[FASTONE]

Hey - I was recently on my computer and I remember a box came up on the screen along with a black box with some writing in it...After that, my computer restarted itself...It happened so fast that I didnt get a chance to even read what it said on the screen. Everything has seemed fine after this until the other night. I logged onto my computer and once on, a Windows Explorer has encountered a problem and has to close popup came up and continues to come up. If I hit dont send, everything on my desktop, start bar at the bottom etc disappear except for my background and then reappear seconds later. The popup then comes back and continues to do this. I have been cleared from the Hijack This forum and also typed this into run: sfc /scannow...It went through but never found anything wrong. Also, I recently ran a spyware scan and the problem seemed to be taken care of...I was then told to make a new restore point by doing this:

Click Start >> Run - type SYSDM.CPL & press Enter
* Select the System Restore Tab
* Tick on the checkbox - "Turn off System Restore on all drives"
Click Apply
* Then untick the same checkbox & click OK

After doing so, the popup has come back and everything seems to act weird...Do you happen to know what might be going on here - I have no clue. Thanks for the help in advance...Have a good one.

This is what the error signature says:

AppName: explorer.exe
AppVer: 6.0.2800.1221
ModName: msvcrt.dll
ModVer: 7.0.2600.1106
Offset: 00033618

This is also the file that it was going to send if I had allowed it too:

C:\DOCUME~1\Chris\LOCALS~1\Temp\WER67C.tmp.dir00\appcompat.txt

If you need additional information, let me know and I can try to get it for you.

 

[FASTONE]

One more thing that I wanted to add...I noticed everytime I exit Internet Explorer and get back in, any of the websites that I go to (Hotmail, this forum) it does not keep any of my information even after I check remember me. Also, I have noticed a noise coming from my computer lately...It is a weird noise and lasts for a few seconds and then stops...Almost like something is failing...Not sure if any of it is related but I wanted to give you as much detail as possible with everything that has been going on lately.

 

[Kalim]

Hi and welcome to TSF FASTONE :grin:

Sorry I didn't see the post earlier.

It seems to me its a driver/hardware issue.

Has your system been running well before this?
Do you have SP2 and all the latest updates installed?
Did you add/change anything in software/hardware before this started happening?

*Download Memtest86, burn the downloaded ISO image file onto a CD using software such as Nero and the reboot your system with the CD inside.
*When it restarts, on the first black screen (POST) press F8 (some may be F4) and it'll give you a boot from menu.
*Choose boot from CD-ROM as the first bootable drive and hit enter.
*Then Memtest should run and display its screen. Give it 4 hours or so and let i it run. See if any and how many errors show up.

This is testing you RAM, the first hardware to show corruptions as such.

Thanks.

 

[petercj]

Click Start >> Run - type SYSDM.CPL & press Enter
* Select the System Restore Tab
* Tick on the checkbox - "Turn off System Restore on all drives"
Click Apply
* Then untick the same checkbox & click OK

The idea is to switch off System Restore, and then restart your computer, and then switch it back on - did you do this?

Failing to get this procedure right, could mean you have restored back to an infected set of files.

 

[hwm54112]

If possible please try the following:

msvcrt are generally application errors, usually not memory issues. you keep losing your desktop because explorer is closing and reopening. try opening task manager (rite click on the task bar). find explorer.exe in the processes window, click on it then click end process. Your desktop will disappear. don't worry. hold down ctrl+alt+del keys. task manager will open - under file menu> select new task "run". type in explorer.exe OK desktop will return - any errors?

start>run type in eventvwr . Click OK. In the window that pops up, click on any entry in the left pane. in the right pane, highlight any "error" entry (red x), right click on it and select properties. look at the descriptions until you see ones that include "msvcrt.dll". please post the source, category, event ID number and description.

Tip: after you are in the properties box, you can use the up and down arrow buttons to scroll thru the event descriptions without going thru the rite click /properties thing for each entry

turning off/on system restore won't have an effect unless you actually do a system restore. that just seems to be a coincidence

start>all programs>accessories>sytem tools>system information>view tab>current system info>expand software enviro>click on "loaded modules" - in rite pane check date of msvcrt - should be about the same as most other microsoft xp dlls

 

[Girderman]

A Google of the text "WER67C" produces exactly one hit, which is to link on a "Devastating" malware problem here.

http://www.geekstogo.com/forum/index.php?showtopic=123499

Might be worth a read.

Going to go read your HJT Log thread. Back in a bit.

 

[Girderman]

Okay I just read your HJT thread:

http://www.techsupportforum.com/security-center/hijackthis-log-help/126176-computer-going-crazy-help.html

In the very beginning, Reid said:

Your system is terribly infected with numerous types of malware.

The thread is three pages long, the last post is the OP posting another HJT log and the way I read it the OP has NOT been cleared from the Security Forum.

Please explain this, if you can.

 

[hwm54112]

Please explain this, if you can.

explained

 

[Kalim]

Yes a slight confusion. I read the thread, wow! Towards the very end, Reid has stated to post here and say that he is all clear from the malware side.

Seems you never had any security software installed and browsed around on the worst sites as your PC was atrociously infected. With that in mind, I think your OS is now damaged. This is usually a by-product of being infected.

We'll wait for your Memetest86 results.

 

[Girderman]

Has the OP run a Repair Install yet ?

 

[Kalim]

Has the OP run a Repair Install yet ?

Nope. I would bank on that to be the next step to be honest as it would save a lot of mucking around I see coming i.e. like in the cannot delete file thread.

I've experienced this error endless times and troubleshooted for many others too. With me on two separate installs it was a corrupt OS and nothing of anything managed to fix it but a clean install.

 

[Girderman]

I feel kind of bad for Reid personally, and all the other HJT Techs in general, as I see this often. All the effort to clean the malware, and in the end a new install still has to be done.

Are there any efforts an internationally criminalizing the creation and distribution of malware ?

 

[FASTONE]

Hey - I just wanted to let you know that when I turned on my computer last night, the message showed up. I have turned my computer on tonight and have not seen a message yet...Does it usually do this (Pop up when it wants too?) How bad is it hurting my computer if I was to not do anything (Reinstall everything) and leave it the way it is? It seems to work fine after the message has come up and I dont close that box...I just move it to the side and can still access the internet/folders etc. The only thing I do notice is that no passwords, emails addresses etc are not remembered everytime I turn on the computer...Is this because I close the internet or shut the computer off, explorer is shutting down then turning on and it loses that information? I have also noticed that the computer will be sluggish and weird at times but I am not sure if it is caused by this problem. Ried has asked me to post a new Hijack This log to see if he can see anything that might be causing this...I will wait to see if he can see anything. Also, there are so many different virus protection programs out there...Which one is truly the best for the money? I have read tons of reviews for Symantec, McAfee, Norton etc and some people say such and such and horrible and others say it works great...Do you think one is better than the other? Thank you very much for your time and effort...Hopefully this problem does not require a reinstall of everything.

 

[petercj]

Have a look at Tools>Internet Options on the IE top bar and see what the settings are - I would make sure the settings are ok and then clean out cookies and temporary files for a fresh start. But, it sounds like you have some malware on your PC that might be calling the shots - the sooner you get another HJT done the better, these things tend to grow rather than just disappear.

As far as AV's go, a lot is down to personal preference, some people swear by Norton, others swear at it - I have seen Norton mentioned in a lot of problem solving posts, and I would never use it.

I use the free AVG and Spybot and Ad-aware (both free versions) and things seem to work well. In terms of value for money, I don't see how anyone can beat the free AVG, which comes with automatic daily updating - at no cost whats so ever.

I opted for a router with a commercial class built in firewall, and that has been a really good investment.

I had four computers wiped out about two years ago by a hacker who kept bombarding our PC's with malware and these guys on TSF helped me sort it out. It's a great site.

 

[Kalim]

I feel kind of bad for Reid personally, and all the other HJT Techs in general, as I see this often. All the effort to clean the malware, and in the end a new install still has to be done.

Are there any efforts an internationally criminalizing the creation and distribution of malware ?

So do I to be frank. Many thorough embedded repairs leave your system unstable and damaged anyway. If a virus has already caused damage to system files and your OS, a repair is needed at minimum anyway. Best to move your storage another media, d/l and run Belarc Advisor> Get your product keys for everything and make a printout of all you have installed> d/l UBCD, nLite and Ryans VM > make those discs by adding all the software you need to install> wipe the HDD with something like KillDisk> Run UBCD diagnostic tools> Format and reinstall Win again moving the files/folders back over again. You'll have a perfectly working system there unless you have other hardware errors.
Yes, there always is an effort against malware, but its not enough. Either google or yahoo was indicted over an email they sent out to customers a while back which actually contained (by a tiny mistake) a porn virus. It was a story that was kept quite hidden and won;t appear for far in google searches. To me the only effort seemingly is when money can be sought out of it. Thats where justice opposes cash.

Does it usually do this (Pop up when it wants too?)

No it shouldn't. Its a sign of either a driver conflict of some software, RAM problems or OS corruption.

How bad is it hurting my computer if I was to not do anything (Reinstall everything) and leave it the way it is?

If it gets worse you may loose everything.. as bad as that sounds I guess.

It seems to work fine after the message has come up and I dont close that box...I just move it to the side and can still access the internet/folders etc. The only thing I do notice is that no passwords, emails addresses etc are not remembered everytime I turn on the computer...Is this because I close the internet or shut the computer off, explorer is shutting down then turning on and it loses that information?

Do you hibernate your computer by any chance?

I have also noticed that the computer will be sluggish and weird at times but I am not sure if it is caused by this problem.

Maybe you have some remnants left over or maybe a CPU usage/Mem usage issue there.

Also, there are so many different virus protection programs out there...Which one is truly the best for the money? I have read tons of reviews for Symantec, McAfee, Norton etc and some people say such and such and horrible and others say it works great...Do you think one is better than the other?

I've tried near enough every one of them. My personal fav in all is avast! (free) and AVG (free) although AVG less than avast! for problems with Thunderbird. Firewalls - I use Sunbelt Kerio as my fav there and have a router firewall aswell. Never had much luck with any other but one called AD which is for the veteran experienced ones in this field. Only ASAP security analysts would probably know of it and even that, only some of them.

Its all covered here:
http://www.techsupportforum.com/f174/pc-safety-and-security-what-do-i-need-115548.html and this aswell http://www.techsupportforum.com/sec...54-users-self-help-malware-removal-guide.html

 

[Glaswegian]

Are there any efforts an internationally criminalizing the creation and distribution of malware ?

Have a look here...

http://www.malwarecomplaints.info/index.php

 

[FASTONE]

Hey - I deleted all the temporary files, cookies etc and the message is still there. It was fine last night but has returned tonight after turning on the computer. I do not hibernate the computer...I have a screen saver that will come on after one minute of not using it. If I notice any other changes, I will let you know...Thanks again for all the help.

 

[FASTONE]

Just wanted to let you know that Ried has looked at all my recent scans and it is not malware/spyware related.

 

[FASTONE]

I typed in eventvwr and this is what I found:

Source: Application Error

Category: None

Event ID Number: 1000

Description: Faulting application explorer.exe, version 6.0.2800.1221, faulting module msvcrt.dll, version 7.0.2600.1106, fault address 0x00033618.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

 

[FASTONE]

Also, I found alot of these errors:

Source: Application Error

Category: None

Event ID Number: 1000

Description: Faulting application iexplore.exe, version 6.0.2800.1106, faulting module unknown, version 0.0.0.0, fault address 0x2000588d.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.