Options

Update failure/ reboot failure

Hello everyone. This seems to be the place to get answers so I have joined up! I come with a few problems and questions. I am currently running Vista sp2 on my laptop. Every time I have to do a Windows Update my laptop goes crazy. It takes forever to boot up because it freezes all the time. If I try to do the windows recovery thing built into Vista on start up that even freezes. I have to manually shut down the laptop by holding the power button down.

Also my computer will randomly shutdown/restart. When that happens it will attempt to restart itself but usually fails. I have to manually turn it back on and usually its ok from there. I get two different notices from windows, one says a certain file could be malware which I doubt it is. The other links me to a hotfix I can install. The problem with that is the hotfix talks about things that dont necessarily apply to the problem. The file it says is potentially malware is "xdvannn.sys"

Lastly my computer just restarted itself like is sometimes usually does but this time it just kept restarting itself over and over without loading anything at all. I was finally able to get it to load which leads me to believe its a OS problem which is very likely seeing how I am using Vista- the new ME! Any help would be appreciated. Should I try just installing the fix and see if it works? Does the hijackthis file look to be a problem with anything?

Thanks,
Eli

EDIT: Don't know if its relevant or not but also my FireFox is no longer keeping me signed into places. I changed nothing as far as setting in FireFox goes. It does remember the information but no matter what site I go to if I click on "remember me" or "Keep me signed in" it just dosent do it. Again I am not sure if that is relevant or not.

Comments

  • edited August 2009
    Hello,

    I've gone through your HijackThis log, but it did not indicate anything inherently malicious.


    Please download Malwarebytes' Anti-Malware by clicking the link below:
    http://www.besttechie.net/tools/mbam-setup.exe

    Double Click mbam-setup.exe to install the application.

    * Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select "Perform Quick Scan", then click Scan.
    * The scan may take some time to finish,so please be patient.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Make sure that everything is checked, and click Remove Selected.
    * When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    * The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    * You'll be required to post the contents of this log later.

    Please Note:
    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.



    Next let's have you download ComboFix.exe. Please visit this webpage for downloading and instructions for running the tool:

    Go here ======> A guide and tutorial on using ComboFix <====== Go here

    Please ensure you read this guide carefully and install the Recovery Console first.This applies to XP Pro and XP Home users only.If you have SP3 installed you will need to use the download meant for SP2.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should get a prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:

    (1) Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    (2) Click Yes to allow ComboFix to continue scanning for malware.

    When the tool is finished, it will produce a report for you.


    Please include the MBAM log and C:\ComboFix.txt for further review, so that we may continue cleansing the system.


    Caution: Never run and remove files with Combofix unless supervised by a qualified security analyst who is experienced in the use of Combofix. Misuse can cause serious computer problems.
  • edited August 2009
    Thanks for the reply. I attached the two new logs as both found and fixed things.
  • edited August 2009
    I see that Viewpoint is installed. Viewpoint, Viewpoint Manager, Viewpoint Media Player are Viewpoint components which are installed as a side effect of installing other software, most notably AOL and AOL Instant Messenger (AIM). Viewpoint Manager is responsible for managing and updating Viewpoint Media Player's components. You can disable this using the Viewpoint Manager Control Panel found in the Windows Control Panel menu. By selecting Disable auto-updating for the Viewpoint Manager -- the player will no longer attempt to check for updates. Anything that is installed without your consent is suspect. Read what Viewpoint says and make your own decision.
    To provide a satisfying consumer experience and to operate effectively, the Viewpoint Media Player periodically sends information to servers at Viewpoint. Each installation of the Viewpoint Media Player is identifiable to Viewpoint via a Customer Unique Identifier (CUID), an alphanumeric identifier embedded in the Viewpoint Media Player. The Viewpoint Media Player randomly generates the CUID during installation and uses it to indicate a unique installation of the product. A CUID is never connected to a user's name, email address, or other personal contact information. CUIDs are used for the sole purpose of filtering redundant information. Each of these information exchanges occurs anonymously.
    Viewpoint Manager is considered as foistware instead of malware since it is installed without user's approval but doesn't spy or do anything "bad". This may change, read Viewpoint to Plunge Into Adware.

    I recommend that you remove the Viewpoint products; however, decide for yourself. To uninstall the the Viewpoint components (Viewpoint, Viewpoint Manager, Viewpoint Media Player):
    • Click Start, point to Settings, and then click Control Panel.
    • In Control Panel, double-click Add or Remove Programs.
    • In Add or Remove Programs, highlight >>Viewpoint component<< , click Remove.
    • Do the same for each Viewpoint component.
    • Restart your PC when you're done.

    ============================================

    Next download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2
    • Double-click SystemLook.exe to run it.
    • Copy the content of the following codebox into the main textfield:
      :file
      c:\programdata\nvModes.dat
      
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply, along with a new ComboFix log.
    Note: The SystemLook log can also be found on your Desktop entitled SystemLook.txt
  • edited August 2009
    Again thanks for the speedy reply. Here are the two requested logs and I did get rid of Viewpoint as I dont use it and really dont know what it is.
  • edited August 2009
    Please rename the following file C:\WINDOWS\system32\nvModes.dat to nvModes.dat.xyz.

    Can I know if the problems you reported persist?
  • edited August 2009
    I seem to be having a hard time finding the file as it dosent appear in the system32 file. Any suggestions?
  • edited August 2009
    My bad...

    Please follow the instructions here to show all hidden files and folders:
    http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/hiddenfiles.mspx

    Then locate the nvModes.dat file again.
  • edited August 2009
    Well I am running Vista as stated above. I did manage to un-hide files and folders but it appears the file isnt there still.

    EDIT:

    Ok I have found the file but it is not in System32. It actually isnt in the Windows folder at all. It is under a hidden folder in the root of my drive.
  • edited August 2009
    Oh you are right! The file is at c:\programdata, not at the system32 folder. Sorry for that Eli.

    Well OK can I know how your PC is running now?


    I'm going out for a while now, so I will only be able to reply to this thread later.
  • edited August 2009
    Ah no problem. Well it hasnt restarted or shut itself down since I have done the things you asked. My FireFox still isnt keeping me signed in but I dont think that has anything too huge to do with the system itself. Will keep you updated if anything comes up. Thanks.
  • edited August 2009
    I will keep this thread open, just let me know what happens after you use your PC for a week or so.
  • edited August 2009
    Update time! Just did it again today. I had just opened up Skype and then boom...restart itself....infinite reboot started going on. Had to hold the power to turn it off....after waiting some time I turned it back on and it was still doing the infinite reboot. After several cycles of turning it off and on I finally was able to get it to turn on. I noticed during the start up process for Windows, (you know the usual Microsoft Corporation with the scrolling green bar) that it was lagging or really bogged down. it took several seconds for the words to appear and lighten up. Then the bar itself was lagging for a few seconds also. After that it started to run fine. Windows started and gave me the potential malware error with said file as posted in the first post. Any ideas what in the world is going on?
  • edited August 2009
    OK....let's have you go HERE to run Panda ActiveScan 2.0
    • Click the big green Scan now button
    • If it wants to install an ActiveX component allow it
    • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
    • Once the scan is completed, please hit the notepad icon next to the text Export to:
    • Save it to a convenient location such as your Desktop
    • Post the contents of the ActiveScan.txt in your next reply.


    By the way xdvannn.sys seems to be something from XTrap, do you know anything about that?
  • edited August 2009
    Well I have good news and bad news. After working all day yesterday I come home and get my laptop running. To my surprise it runs in safe mode. I have no idea why it ran in safe mode. After doing an msconfig I see no reason why it booted in safe mode still. After doing a couple reboots I am told my HD is corrupt and I have to reformat my HD. So I now have a freshly installed OS on my laptop.

    BTW the file from Xtrap is what a lot of MMO games use to check for bots and other forms of hacks. If something is detected it restarts your computer instantly. Which is weird because it only ever gave me the error when I WAS NOT playing any games. Well thanks for your help Chiaz.
  • edited August 2009
    Glad to hear that the matter is now resolved.

    This topic is now closed.

    If you wish to reopen your topic, please send a Private Message (PM) to Trogan with a link to your thread.

    If you are not the user who started this thread, you must start your own Thread instead :)
Sign In or Register to comment.