Comments on: Why does my desktop keep crashing?

Question: Why does my desktop keep crashing?

ZaneJ. — Thu, 17 Jan 2008 21:48:37 -0800

Why (and how do I fix it) does my Windows desktop keep crashing?

I recently had an issue with some adware, Vundo, and other nefarious computer programs. After resolving that issue, my computer's desktop keeps disappearing. All the icons disappear, the taskbar becomes unusable; the clock even stops updating. When I drag my mouse across the taskbar it gives me the little 'working' icon, for me the hourglass. Windows Task Manager still works fine, and gives me some control. I'm leery about using the System Restore option, in fear of re-introducing the malicious programs I've removed back onto my machine. I'm also cheap, and don't want to take my comp into the repair shop if it's something I can easily do myself.

By: B(oYo)BIES

B(oYo)BIES — Thu, 17 Jan 2008 22:45:08 -0800

Do you have your Windows disks? Or recovery disks? Or recovery partition? Even if you did want to take it to a tech, it sounds like this malware has embedded itself pretty deep into your system. Your best bet is going to be reformatting the PC.

By: pompomtom

pompomtom — Thu, 17 Jan 2008 23:00:26 -0800

Backup, format and reinstall is going to be faster than diagnosis.

By: Krrrlson

Krrrlson — Thu, 17 Jan 2008 23:43:50 -0800

Vundo was a bitch and a half to remove on my machine -- in fact, I suspect there are still remnants of it somewhere.

I recommend you back up all your data in preparation for a reformat/reinstall, and then run System Restore. If Vundo doesn't come back, you're set; otherwise, reformat and reinstall.

By: tradeer33

tradeer33 — Fri, 18 Jan 2008 04:48:57 -0800

I agree with the others, Backup your important data. I would try the VundoFix first just to make sure it was gone. Then if your on a hi-speed connection, boot into safemode with network support, *f8 right after post* you should get the list with safemode listed. If you can boot into safemode try to download Hitman Pro 2 it downloads and runs several different anti-malware programs and scans automatically. go ahead and babysit it in case it errors out on one of the installs. after its done in safemode. Restart in normal mode and see if your issue is still there. If it is go ahead and format and reload windows. This is just another step to try before

By: tradeer33

tradeer33 — Fri, 18 Jan 2008 04:50:14 -0800

.....another step to try before losing all your programs that you had installed.

By: damn dirty ape

damn dirty ape — Fri, 18 Jan 2008 06:55:09 -0800

Yuore best bet is to reinstall. Spyware cant usually be cleanly removed and misanthropic spyware writers seem to make an effort to destroy the OS if tampered with. You can probably get away with a repair install, but that might just be prolonging the problem.

By: samsara

samsara — Fri, 18 Jan 2008 08:02:38 -0800

My job consists of cleaning this kind of spyware daily. 99% it is fixable without having to reformat, but you have to do a thorough sweep to make sure all load points are removed.

These load points usually consist of startup items and services, BHOs, LSP hooks, Shell hooks, and rootkits.

Here's the step by step:

- Download HijackThis, run a scan, and post your result log here. (to help with the identifying process)

- Download Spybot and do a full scan. This is probably the best antispyware program I've come across for the tough ones (I usually run this along side Mcafee Anti-spyware but that one costs...Adaware is decent as well though hasn't been as successful lately)

- If the problems still persist after running a full scan, open a cmd prompt, and type the following:

cd \windows\system32
dir/a/od *.* > %userprofile%\desktop\results.txt

- Open results.txt on your desktop and copy paste the more recent items (at the bottom of the list..stuff within the past few months really) here.

By: samsara

samsara — Fri, 18 Jan 2008 08:07:46 -0800

Oh and for those dlls or processes that stick in memory and refuse to be deleted, try unloading them via APM. It's one of the few process manipulators that can successfully remove ugly entrenched dlls from memory.

By: samsara

samsara — Fri, 18 Jan 2008 08:11:01 -0800

Direct download link for APM

By: ZaneJ.

ZaneJ. — Fri, 18 Jan 2008 09:43:09 -0800

Giving it a try, samsara. A friend helped me build this computer a few years ago and used a cracked Windows program to install the OS; read, I don't have the Windows cd's to do a reinstall. Trying what you suggested now.

By: ZaneJ.

ZaneJ. — Fri, 18 Jan 2008 10:55:22 -0800

Here is the log from HijackThis, samsara.

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 10:54:44 AM, on 1/18/2008
Platform: Windows XP (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Documents and Settings\Zane\Desktop\Anti-malware Programs\HiJackThis_v2.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Zane\Desktop\Anti-malware Programs\APM\apm.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.evergreen.edu/
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: {93a2bc88-3bbc-6c9b-2074-cb13d67a15c3} - {3c51a76d-31bc-4702-b9c6-cbb388cb2a39} - C:\WINDOWS\System32\ifpbwabp.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {CA4F0D8D-5F2B-4F16-838A-8D52249EAB21} - C:\WINDOWS\system32\cbxwxut.dll (file missing)
O2 - BHO: (no name) - {F8A42ECE-0C70-400A-9D6A-A58DCD49DA45} - C:\WINDOWS\System32\pmnno.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\wianmpa.exe
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingA1209] command /c del "C:\WINDOWS\system32\pmnno.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1847] cmd /c del "C:\WINDOWS\system32\pmnno.dll_tobedeleted"
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [QdrModule11] "C:\Program Files\QdrModule\QdrModule11.exe"
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O16 - DPF: {38481807-CA0E-42D2-BF39-B33AF135CC4D} - http://10.17.1.10/av/youhaveavirus.html
O20 - Winlogon Notify: cbxwxut - cbxwxut.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

--
End of file - 4652 bytes

By: samsara

samsara — Fri, 18 Jan 2008 12:37:46 -0800

Great. It looks like spybot found some stuff and is in the process of deleting it (the two dlls in system32).

Let's see if that alone clears it up.

Let these stay for the reboot:

O4 - HKLM\..\RunOnce: [SpybotDeletingA1209] command /c del "C:\WINDOWS\system32\pmnno.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1847] cmd /c del "C:\WINDOWS\system32\pmnno.dll_tobedeleted"

Check the following off and "Fix" with HijackThis:

O2 - BHO: {93a2bc88-3bbc-6c9b-2074-cb13d67a15c3} - {3c51a76d-31bc-4702-b9c6-cbb388cb2a39} - C:\WINDOWS\System32\ifpbwabp.dll (file missing)

O2 - BHO: (no name) - {CA4F0D8D-5F2B-4F16-838A-8D52249EAB21} - C:\WINDOWS\system32\cbxwxut.dll (file missing)

O2 - BHO: (no name) - {F8A42ECE-0C70-400A-9D6A-A58DCD49DA45} - C:\WINDOWS\System32\pmnno.dll

O4 - HKCU\..\Run: [QdrModule11] "C:\Program Files\QdrModule\QdrModule11.exe"

O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

^^I'm not sure about QDR, RegistryBooster, and Ad-aware's part in the locking issue, so just removing them for now to narrow down the possibilities...you can always reinstall them later if they are preferred.

I'd also consider removing daemon tools and AVG via add/remove programs if the machine is still locking up after reboots (remove one at a time, reboot, then test) For AVG I would reinstall it afterwards but with a more basic install.

Good luck, please let me know if you are successful with spybot and the above recommendation! You can also mefi-mail me if I don't respond right away.

By: samsara

samsara — Fri, 18 Jan 2008 12:40:52 -0800

These slipped by...zap them as well with HJT:

O16 - DPF: {38481807-CA0E-42D2-BF39-B33AF135CC4D} -http://10.17.1.10/av/youhaveavirus.html

O20 - Winlogon Notify: cbxwxut - cbxwxut.dll (file missing)

By: spankbot

spankbot — Fri, 18 Jan 2008 13:53:36 -0800

It's sometimes imposable to completely remove this junk. It can be VERY time consuming to even try. So, backup, format, and re-install. Once the computer is working again, make sure you have a hardware firewall ($40 Linksys is fine), install Spy-Bot, Ad-Aware. Use OpenDNS, install PeerGuardian. Never use Internet Explorer - get Firefox or Opera.

You could also just get a Mac and not have to worry as much about this stuff - spend more time using your computer.

By: Psionic_Tim

Psionic_Tim — Fri, 18 Jan 2008 16:08:43 -0800

While I understand that system admins may not want to spend the time removing spyware or viruses, there are very few cases in which a system cannot be cleaned. I very recently stopped doing this for a living, and used to get a thrill from repairing an OS that other would claim could not be repaired.

Samsara's advice is sound, just for a second opinion.

I can also attest to the team at SpywareInfo Forums. If you get stuck, try posting on their malware removal forum.