~~~~~~~~~~~~~~~~~~~~~~ Number of Restore Points found: 8 ~~~~~~~~~~~~~~~~~~~~~~~~ Uninstall_list.txt: Adobe Acrobat 5.0 Adobe Flash Player ActiveX Adobe Shockwave Player 11 Agere Systems AC'97 Modem America Online AnswerWorks 4.0 Runtime - English AnswerWorks 5.0 English Runtime AOL Coach Version 1.0(Build:20020823.1) Apple Software Update ATI Display Driver avast! Antivirus BellSouth FastAccess DSL Report Agent BroadJump PPPoE Brother MFL Pro Suite COMODO Firewall Pro Diskeeper Home Edition Driver Updater Pro Driver Updater Pro ESET Online Scanner v3 HijackThis 2.0.2 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB915800-v4) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB976098-v2) IBM High Rate Wireless LAN MiniPCI Card IBM TrackPoint Accessibility Features Images of Ireland Theme for Windows XP Intel® Network Connections Drivers John Ash's Wine Country Cuisine 1.0 Macromedia Flash Player 8 Malwarebytes' Anti-Malware Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB953297) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 3.5 SP1 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft Kernel-Mode Driver Framework Feature Pack 1.7 Microsoft National Language Support Downlevel APIs Microsoft Office 2000 SR-1 Disc 2 Microsoft Office 2000 SR-1 Professional Microsoft Silverlight Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Windows Theme Nunavut Microsoft Windows Theme Ontario Microsoft Works 4.5 Microsoft Works Calendar 1.0 Microsoft Works Setup Launcher MSXML 6.0 Parser (KB925673) NILE THEME PaperPort 8.01 SE PC Pitstop Driver Alert 1.0.0.13 PinPoint 2000 PowerDVD SE QuickTime RealPlayer Basic Security Update for CAPICOM (KB931906) Security Update for CAPICOM (KB931906) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 7 (KB938127-v2) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB976325) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Search 4 - KB963093 Security Update for Windows XP (KB923561) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371-v2) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Sophos Anti-Rootkit 1.3.1 SoundMAX SUPERAntiSpyware Free Edition System Update ThinkPad Configuration ThinkPad FullScreen Magnifier ThinkPad Power Management Driver ThinkPad Software Installer ThinkPad TrackPoint Driver ThinkVantage Access Connections TurboTax 2008 TurboTax 2008 WinPerFedFormset TurboTax 2008 WinPerProgramHelp TurboTax 2008 WinPerReleaseEngine TurboTax 2008 WinPerTaxSupport TurboTax 2008 WinPerUserEducation TurboTax 2008 wrapper TurboTax Home & Business 2006 TurboTax Home & Business 2007 TurboTax ItsDeductible 2005 TurboTax ItsDeductible 2006 TurboTax Premier 2005 Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Windows XP (KB942763) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951618-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) Viewpoint Media Player (Remove Only) WebIQ Technology Engine WexTech AnswerWorks Williams-Sonoma Guide to Good Cooking Windows Defender Windows Internet Explorer 7 Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows Media Player 11 Windows Presentation Foundation Windows Search 4.0 Windows XP Service Pack 3 RootRepeal report 01-03-10 (07-34-48).txt: ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2010/01/03 07:31 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ——————- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xB64E3000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF799D000 Size: 8192 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xBA7BE000 Size: 49152 File Visible: No Signed: - Status: - Hidden/Locked Files ——————- Path: C:\HIBERFIL.SYS Status: Locked to the Windows API! Path: C:\Documents and Settings\Monique\Cookies\monique@tribalfusion[1].txt Status: Could not get file information (Error 0xc0000102) Path: c:\documents and settings\monique\local settings\temporary internet files\content.ie5\ixlbp5iy\avatar-the-war-against-humans[1].htm Status: Allocation size mismatch (API: 1081344, Raw: 131072) Path: c:\documents and settings\monique\local settings\temporary internet files\content.ie5\ixlbp5iy\infections_removal_f27[5].htm Status: Allocation size mismatch (API: 1081344, Raw: 98304) Path: c:\documents and settings\monique\local settings\temporary internet files\content.ie5\i0au8i5h\screen_freezes_t109225[2].htm Status: Allocation size mismatch (API: 1081344, Raw: 65536) Path: c:\documents and settings\monique\local settings\temporary internet files\content.ie5\j14exmgf\us[1].htm Status: Allocation size mismatch (API: 1081344, Raw: 163840) Path: c:\documents and settings\monique\local settings\temporary internet files\content.ie5\xcj3bnql\screen_freezes_t109225[1].htm Status: Allocation size mismatch (API: 1081344, Raw: 65536) SSDT ——————- #: 011 Function Name: NtAdjustPrivilegesToken Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679cc8c #: 025 Function Name: NtClose Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb6553618 #: 031 Function Name: NtConnectPort Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679c3c4 #: 037 Function Name: NtCreateFile Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679c8a0 #: 041 Function Name: NtCreateKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb65534d4 #: 046 Function Name: NtCreatePort Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679c080 #: 050 Function Name: NtCreateSection Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679e084 #: 052 Function Name: NtCreateSymbolicLinkObject Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679ce72 #: 053 Function Name: NtCreateThread Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679bc50 #: 063 Function Name: NtDeleteKey Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679d0b8 #: 065 Function Name: NtDeleteValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb65539b2 #: 068 Function Name: NtDuplicateObject Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb65530ac #: 097 Function Name: NtLoadDriver Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679dd24 #: 116 Function Name: NtOpenFile Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679cab0 #: 119 Function Name: NtOpenKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb65535ae #: 122 Function Name: NtOpenProcess Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb6552fec #: 125 Function Name: NtOpenSection Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679c744 #: 128 Function Name: NtOpenThread Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb6553050 #: 177 Function Name: NtQueryValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb65536ce #: 192 Function Name: NtRenameKey Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679d7f2 #: 200 Function Name: NtRequestWaitReplyPort Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679c196 #: 204 Function Name: NtRestoreKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb655368e #: 210 Function Name: NtSecureConnectPort Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679dae6 #: 240 Function Name: NtSetSystemInformation Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679dec4 #: 247 Function Name: NtSetValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xb655380e #: 249 Function Name: NtShutdownSystem Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679c5d2 #: 255 Function Name: NtSystemDebugControl Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679c638 #: 257 Function Name: NtTerminateProcess Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679bf4a #: 258 Function Name: NtTerminateThread Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679be18 Shadow SSDT ——————- #: 383 Function Name: NtUserGetAsyncKeyState Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679ef3c #: 414 Function Name: NtUserGetKeyboardState Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679ed42 #: 416 Function Name: NtUserGetKeyState Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679ee3c #: 460 Function Name: NtUserMessageCall Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679ea8a #: 475 Function Name: NtUserPostMessage Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679e73c #: 476 Function Name: NtUserPostThreadMessage Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679e8e8 #: 491 Function Name: NtUserRegisterRawInputDevices Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679f03c #: 502 Function Name: NtUserSendInput Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679ec4c #: 549 Function Name: NtUserSetWindowsHookEx Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679f132 #: 552 Function Name: NtUserSetWinEventHook Status: Hooked by "C:\WINDOWS\System32\DRIVERS\cmdguard.sys" at address 0xb679f35c ==EOF==

Both your anti-virus and your firewall show up as disabled to some degree or other - did you do this yourself, or has it occurred as part of the issues that the PC has had, and how long has it been this way … assuming you knew about it.

The antivirus and firewall being disabled is my own doing, to let the scans run. To be honest my firewall and antivirus were not running when this problem started about a week ago. I had let all my security measures slide for about a year. Only after the freezing started did I enable and update everything. It took ages, in fits and starts because the computer locked up so much, but now I'm current. Since the updates it takes a good bit longer for the lockup to happen but it still does. Monique

The best advice I can offer given the circumstances is to back-up any important data and then reformat and reinstall. It is going to be impossible to guarantee a clean computer at the end of the removal process, which makes it something of a waste of my time and yours to start it in the first place. The possibility that legitimate files may have been infected or corrupted by the malware present on your PC, and also that security settings may have been lowered making your computer more liable to infection in the future, means that starting over is the easiest and most reliable solution to your problems. You also need to be aware of the risk of identity theft if you have accessed bank accounts with this computer or shopped online. Keylogging software could have recorded details of these actions and a lack of an effective firewall means that there is nothing to stop this information being sent home. If this does apply to you, i'd monitor your accounts and perhaps consider getting credit/debit cards, passwords etc… changed - obviously not using this PC!

Reformatting is out of the question right now because I've just been through a very sudden, very chaotic move and I can't find anything. My original CDs are God knows where and with all the patches I would have to download afterwards it would take weeks. All I have is a dialup connection. A guarantee is not what I'm looking for. All I want is for it to stop locking up. Updating my programs has already had a measurable effect. Are you saying that you don't even want to try? Monique

What I am saying is that given the circumstances it is likely that your OS is damaged to a degree that I cannot fix. I can recommend various scanners which may improve matters, or they may actually make things worse. If you do have infected files on your system there is a risk that these will be damaged during cleaning or even fully removed and then the computer may not even boot. If you are happy to take the risk then I will let you have the links and instructions, but I won't either take responsibility for the consequences or spend time trying to delve further into your problem. My free time is limited and I consider it wiser to spend it on issues that I feel have the potential to be successfully resolved through my efforts.

I am absolutely willing to take the risk. That's why I'm here. And no, I won't hold you responsible for the consequences. I'm the one who chose to go without protection for so long so the ramifications are mine. I do regret that you're not willing to see this all the way through but I suppose that's just more ramifications. Thank you for the time you've spent already. The computer is still locking up randomly. Also, some of my usual websites won't display anymore and give me a 403 error. Monique

Download Malwarebytes' Anti-Malware from here and save it to your Desktop - unless you already have it, in which case skip to the "updating" bit below.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• Ensure a checkmark is placed next to both Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware and then click Finish.
• If an update is found, it will download and install the latest version - you'll need to clear it with your firewall.
• Once the program has loaded, select Perform full scan and then Scan.
• When the scan has finished, click OK and then Show Results to view the results - no surprise there!
• If MBAM finds anything, check the box(es) and click Remove Selected.
• Please note - Leave unchecked any boxes that have \System Volume Information\ in the filepath. These pose no immediate risk to your PC unless you use System Restore and will be dealt with later.
• When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt

Let me have the MBAM log, a fresh HJT log (run in Normal Mode) AND a description of how your PC is behaving.

Given the number of scans that have been run on the system and the fact that not much is showing up, I tend towards the idea that this is a file corruption issue of some kind, but I can't be certain. As I cannot identify which file(s) are the problem, there isn't a lot I can do about it, which was the main issue with this problem in the first place. The wisest solution was and is to reformat, and there isn't much more I can say about the matter. While I appreciate that it may not be what you want to read, it's my "professional" opinion and it isn't going to change.

Ok fair enough. It's good to know that there doesn't seem to be any obvious malware causing this. I can certainly reformat down the road when I locate my CDs. Looks like I'll just have to live with the symptoms until then. Thanks very much for taking a look - you and your team provide a wonderful resource here. Monique

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.