Blinking Monitor...help!

Are you able to boot in normal mode yet? Or are you still working in safe mode w/networking?

Just tried to reboot in normal - no joy. Same "blinking" although it is now more like long periods of black with the odd flash of screen. Seems to work fine in Safe with Networking. I noticed that the last scan showed two virus' - could that be it, or is it more likely some other conflict? The reason that I posted here was that the blinking problem occurred immediately following an virus alert through Microsoft Essentials and a warning from WinPatrol - maybe this was just a coincidence. Thanks for all your efforts so far! Lee

The items found are in locations that would not be causing any issues, and they will both be removed when we uninstall Combofix. However, until the blinking problem is solved, I do not want to delete them. While I'm not seeing any evidence of malware on the system at this point, many problems that occur only in normal mode but disappear in safe mode are a result of a conflict. I've often seen it as a conflicting driver on the device. It is quite possible the malware caused some kind of corruption and that is the reason you noticed it immediately after. I'm going to see if I can get someone from the Windows forum to step in for a bit to see if they can assist in getting the monitor working again from a non-malware standpoint. I would normally refer you directly to the Windows Forum, but since we have been running all our scans in safe mode at this point, I do not want to deleted any Combofix backups or restore points until we have been able to get the monitor working and do a few "double check" scans in normal mode. Please be patient, we will be back to you shortly.

OK, we are going to look at your startup items in MSCONFIG and see if we can find what's causing the conflict:

If you are using a laptop be very careful when doing this that you don't disable anything regarding the keyboard or mouse


Please read and follow the steps in this tutorial on MSCONFIG (System Configuration). Once again, it is very important if this is a laptop NOT to disable keyboard or mouse items, so please check through the entries carefully. Follow the instructions at the bottom of this tutorial for troubleshooting what may be causing the conflict. Once you have identified it, please let me know and we can go from there.

If you have any concerns with how to perform the steps, or if you are unsure of any items to disable, please feel free to let me know.

HI there The link to the MSCONFIG tutorial does not seem to be working (at least on my browser) - It comes back with a "page not found" message. Tried to do a search but didn't come up with anything. Do yo u have another link? Thanks, Lee

My apologies. I didn't get that formatted correctly. Try this link..

Well…the frustration continues. I did the ERUNT backup, the proceeded to the run MSCONFIG. Disabled everything in Startup (and I have to say there was a heckuva load of carp** - 23 files in all. Some of them duplicates?) Rebooted in regular and the "blinking" was still there. As I said before..now what happens is that the Windows and Dell logos appear, then the hourglass flashes a couple of times, then nothing. It does not make it to the password screen. After two minutes or so the screen goes even a bit "blacker" if that makes sense. When I do a hard shut down, it happens immediately - no holding the button in for a few seconds before shutdown. Anyway - went back in an disabled the stuff in Services (after hiding Windows Services). Rebooted in regular only to have the same black screen happen again. So…I am back in Safe Mode with Networking. Lee

Looking back at your DDS Attach.txt I can see a NVIDIA GeForce FX 5200 that is showing as disabled. If this is your graphics card you are currently using (or if it's what came with the computer and you know you didn't change anything), that could be part of the issue. I'm not a hardware person, but let's see if this might be the problem.

• Click Start
• Click Settings
• Click Control Panel
• In the Control Panel double-click the Systems icon.
• In the System Properties window click the Hardware tab
• In the Hardware tab click the Device Manager button and you should see a screen showing all your devices.
• Look to see if you can find the NVIDIA item in the list
• You'll want to try to enable the device (if you are unsure of how to do this, please see this tutorial on using the device manager)
• Reboot and see if the problem is solved

Let me know how that goes.

Well…I located the Device Drivers while in Safe Mode with Networking, but when looking at the NVidia driver, it showed it as Enabled (although would not provide me with a status while in Safe Mode) Since I could not Enable, I decided to try the opposite and Disable it. When I rebooted in Regular - no blinking. The resolution seems a bit off, but the black screen is gone and I was able to log in. As I write this, the NVidia Device Driver is disabled, yet I still have a picture. I have not made any switches on the monitor cable to access a different video card, so am not sure what is going on. Ideas? Lee

Have you tried to enable it now that you are in normal mode? This seems to be a hardware issue and it's a little out of my realm but you can try that. As to resolution, you should also check your display properties and you can adjust your resolution there (it's in your control panel). I'd also feel better if we could get one clean scan in normal mode before we clean up our tools as well. Can you please run an ESET scan as per the previous instructions. And let's make sure nothing else shows up. Then we'll do some clean up of tools.

So…I went in and enabled the NVidia GForce 5200. The driver indicates as "working properly" and there continued to be no blackouts. When I went and tried a reboot into Regular, the black screens returned and the 'puter never made it to my log in screen before crapping out completely. Back to Safe Mode - disable the driver - reboot in Regular and enable the driver. Everything remains fine. I am attaching the ESET log and continue to be perplexed. It seems that something is happening on Start-Up, that's causing the issues. Lee ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=19a4089568ed5d488585c21d5d2f98f6 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-09-18 06:40:44 # local_time=2011-09-18 11:40:44 (-0800, Pacific Daylight Time) # country="United States" # lang=9 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 37067427 37067427 0 0 # compatibility_mode=5891 16776550 42 88 0 13123811 0 0 # compatibility_mode=7937 16777214 100 100 7498109 105807817 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=72173 # found=2 # cleaned=0 # scan_time=3106 C:\Qoobox\Quarantine\C\WINDOWS\system32\ntsdnsta.dll.vir Win32/PSW.Papras.BW trojan (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{33279A37-F310-483C-A6B0-6F5E1F8075A7}\RP657\A0023221.dll Win32/PSW.Papras.BW trojan (unable to clean) 00000000000000000000000000000000 I esets_scanner_update returned -1 esets_gle=0 # version=7 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=19a4089568ed5d488585c21d5d2f98f6 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-09-23 02:58:46 # local_time=2011-09-22 07:58:46 (-0800, Pacific Daylight Time) # country="United States" # lang=9 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 37441534 37441534 0 0 # compatibility_mode=1024 16777215 100 0 48057552 48057552 0 0 # compatibility_mode=5891 16776869 42 87 0 13497918 0 0 # compatibility_mode=7937 16777213 100 100 7872216 106181924 0 0 # compatibility_mode=8192 67108863 100 0 287952 287952 0 0 # scanned=107210 # found=2 # cleaned=0 # scan_time=4481 C:\Qoobox\Quarantine\C\WINDOWS\system32\ntsdnsta.dll.vir Win32/PSW.Papras.BW trojan (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{33279A37-F310-483C-A6B0-6F5E1F8075A7}\RP657\A0023221.dll Win32/PSW.Papras.BW trojan (unable to clean) 00000000000000000000000000000000 I

The following will implement some cleanup procedures as well as reset System Restore points:

• Click Start > Run
• Now type Combofix /uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
• [external image: Posted Image]

If there are any remaining tools or logs on your desktop you can right-click and delete them. I would advise keeping Malwarebytes as it is a program you'll want to run regularly.

This takes care of the items found in the ESET scan so you don't have to worry about them any longer.

At this point, your issues do not appear to be related to malware and I'd like to refer you to our Windows Forum for additional help. When posting there, please feel free to include a link to this post in case they need to see any information contained in the logs.

—————————————

Your logs appear to be malware free and you do not appear to be experiencing any malware related problems.
Please follow these simple steps in order to keep your computer malware free and secure:

Set a New Restore Point to prevent possible reinfection from an old one.
Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
* Go to Start > Programs > Accessories > System Tools
* Click "System Restore"
* Choose the radio button marked "Create a Restore Point" on the first screen then click "Next"
* Give the Restore Point a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
* Then go to Start > Run and type: Cleanmgr
* Click "OK"
* Click the "More Options" Tab.
* Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.

Visit Microsoft's Windows Update Site Frequently
It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Use and Update your AntiVirus Software
It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall
I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this. Simply using a Firewall in its default configuration can lower your risk greatly.

Use only one antivirus and one firewall on your machine
Having more than one anti-virus program and one firewall on your machine, even if only one is running, can cause conflicts and slowdowns in the performance of the machine.

If you need more information on free anti-virus or firewall options please let me know and I will give you some recommendations.

Make your Internet Explorer more secure
This can be done by following these simple instructions:
1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click once on the Security tab
3. Click once on the Internet icon so it becomes highlighted.
4. Click once on the Custom Level button.
5. Change the Download signed ActiveX controls to Prompt
6. Change the Download unsigned ActiveX controls to Disable
7. Change the Initialize and script ActiveX controls not marked as safe to Disable
8. Change the Installation of desktop items to Prompt
9. Change the Launching programs and files in an IFRAME to Prompt
10. Change the Navigate sub-frames across different domains to Prompt
11. When all these settings have been made, click on the OK button.
12. If it prompts you as to whether or not you want to save the settings, press the Yes button.
13. Next press the Apply button and then the OK to exit the Internet Properties page.

Keep your Java, Adobe Reader and Adobe Flash Up to Date
Older versions of these programs can contain security vulnerabilities. It is very important to keep them updated.

Update and Run Malwarebytes Anti-Malware
Scan your computer with this program on a regular basis just as you would an antivirus software making sure you update definitions each time you scan.

To simplify making sure you have the latest version of many of your security programs and applications, you may want to consider:
Secunia's Personal Software Inspector (PSI). It is a free utility that scans your computer for installed applications and checks to see if they have the latest security patches and updates. If it finds any applications with possible security issues, links and/or instructions are provided for the necessariy updates.

Filehippo's Update Checker. It is free utilitiy that scan your computer for installed software, checks the versions and then sends this information to see if there are any newer releases. Available software updates are displayed and you can decide which ones to download and install. Among many other types of programs, they includes a number of the Anti-Spyware, Firewall/Security and Anti-Virus programs that have been recommended (though not all of them). Note: Definition files should be updated from within the programs themselves. The Update Checker look for newer versions of the software program, not definition files.

I would suggest you read:
Tony Klein's excellent article: How I got Infected in the First Place
PC Safety and Security–What Do I Need?
How to Prevent Malware

Good luck & Happy surfing!

HI patndoris I just wanted to write and thank you for all your efforts. I have completed the "clean up" tasks you suggested and, if nothing else, my computer seems to be running a bit faster. The blackouts continue, but I will see what can be uncovered in the other forum. Thanks again Lee

You are very welcome. Good luck!

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.