Computer cant turn on

[devil0150]

Rebooted. Still that problem.

[Karnac]

My bets on a malware infection....

[devil0150]

Should I post this on the malware infection forum or not? Anybody has other ideas?

[Allan]

No need. You can always install Malware Bytes and run a full scan with both that and your anti virus utility. I don't know that malware is the problem, but there's never any harm in running scans.

[devil0150]

I'll run a scan with malware bytes but I cant use my antivirus in safe mode.
Anyway, should I post the log or not?

[devil0150]

Oh, I found some command line scanner of my antivirus. I'll make  a scan with that too.

[patio]

What AV app won't run on safemode ? ?

[devil0150]

My AVG Free antivirus. It doesnt run like usual. Only some kind of command line scanner works. Anyway, this is the mbam log.

Code: [Select]

Malwarebytes' Anti-Malware 1.38
Database version: 2297
Windows 5.1.2600 Service Pack 3

8/19/2009 9:11:08 PM
mbam-log-2009-08-19 (21-11-08).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 279968
Time elapsed: 51 minute(s), 34 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 1
Registry Keys Infected: 3
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
C:\WINDOWS\system32\reader_s.exe (Trojan.Agent) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS\system32\sysfldr.dll (Trojan.Agent) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Protect (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\AGprotect (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reader_s (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reader_s (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\sysfldr.dll (Trojan.Agent) -> Delete on reboot.
c:\WINDOWS\system32\drivers\protect.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\reader_s.exe (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\HSM Center\reader_s.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd (Trace.Pandex) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\drivers\500.exe (Rootkit.Agent) -> Delete on reboot.

Now what should I do?

[squall_01]

see if you cant run spybot if you have it. 

[Allan]

Spybot isn't needed - it's old school. If you want to run another spyware scan use Super AntiSpyware. That and Malwarebytes are the best of breed at the moment.

[smeezekitty]

These days there is not reason not to update your bios. Systems and flash utilities are made pretty much foolproof now.

http://www.google.com/search?q=issues+with+bios+flash&sourceid=firefox&start=0&start=0&ie=utf-8&oe=utf-8

[Allan]

And I can tell you about people bitten by zebras. In current systems bios upgrades are perfectly safe. Please, if you don't have something positive to contribute at least don't make it harder for me to help.

[Quantos]

And I can tell you about people bitten by zebras. In current systems bios upgrades are perfectly safe. Please, if you don't have something positive to contribute at least don't make it harder for me to help.

Sorry man, I have to disagree with you there.

The ONLY time anyone should ever flash a piece of hardware is if there is a fix for it directly.  I've seen too many problems caused by your cavalier attitude because 'it's cool to be current'.

[Allan]

Sorry man, I have to disagree with you there.

The ONLY time anyone should ever flash a piece of hardware is if there is a fix for it directly.  I've seen too many problems caused by your cavalier attitude because 'it's cool to be current'.

It's not cavalier at all. And as I explained in another thread here when the same question came up, I do not suggest firmware upgrades unless they are, in my opinion, a necessary and logical step in the "repair" process. It's not that I don't recognize the SLIM possibility of something untoward happening, it's that I don't want anyone scaring the person with the problem when he or she needs to update the bios. I always try to be aware of the potential implications of everything I suggest on support forums.

[devil0150]

Here is my super antispyware log.

Code: [Select]

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/21/2009 at 03:32 PM

Application Version : 4.26.1006

Core Rules Database Version : 3998
Trace Rules Database Version: 1938

Scan type       : Complete Scan
Total Scan Time : 00:44:09

Memory items scanned      : 302
Memory threats detected   : 1
Registry items scanned    : 7931
Registry threats detected : 3
File items scanned        : 25866
File threats detected     : 34

Trojan.Agent/Gen-Reader_S
C:\WINDOWS\SYSTEM32\READER_S.EXE
C:\WINDOWS\SYSTEM32\READER_S.EXE
[reader_s] C:\WINDOWS\SYSTEM32\READER_S.EXE

Adware.Tracking Cookie
C:\Documents and Settings\HSM Center\Cookies\hsm_center@questionmarket[2].txt
C:\Documents and Settings\HSM Center\Cookies\hsm_center@advertising[1].txt
C:\Documents and Settings\HSM Center\Cookies\hsm_center@mediaplex[1].txt
C:\Documents and Settings\HSM Center\Cookies\hsm_center@revsci[2].txt
C:\Documents and Settings\HSM Center\Cookies\hsm_center@doubleclick[2].txt
C:\Documents and Settings\HSM Center\Cookies\[email protected][2].txt
C:\Documents and Settings\HSM Center\Cookies\hsm_center@adbrite[2].txt
C:\Documents and Settings\HSM Center\Cookies\hsm_center@chitika[1].txt
C:\Documents and Settings\HSM Center\Cookies\[email protected][1].txt
C:\Documents and Settings\HSM Center\Cookies\[email protected][1].txt
C:\Documents and Settings\HSM Center\Cookies\[email protected][1].txt
C:\Documents and Settings\HSM Center\Cookies\hsm_center@adcowebmedia[2].txt
C:\Documents and Settings\HSM Center\Cookies\hsm_center@advertiseyourgame[2].txt
C:\Documents and Settings\HSM Center\Cookies\hsm_center@lfstmedia[2].txt
C:\Documents and Settings\HSM Center\Cookies\[email protected][2].txt
C:\Documents and Settings\HSM Center\Cookies\hsm_center@imrworldwide[2].txt
C:\Documents and Settings\HSM Center\Cookies\hsm_center@statcounter[2].txt
C:\Documents and Settings\HSM Center\Cookies\hsm_center@collective-media[1].txt
C:\Documents and Settings\HSM Center\Cookies\[email protected][2].txt
C:\Documents and Settings\HSM Center\Cookies\hsm_center@shinystat[1].txt
C:\Documents and Settings\HSM Center\Cookies\hsm_center@serving-sys[2].txt
C:\Documents and Settings\HSM Center\Cookies\[email protected][1].txt
C:\Documents and Settings\HSM Center\Cookies\[email protected][2].txt
C:\Documents and Settings\HSM Center\Cookies\hsm_center@fastclick[1].txt
C:\Documents and Settings\HSM Center\Cookies\[email protected][1].txt
C:\Documents and Settings\HSM Center\Cookies\hsm_center@mediafire[1].txt
C:\Documents and Settings\HSM Center\Cookies\[email protected][1].txt
C:\Documents and Settings\HSM Center\Cookies\hsm_center@apmebf[2].txt
C:\Documents and Settings\HSM Center\Cookies\hsm_center@atdmt[2].txt
C:\Documents and Settings\HSM Center\Cookies\[email protected][1].txt
C:\Documents and Settings\HSM Center\Cookies\hsm_center@tribalfusion[2].txt

Trojan.Unknown Origin
HKLM\Software\AGProtect
HKLM\Software\AGProtect#Cfg

Trojan.Agent/Gen
C:\WINDOWS\TEMP\VRT1.TMP

Trojan.Agent/Gen-FDUPX
C:\WINDOWS\TEMP\VRT3.TMP

Next step??