TechSpot

Unable to boot in Safemode, However can boot in Safemode with Networking. Trojan?

By Laidback
Sep 24, 2006
  1. Hello Im having a problem that quite a few people seem to be having over the net.

    My PC has been running extreemly slow lately, locking up when using Windows Task Manager, when using Internet Explorer etc. Safemode freezes just after chosing a user and clicking the syustem restore dialog. I can only get in using Safemode with Networking. I strongly think this is the work of a trojan as I have had multiple warnings before, however I thought these had been removed.
    I am suspicous about the activity of the windows task manager, I am unable to end processes for options such as csrss.exe and the svchost.exe. Should I be able to.
    Surely seven instances of svchost.exe is to many...
    Also internet explorer is consistently working offline...


    BUT To the main problem:

    My computer quite often on certain boot-up not open folders and programs that have not been loaded upon startup. When I click on any folders such as mycomputer, mydocuments, etc, the entire screen goes completely blank with only the desktop wallpaper visible for a few secs before returning to normal like nothing has been selected.
    I have tried system restore and get a message that it cant be done.
    Virus scans get nothing either. I use, adaware, edwido, trojan hunter, Nod32, spybot etc.

    The only thing that seems to work at the moment is safe mode with networking. Any ideas on what could be causing this?



    ---------------------------------------------------------
    ewido anti-spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 10:11:19 p.m. 24/09/2006

    + Scan result:



    Nothing found. <---- Hard to believe



    ::Report end

    Thanks for getting this far, your help is really abreciated. I feel as if the computer could die any minute. I'm using it for graphic design fur university work, both be an my sister. The computer is unbearably slow, its impossible to use the resource hog design programs that we need to run.

    P.s. Being my first post, I am just interested to know if you guys like long descriptive posts like the one I have done or should I cut the Chit Chat.
    Thanks again and Hello from New Zealand.
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Download the Pocket Killbox programme from HERE. Extract it but don`r run it yet.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Follow as many of the instructions below as you can.

    Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    PRINTV~1(printview)

    Close control panel.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    pvmodule.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)

    O2 - BHO: (no name) - {49D5A7B2-65FA-4C86-AFEE-848AFE3870EA} - C:\WINDOWS\system32\ssttt.dll

    O2 - BHO: (no name) - {B7672BAF-E9A3-49B6-86B2-C81719A18A4C} - C:\WINDOWS\system32\kblndbsn.dll (file missing)

    O2 - BHO: PrintViewBHO Class - {D4E0C464-30CE-4075-9A10-71FD106C2847} - C:\PROGRA~1\PRINTV~1\PRINTH~1.DLL

    O4 - HKLM\..\Run: [PVModule] C:\PROGRA~1\PRINTV~1\pvmodule.exe

    O17 - HKLM\System\CCS\Services\Tcpip\..\{8CFEAC44-BDC2-4E36-A71D-24B11B61ED0B}: NameServer = 202.180.64.2 202.180.64.9<Only fix this, if it doesn`t belong to your ISP.

    O20 - Winlogon Notify: ssttt - C:\WINDOWS\system32\ssttt.dll

    O20 - Winlogon Notify: winzdn32 - winzdn32.dll (file missing)

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\PROGRA~1\PRINTV~1 Delete the entire folder.

    Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted.

    This is the filepath you need to enter into killbox.

    C:\WINDOWS\system32\ssttt.dll

    Once your system has rebooted, turn system restore back on and rehide your protected OS files.

    Post a fresh HJT log as an attachment into this thread and let me know how your system is running. See HERE for instructions.

    Regards Howard :wave: :wave:

    This thread is for the use of Laidback only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  3. Laidback

    Laidback TS Rookie Topic Starter

    Any unnesesarry things that will be slowing my computer down?
    I can now boot up in Normal SafeMode

    THANKYOU!!
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Your HJT log is clean.

    You do have some processes running that are unecessary. You can stop the Ewido background guard if you like.

    Have HJT fix the following.

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O2 - BHO: IEPlugin Class - {CF7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\Advanced System Optimizer\IEHelper.dll

    O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe

    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    Use msconfig`s startup tab to disable anything you don`t want to start with Windows.

    You might like to take a look at this thread HERE.

    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    This thread is for the use of Laidback only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...