PC Often Boots with Black Screen

I should be able to run this scan within the next day. Thanks.

I've been trying to work on this PC via LogMeIn Rescue, hence the references to it below. I had my friend finish running RogueKiller directly once it killed the LMI connection.

RKreport.txt:
RogueKiller V5.2.7 [06/30/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRKgmailcom
Feedback: http://www.sur-la-toile.com/discussion-193…-Remontees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: Owner [Admin rights]
Mode: Scan – Date : 07/05/2011 11:11:49

Bad processes: 3
[SUSP PATH] lmi_rescue.exe – c:\users\owner\appdata\local\temp\lmir0004.tmp\lmi_rescue.exe -> KILLED
[SUSP PATH] LMI_Rescue_srv.exe – c:\users\owner\appdata\local\temp\lmir0004.tmp\lmi_rescue_srv.exe -> KILLED
[SUSP PATH] LMI_Rescue_srv.exe – c:\users\owner\appdata\local\temp\lmir0004.tmp\lmi_rescue_srv.exe -> KILLED

Registry Entries: 6
[SUSP PATH] HKCU\[…]\Run : Best Buy pc app (C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Best Buy\Best Buy pc app.appref-ms) -> FOUND
[SUSP PATH] HKUS\S-1-5-21-2490422246-3727496615-806778977-1000[…]\Run : Best Buy pc app (C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Best Buy\Best Buy pc app.appref-ms) -> FOUND
[HJ] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[…]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

HOSTS File:


Finished : << RKreport[1].txt >>
RKreport[1].txt

Quarantine.txt:


Time : 05/07/2011 11:11:49
————————–
[lmi_rescue.exe.vir] -> c:\users\owner\appdata\local\temp\lmir0004.tmp\lmi_rescue.exe
[LMI_Rescue_srv.exe.vir] -> c:\users\owner\appdata\local\temp\lmir0004.tmp\lmi_rescue_srv.exe
[LMI_Rescue_srv.exe.vir] -> c:\users\owner\appdata\local\temp\lmir0004.tmp\lmi_rescue_srv.exe
ERROR [best buy pc app.appref-ms.vir] -> c:\users\owner\appdata\roaming\microsoft\windows\start menu\programs\best buy\best buy pc app.appref-ms
ERROR [best buy pc app.appref-ms.vir] -> c:\users\owner\appdata\roaming\microsoft\windows\start menu\programs\best buy\best buy pc app.appref-ms

Close all running programs and run RogueKiller once again. 1. Right click on RogueKiller.exe and choose Run as administrator
2. When prompted, type 2 and then press Enter
3. The RKreport.txt will be generated next to RogueKiller.exe (on the desktop, if that is where you saved the program
4. If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe
Please post the contents of the RKreport.txt in your next reply.

Can you also let me know if there are any changes.

Satchfan

RKReport:

RogueKiller V5.2.7 [06/30/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRKgmailcom
Feedback: http://www.sur-la-toile.com/discussion-193…-Remontees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: Owner [Admin rights]
Mode: Remove – Date : 07/05/2011 12:42:31

Bad processes: 0

Registry Entries: 6
[SUSP PATH] HKCU\[…]\Run : Best Buy pc app (C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Best Buy\Best Buy pc app.appref-ms) -> DELETED
[SUSP PATH] HKCU\[…]\RunOnce : 201175_11_793524 ("C:\Users\Owner\AppData\Local\Temp\LMIR0005.tmp.bat.js") -> DELETED
[HJ] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[HJ] HKCU\[…]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[HJ] HKCU\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

HOSTS File:


Finished : << RKreport[1].txt >>
RKreport[1].txt

Quarantine:


Time : 05/07/2011 11:11:49
————————–
[lmi_rescue.exe.vir] -> c:\users\owner\appdata\local\temp\lmir0004.tmp\lmi_rescue.exe
[LMI_Rescue_srv.exe.vir] -> c:\users\owner\appdata\local\temp\lmir0004.tmp\lmi_rescue_srv.exe
[LMI_Rescue_srv.exe.vir] -> c:\users\owner\appdata\local\temp\lmir0004.tmp\lmi_rescue_srv.exe
ERROR [best buy pc app.appref-ms.vir] -> c:\users\owner\appdata\roaming\microsoft\windows\start menu\programs\best buy\best buy pc app.appref-ms
ERROR [best buy pc app.appref-ms.vir] -> c:\users\owner\appdata\roaming\microsoft\windows\start menu\programs\best buy\best buy pc app.appref-ms


Time : 05/07/2011 12:42:31
————————–
ERROR [best buy pc app.appref-ms.vir] -> c:\users\owner\appdata\roaming\microsoft\windows\start menu\programs\best buy\best buy pc app.appref-ms
[lmir0005.tmp.bat.js.vir] -> c:\users\owner\appdata\local\temp\lmir0005.tmp.bat.js

Hi Eric

Download Malwarebytes-Anti-Malware

Click here

• double-click mbam-setup.exe and follow the prompts to install the program.
• at the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware. and Launch Malwarebytes' Anti-Malware, then click Finish..
• if an update is found, it will download and install the latest version.
• once the program has loaded, select Perform quick scan, then click Scan.
• when the scan is complete, click OK, then Show Results to view the results.
• be sure that everything is checked, and click Remove Selected.
• when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Please remember to tell me how your computer is running.

Thanks

Satchfan

Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Database version: 7035 Windows 6.1.7601 Service Pack 1 Internet Explorer 9.0.8112.16421 7/6/2011 4:07:24 PM mbam-log-2011-07-06 (16-07-24).txt Scan type: Quick scan Objects scanned: 163693 Time elapsed: 5 minute(s), 58 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 1 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

My friend says the computer has been running better lately. I'll give you another update from her tomorrow. Thanks for your help, Satchfan.

OK Eric I'll wait to hear how things are before proceeding. Satchfan

Satchfan, everything looks okay to you, right? My friend says she hasn't had an issue in a few days.

Hi Eric

That’s good news but it’s a good idea to run an online scan before we tidy up.

Run ESET Online Scan

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan 1. Click the Eset online Scanner button.
2. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
• Double click on the Eset installer icon on your desktop.

3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Accept any security warnings from your browser.
6. Check Scan archives
7. Push the Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push List of found threats
10. Push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - when ESET doesn't find any threats, no report will be created.
11. Push the back button.
12. Push Finish
If a log has been produced post it in your next reply.

Satchfan

No report generated by ESET. Are we good to go?

Hi Eric

Yes that’s the final sign that all is well

Now that you’re free from malware, as long as your computer seems to be running well, please follow these simple steps to tidy up you computer and decrease the likelihood of getting infected again:


Uninstall OTL
• Double-click OTL.exe
• Click the CleanUp! button.
• Select Yes when the Begin cleanup Process? prompt appears.
• If you are prompted to reboot during the cleanup, select Yes.
• The tool will delete itself once it finishes, if not delete it by yourself.
NOTE: If you receive a warning from your firewall or other security programs regarding OTL attempting to contact the internet, please allow it to do so.

===================================================

Create a Restore Point• click Start, right-click Computer, and then Properties.
• in the left pane, click System protection. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
• click the System Protection tab, and then click Create.
• in the System Protection dialog box, type a description, and then click Create.
Remove old restore points• click Start button and in the search box, type Disk Cleanup, and then, in the list of results, click Disk Cleanup.
• if prompted, select the drive that you want to clean up, and then click OK.
• in the Disk Cleanup for (drive letter) dialog box, click Clean up system files. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
• if prompted, select the drive that you want to clean up, and then click OK.
• click the More Options tab, under System Restore and Shadow Copies, click Clean up.
• in the Disk Cleanup dialog box, click Delete.
• click Delete Files, and then click OK.
===================================================

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

• Download the latest version of Java Runtime Environment (JRE) 26 and save it to your desktop.
• Scroll down to where it says JDK 6 Update 26 (JDK or JRE)
• Click the Download JRE button to the right
• Select the Windows platform from the dropdown menu.
• Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u26 with JavaFX 1 License Agreement". Click on Continue. The page will refresh.
• Click on the link to download Windows Offline Installation and save the file to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel, Programs, Uninstall a program and remove all older versions of Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-6u26-windows-i586.exe to install the newest version.

• After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
  • On the General tab, under Temporary Internet Files, click the Settings button.
  • Next, click on the Delete Files button
  • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
    Trace and Log Files
• Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
• Click OK to leave the Temporary Files Window
• Click OK to leave the Java Control Panel.

===================================================

Recommended programs

SpywareBlaster. SpywareBlaster protects against bad ActiveX, it immunizes your PC against them. It blocks over 11,000 bad sites and uses no resources of your computer.

===================================================

Update and run Malwarebytes. This really is an excellent program that you should update and run on a regular basis, probably weekly.

===================================================

It’s important to keep programs up to date so that malware doesn't exploit any old security flaws.

FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated.

===================================================

MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

===================================================

I also recommend that you read the following:

How to prevent malware by miekiemoes

Safe computing

Satchfan

Okay, followed your recommendations. Thanks, Satchfan.

You're welcome Eric

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.