Very Annoying Computer Problem. Please help me.

[lorddybion]

   Good day and Happy Holidays. I have a computer problem that is driving me crazy. My computer on the monitor at irregular intervals just goes completely blank except for my Desktop Wallpaper. Sometimes, it will return in less that a few seconds, but sometimes it would take almost 2 hours for it to return to normal. To open applications, I must use the Windows Task Manager "New Task..." key. If there is a window open at the time the screen goes blank, I must use the Windows Task Manager to see it ("Switch to..." key) unless I am working in it like I am now (Mozilla Firefox). I have Kaspersky Internet Security 7.0 Trail Version running and even in my Safe Mode, it will not find a thing. But, it has shown me notifications about a program trying to run called "rundll32". I do not know if this is the problem, and I do not want to delete the file from C:\WINDOWS\system32 file because I do not know the results of doing so. If there is any other type of anti-virus software that I should be using or is recommended, please let me know.

    Your help will be GREATLY appreciated. Thank you for viewing and possibly responding.

[lorddybion]

I have Googled "rundll32" and clicked the first link I saw. The website says that it is a virus, but some replies say that it isn't. I would like it to be confirmed before I take action against this file. The link is:

http://www.neuber.com/taskmanager/process/rundll32.exe.html

Thank you.

[Deerpark]

Since a malware infection is suspected I suggest you go through the steps listed here.
Please read this before requesting help
It will make it a lot easier for our expert to help you.

[Broni]

'rundll32.exe" is a crucial Windows file, however it may be used by "bad guys" to run their crap.
Don't touch that file, and follow Deerpark's advice.

[lorddybion]

     Wow Deerpark, all of that toke a while. I have attached the HijackThis log and the SUPERAntiVirus log into this post. There is a problem though, the NOD32 scan did not complete. The first time I launched it, the page seemed to refresh itself about 3/4 into the scan, and it found 1 threat. Then I ran it again and it didn't find any threats, although I didn't complete it. I shall try to complete it today. And also, thank you Broni for the info.

Happy Holidays everyone.



[saving space - attachment deleted by admin]

[Broni]

1. Print this post out, since you won't have an access to it, at some point.

2. Close all windows, except for HijackThis.

2. Go Start>Control Panel>Add\Remove, and uninstall MyWebSearch (if present).

3. Put a checkmark next to the following HijackThis entries:

- O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

- O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

- O3 - Toolbar: (no name) - {F06E2ABE-3A50-4079-BE25-FC100D9EAA25} - (no file)

- O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{04C90A36-03A1-1033-0307-010713200001}] "C:\Program Files\Common Files\{04C90A36-03A1-1033-0307-010713200001}\Update.exe" mc-110-12-0000698 (User 'SYSTEM')

- O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{04C90A36-03A1-1033-0307-010713200001}] "C:\Program Files\Common Files\{04C90A36-03A1-1033-0307-010713200001}\Update.exe" mc-110-12-0000698 (User 'Default user')

- O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZN

- O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Denise\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)

4. Click on "Fix checked" button.

5. Restart your computer in Safe Mode (keep tapping F8 key, when your computer starts)

6. Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to "Show hidden files, and folders".

7. Delete following files/folders (if present):

- Update.exe file from C:\Program Files\Common Files

8. Turn off System Restore:

- Windows XP:
   1. Click Start.
   2. Right-click the My Computer icon, and then click Properties.
   3. Click the System Restore tab.
   4. Check "Turn off System Restore".
   5. Click Apply.   
   6.  When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
   7. Click OK.
- Windows Vista:
   1. Click Start.
   2. Right-click the Computer icon, and then click Properties.
   3. Click on System Protection under the Tasks column on the left side
   4. Click on Continue on the "User Account Control" window that pops up
   5. Under the System Protection tab, find Available Disks
   6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
   7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
   8. Click OK

9. Restart in Normal Mode.

10. Turn System Restore on.

11. Run HijackThis again, and post back its log back here.

[lorddybion]

Alright, I have done everything on the last post Broni, I have attached the new log in this post. Also, the NOD32 Online Scan didn't show any threats after a complete scan.

P.S.
The Update.exe and the MyWebSearch were not present.

[saving space - attachment deleted by admin]

[Broni]

Do you have your Windows firewall up, because I can't see any in HJT log?

You need to update your Java version: http://www.java.com/en/download/index.jsp
Uninstall your 1.6.0_02 version (it doesn't matter what will you do first)

We have some more cleaning to do...

Print out these instructions as we will need to close every window that is open later in the fix.

Download VundoFix:
http://www.atribune.org/content/view/24/2/

    * Double-click VundoFix.exe to run it.
    * When VundoFix re-opens, click the Scan for Vundo button.
    * Once it's done scanning, click the Remove Vundo button.
    * You will receive a prompt asking if you want to remove the files, click YES
    * Once you click yes, your desktop will go blank as it starts removing Vundo.
    * When completed, it will prompt that it will reboot your computer, click OK.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the
Scan for Vundo button." when VundoFix appears at reboot.

Post new HJT log.

[lorddybion]

I don't think I have the Windows Firewall activated, I think a certain anti-virus recommended it. Is there a shortcut located to my Control Panel because it will be almost impossible to open functions like "My Computer" or "My Documents" without my computer going crazy. Also, a friend of mine recommended I download VundoFix (which I already have) and I have already scanned using it. But, I have encountered a file that wouldn't be deleted.

C:\WINDOWS\system32\cbxwwwv.dll

Even when my computer was rebooted, it wouldn't be deleted. When I tried to manually delete it in Safe Mode, it said that it is being used by another program.

I have also downloaded the BitDefender Free Edition, and it also found the cbxwwwv.dll Vundo, and it couldn't deal with it either. I shall attach a new HJT log.

I have also noticed that "rundll32.exe" is a running process in my Task Manager (which I have never seen before). Also, there are currently four "svchost.exe" running (which is also new). If I try to end one of them, an error message appears and it tells me that my computer will shut down in one minute. There are also some new processes that I believe are suspicious :

vsserv.exe
bdss.exe
xcommsvr.exe
lsass.exe
crss.exe
smss.exe

I do not know if this will help, but I'm just putting it out there.

[saving space - attachment deleted by admin]

[Broni]

To access firewall, go Start>Control Panel, double click on Windows Firewall

Did you update your Java?

I have also downloaded the BitDefender Free Edition, and it also found the cbxwwwv.dll Vundo, and it couldn't deal with it either. I shall attach a new HJT log.

I have also noticed that "rundll32.exe" is a running process in my Task Manager (which I have never seen before). Also, there are currently four "svchost.exe" running (which is also new). If I try to end one of them, an error message appears and it tells me that my computer will shut down in one minute. There are also some new processes that I believe are suspicious :

vsserv.exe
bdss.exe
xcommsvr.exe
lsass.exe
crss.exe
smss.exe

DO NOT install/uninstall, play with services, unless instructed to do so.

I'll take a look at your HJT log, now.

[Broni]

Your HJT log is clean.

How is your computer doing?

[lorddybion]

I managed to turn on the firewall before the computer went haywire. But my computer screen is continuing to go blank and the multiple svchost.exe's are still running. 

[lorddybion]

And also, if my this problem cannot be resolved, how does one begin a "System Wipe" (when the machine goes back to default as if new)

[Deerpark]

That depends... do you have a system restore disc or a Windows XP install disc?
Do you need to make a backup of anything?

[lorddybion]

Um, I don't know. This computer was bought a while back and it came with the Windows 98 OS. A friend of my mother's installed the Windows XP OS. But, all I would have to do is put in the installation CD and it would reset the hard-drive?