Win32:Trojan-gen in System Restore/mysterious black screens

If it's Spyware Doctor and McAfee, why didn't it happen before?
I've had both for a long time. In fact, I think Spyware Doctor was pre-installed by HP.

I uninstalled Spyware Doctor and, during the reboot, I remembered that my brother has all the same stuff on his notebook, but experiences no problems.

Then there's a matter of the bad blocks mentioned in the RSIT log on page 1 of this thread:


======System event log======

Computer Name: FAMILY
Event Code: 7
Message: The device, \Device\Harddisk0\D, has a bad block.

Record Number: 1107564
Source Name: Disk
Time Written: 20091122011123.000000-300
Event Type: error
User:

Computer Name: FAMILY
Event Code: 7
Message: The device, \Device\Harddisk0\D, has a bad block.

Record Number: 1107563
Source Name: Disk
Time Written: 20091122011122.000000-300
Event Type: error
User:

Computer Name: FAMILY
Event Code: 7
Message: The device, \Device\Harddisk0\D, has a bad block.

Record Number: 1107562
Source Name: Disk
Time Written: 20091122011054.000000-300
Event Type: error
User:

Computer Name: FAMILY
Event Code: 7
Message: The device, \Device\Harddisk0\D, has a bad block.

Record Number: 1107561
Source Name: Disk
Time Written: 20091122011053.000000-300
Event Type: error
User:

Computer Name: FAMILY
Event Code: 7
Message: The device, \Device\Harddisk0\D, has a bad block.

Record Number: 1107560
Source Name: Disk
Time Written: 20091122011052.000000-300
Event Type: error
User:

I read that hard disk "D" location as the manufacturer's hidden recovery partition. The error issue may be due to these often using an older, FAT 16 file system.

I agree that any software installed prior to the problem should not be very high on any suspect lits. Unless they have updated and then became incompatible.

I realize I haven't checked if these problems created dump files we can check.


Make sure you can [URL="https://www.cybertechhelp.com/tutorial/article/how-to-show-hidden-files"]View Hidden Files[/URL]. Also uncheck "Hide Extensions for Known File Types"


Navigate (right click My Computer, left click Explore) to the following folder:

c:\windows\minidump

And if one is there, locate in it any recent minidump(date-somenumber).dmp files created, where "date-somenumber" matches dates of any recent crashes there. If they exist, then just zip a copy of it, and send it to jintan AT malwarecrypt.com as an attachment. Please place "Submitted Files - IceDog Chill/bg/dmp" as the email Subject.

After following the steps, I see the Minidump folder is completely empty, with nothing to zip. Is that normal?

By the way, the link was a broken one that sent me to a page that said
"Did you mean: www. cybertechhelp. com/ tutorial/ article/ how- to- show- hidden- files"
So I took that.

Yes, I have some links saved that already include the "" quotes, that in a few forums like here do not work correctly unless I change them.

May be missing opportunity with not recording crashes there. Right click My Computer - Properties, click the Advanced tab. Under Startup and recovery click the Settings button. Check "Write an event to the system log". Also make sure it is set for now to "Small memory dump". (then OK\Apply\OK).

Assuming these crashes are occurring frequently perhaps you will have a dump file I can check.

Oh... Ok.

It was already set that way. I didn't have to touch anything.

Not the typer of problems that create dump files then. Let's check the event logs instead, and see if a common fualt shows there.

Go to Start - Run, type eventvwr.msc and press OK.

In that list locate and right click Application, then select "Save Log File As", and save this to your desktop as apps.evt (the ".evt" extension will be selected automatically).

Also right click System and save that log to your desktop as system.evt as well.


Zip copies of those two logs, and then just send them to jintan AT malwarecrypt.com as an attachment. Please place "Submitted Files -IceDog Chill/bg/evt" as the email Subject.

I don't know what the "bg" means, but it's sent.

My own abbreviation, so I make sure I do not delete email submissions as spam. BG is BullGuard. Not difficult to see what is getting errors in the logs you sent - avast! Web Scanner service. Starting to suggest the problems are sourced with the security software there. Since we have not looked recently, let's review installed softwares before deciding on any additional changes.

Open HijackThis again, click Config - Misc Tools - Open Uninstall Manager.

Click on Save List, then save that to a location you can locate again (such as the desktop). Copy/paste the contents of that back here please.

Oh. I was guessing background, which didn't make sense.
Here's the requested log:

Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Media Player
Adobe Media Player
Adobe Reader 8.1.5
Adobe® Photoshop® Album Starter Edition 3.2
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft ShowBiz 2
avast! Antivirus
Blackhawk Striker from Hewlett-Packard Desktops (remove only)
Blasterball 2 from Hewlett-Packard Desktops (remove only)
Bonjour
Bounce Symphony from Hewlett-Packard Desktops (remove only)
CCleaner
Choice Guard
Color Efex Pro 3.0 Corel Sampler
Core FTP LE 2.1
Corel MediaOne
Corel Paint Shop Pro Photo X2
Corel Painter Photo Essentials 4
Coupon Printer for Windows
Critical Update for Windows Media Player 11 (KB959772)
Defraggler
Digimarc MyPictureMarc Watermarking Plugin
ebgcInfra
ebgcRes
ebgcSDK
Error Messages for Windows
ESET Online Scanner v3
Excavation from Hewlett-Packard Desktops (remove only)
filehippo.com Update Checker
Five Card Frenzy from Hewlett-Packard Desktops (remove only)
FoxyTunes for Firefox
Games Add-in for Windows Live® Toolbar
getPlus(R)_ocx
Google Chrome
Google Earth
Google Photos Screensaver
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
Highlight Viewer (Windows Live Toolbar)
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
HP Deskjet Preloaded Printer Drivers
HP Instant Support
HP Photo & Imaging 3.1
HP Photo and Imaging 2.0 - Photosmart Cameras
HP PSC & Officejet 4.7 Corporate Edition
hp psc 2170 series
HP Software Update
HPIZ311
ImageSkill Background Remover 3
Intel(R) Extreme Graphics Driver
IntelliMover Data Transfer Demo
InterVideo WinDVD Player
iTunes
Java 2 Runtime Environment, SE v1.4.2
Java(TM) 6 Update 17
KBD
Mah Jong Medley
Malwarebytes' Anti-Malware
McAfee SecurityCenter
Memories Disc Creator 2.0
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Live Add-in 1.4
Microsoft Office Standard Edition 2003
Microsoft Office Word 2003
Microsoft Plus! Digital Media Edition
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft User-Mode Driver Framework Feature Pack 1.0
MobileMe Control Panel
Mozilla Firefox (3.5.5)
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6 Service Pack 2 (KB954459)
Multimedia Card Reader
Network Magic
NVIDIA Drivers
NVIDIA GART Driver
NVIDIA Windows 2000/XP Display Drivers
OpenOffice.org 2.4
Orbital from Hewlett-Packard Desktops (remove only)
Otto from Hewlett-Packard Desktops (remove only)
Overball from Hewlett-Packard Desktops (remove only)
PC Pitstop Disk MD 2.0
PC Pitstop Exterminate 1.0
PC Pitstop Optimize 1.5
PC-Doctor for Windows
PHOTORECOVERY LE
Photosmart 140,240,7200,7600,7700,7900 Series
Polar Bowler from Hewlett-Packard Desktops (remove only)
PS2
Python 2.2 combined Win32 extensions
Python 2.2.1
QuickTime
RealPlayer
Realtek AC'97 Audio
RecordNow!
Rhapsody Player Engine
Safari
SecondLife (remove only)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Segoe UI
Skype™ 4.0
Slyder from Hewlett-Packard Desktops (remove only)
Smart PC Suite v2.2
StarOffice 8
StarOffice 8 Product Update 11
Super Collapse! from GameHouse
Super Mah Jong
Super WHATword?
System Requirements Lab
Unit Conversions
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Windows (KB971513)
Update for Windows Internet Explorer 8 (KB971180)
Update for Windows Internet Explorer 8 (KB975364)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Updates from HP
VLC media player 0.9.2
Weather Add-in for Windows Live Toolbar
WebEx Support Manager for Internet Explorer
Winamp
Winamp Toolbar
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Essentials
Windows Live Favorites for Windows Live Toolbar
Windows Live ID Sign-in Assistant
Windows Live Messenger
Windows Live Toolbar Extension (Windows Live Toolbar)
Windows Live Upload Tool
Windows Live Writer
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows Search 4.0
Windows XP Service Pack 3
WinZip 14.0
Yahoo! Install Manager
Yahoo! Toolbar
Zone Deluxe Games

One item of note, and I am not sure if we discussed this already, is that Smart PC Suite software you have installed there. Just by looking at the web info, showing terms like "optimize" and "fixes various PC problems" tells me this is another of those reg cleaner-type softwares. Empties temp storage, which often does improve things, but then locates and removes harmless, unused Registry entries, which improves nothing. And provides the user with change options they would know little about, which can cause system problems after. Given the problems you are having there it would be a good idea to uninstall this one.

The logs also show a McAfee Security Center. This will include some of McAfee's security functions, and is a candidate for being source of problems there.

The solution for the errors showing for Avast is to uninstall and reinstall it, but I would suggest doing the other two uninstalls first.

To make sure McAfee gets completely removed, go here and follow the steps under:

Step 2 - Download and run MCPR.exe

Be sure to reboot after running that.

Smart PC Suite was another pre-installed item that I never used.
When I uninstalled it, a box popped up saying that there were components not removed and that I'd have to remove them manually.

As for McAfee, they've become too lax in their security to be any use to me at this point.
What do I replace McAfee's Firewall with after I terminate it?
Maybe Avast has a firewall?

Avast has network related security functions that in ways mimic what a full firewall software would provide. I am curious is after uninstalling those softwares and rebooting, the problems get corrected.

I hope you're right about Avast, because MS is saying I'm not protected on the Firewall side.

I'm eager to find out too, but it might night happen. It ended by saying "Incomplete Cleanup". Here's the log it gave me:


MCAFEE CLEANUP
December 21, 2009 19:58:46
INFO Cleanup will be scheduled and run.
INFO Product mpfpcu to be removed from system.
INFO Product mpfp to be removed from system.
INFO Product mps to be removed from system.
INFO Product shred to be removed from system.
INFO Product mpscu to be removed from system.
INFO Product mskcu to be removed from system.
INFO Product msk to be removed from system.
INFO Product emproxy to be removed from system.
INFO Product mas to be removed from system.
INFO Product fwdriver to be removed from system.
INFO Product hw to be removed from system.
INFO Product mbk to be removed from system.
INFO Product mcproxy to be removed from system.
INFO Product mhn to be removed from system.
INFO Product mqccu to be removed from system.
INFO Product mqc to be removed from system.
INFO Product shrd to be removed from system.
INFO Product nmc to be removed from system.
INFO Product redir to be removed from system.
INFO Product mna to be removed from system.
INFO Product mwl to be removed from system.
INFO Product msad to be removed from system.
INFO Product vs to be removed from system.
INFO Product msc to be removed from system.
INFO Product mcpr to be removed from system.
INFO Task Scheduler service started.
WINERR IPersistFile::Save() failed. Error: 0x8007007a
FAIL Error while running cleanup using Task Scheduler.

That error at the end shows it doing a save or write to a different location function, so I can't see how it would suggest McAfee hasn't been removed now. Task Scheduler, so may have been making sure it did not leave any scheduled tasks behind. But let's how the system runs now that you made these changes.

I hope you're right about that. Let's see what happens tonight.

Leave my post now as the last one until you post back new information. This way I will be notified and will more likely see that you have replied.

It seems it was McAfee all along, and judging by the horror stories I was told about McAfee on Second Life this week, I was a lucky one.
Also, I, along with many on SL, thank you for helping me get rid of the problem.

The two things that weigh on my mind now are:
1) How did McAfee do this to my system?
2) Is it ok to leave this MS icon that says I'm not firewall protected as is, due to Avast's coverage? Or do I need to do something about it?

Good you got that solved. Comprehensive antivirus/anti-malware/anti-many things softwares like McAfee make many changes in many places, and when corrupted can bring on just as many difficult to identify issues. If you go to Start - Run, type firewall.cpl, you should be able to at least enable the built-in firewall. But here are other free firewall options you can choose from.

I also found PC Tools Firewall Plus Free Edition 6.0.0.74 at
https://download.cnet.com/PC-Tools-Firewall-Plus-Free-Edition/3000-10435_4-10625321.html?tag=mncol

If you recommend that, add it to your list.

Thanks again. And Merry Christmas.

I will need to check that and see if it is a good one. PCTools softwares, like Spyware Doctor, tend to slow systems down quite a bit, but perhaps the firewall one is okay. Thank you for the tip, and you also have a good holiday time there.

Not sure in all these last post procedures if we go to finishing our work, by removing what it added there to your system. Let's cover that ground now.


Eset, if you don't plan to use it again, uninstalls through Add/Remove Programs.


You can also at this time delete the files/folders of the tools we used. To assist with some of that download OTC.exe by OldTimer to your desktop. This will help by automatically removing some of the tools we used.

Just click OTC.exe, then click CleanUp, and select Yes. When it finishes removing some of the tools and files we used there just agree to the reboot, and OTC should self-delete once the system has rebooted (if not just delete the OTC.exe file).

-------------------------

Then a good idea is to reset the System Restore. To do this, right-click My Computer and select Properties. Click the System Restore tab in the window that appears, and check the box that says "Turn off System Restore on all drives" and click Apply.

You will be asked if you are sure, click Yes. This will delete the restore points. Then click OK in the Properties window and reboot your computer.

When your desktop appears, right-click My Computer and select Properties once more. Uncheck the "Turn off System Restore..." box and click Apply. OK.

And you should be back on course then.

OTC didn't remove any of it. Strange. If I need to, I'll go through this thread and remove the programs one by one.

And the System Restore was already switched off. A risky move, maybe, but it was a suggestion from another tech.




Something just happened minutes ago. The screen went black and two large tags popped up, the size indicating on-the-spot altered screen resolution. The incident forced me to press the tower's power button to shut it off and turn it back on. When I turned it back on, I had to submit a system error to MS. Now I see a browser window saying I have video driver issue. I got this before and updated the video drivers. Do I need to do it again?

Some of that turning off System Restore idea I think comes from early Norton suggestions, where Norton had the user turn it off to keep Norton from having problems scanning/fixing System Restore files. Since it can be a vital resource should things get worse, turning it off is akin to being on a boat, and throwing the lifeboats over the side because they are heavy.

Darn - right back to video again there. For now see if that occurs again with regular use.

Ok, the issue is again regular, this time with new problems:
last night, my system rebooted itself.
Today, it froze dead twice and went to a black screen the third time.

Is it residual damage from McAfee or something else?

Let's get current info. Run and post back a new Gmer scan, using the following method (posted here in case we did not use it earlier):

Open Gmer again. This time just right click in the white space in the display and select Options - Only non MS files. Then click Scan and allow Gmer to run a different scan. Once that completes click on the Copy button and rightclick on your Desktop, choose "New" > Text document. Once the file is created, open it and rightclick again and choose Paste. Copy the information and post it here please.

Also check the C:\Windows\minidump folder, and if any dump files were created zip a copy of them, and send that as an attachment to jintan AT malwarecrypt.com. Be sure to use "BG/Chill/dmp" as the email subject.

System rebooted itself during the scan, this time with a browser window saying i need to update my video driver after the reboot, but I'm sending the Minidump files.