 Cmd.exe Shuts Down My Pc! |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
BleepingComputer.com > Security > HijackThis Logs and Virus/Trojan/Spyware/Malware Removal > Misplaced HJT Logs  |
 Feb 7 2008, 04:30 AM
Post
#1
|
|
 New Member  Group: Members Posts: 11 Joined: 31-October 07 From: Philippines Member No.: 166,540  |
-------------------- 私はGempesaw の一族からのジョンErvine Gempesaw である
|
 |
 
|
|
Feb 7 2008, 04:35 AM
Post
#2
|
|
 Member Group: Members Posts: 130 Joined: 12-May 07 From: Miri Member No.: 130,551 |
Welcome to BC
 (Borrowed quote)Hmm..last time this was a symptom for virus breakout called brontok. It will shutdown the workstation anytime you try to access to cmd, registry edit and task manager, which was during then. Now, if I am not mistaken, you wont have access to any of those for it will redirect it to some other app like a notepad. Try and scan your system with updated virus database.  Keep us updated. Good Luck.
--------------------  Tech Support: "Do you have any windows open right now?" Customer: "Are you crazy woman, it's twenty below outside..." |
|
|
|
|
Feb 7 2008, 04:42 AM
Post
#3
|
|
|
New Member Group: Members Posts: 11 Joined: 31-October 07 From: Philippines Member No.: 166,540 |
QUOTE(syunichi @ Feb 7 2008, 05:35 PM)  Welcome to BC (Borrowed quote)Hmm..last time this was a symptom for virus breakout called brontok. It will shutdown the workstation anytime you try to access to cmd, registry edit and task manager, which was during then. Now, if I am not mistaken, you wont have access to any of those for it will redirect it to some other app like a notepad. Try and scan your system with updated virus database. Keep us updated. Good Luck.Thanks for the advice Actually the last virus that affected my system was destrukto, and I successfully remove it, after that everytime I try to run cmd.exe, my computer just shuts down. I also tried to swap files within my officemates, but its no use. That is my only problem, hope you could help me with this. -------------------- 私はGempesaw の一族からのジョンErvine Gempesaw である
|
|
|
|
|
Feb 7 2008, 04:56 AM
Post
#4
|
|
|
Member Group: Members Posts: 130 Joined: 12-May 07 From: Miri Member No.: 130,551 |
Ok, why dont you try Command.com instead of cmd.exe. Will the same thing happen?
-------------------- Tech Support: "Do you have any windows open right now?" Customer: "Are you crazy woman, it's twenty below outside..." |
|
|
|
|
Feb 7 2008, 05:09 AM
Post
#5
|
|
|
Member Group: Members Posts: 130 Joined: 12-May 07 From: Miri Member No.: 130,551 |
You might wanna try running SDFix during safe mode. Keep us updated. I read about password_view virus that brings the same aftermath as yours. Good luck.
-------------------- Tech Support: "Do you have any windows open right now?" Customer: "Are you crazy woman, it's twenty below outside..." |
|
|
|
|
Feb 7 2008, 07:58 PM
Post
#6
|
|
|
New Member Group: Members Posts: 11 Joined: 31-October 07 From: Philippines Member No.: 166,540 |
QUOTE(syunichi @ Feb 7 2008, 06:09 PM) You might wanna try running SDFix during safe mode. Keep us updated. I read about password_view virus that brings the same aftermath as yours. Good luck. Hi! I remember! I did have a virus called password_viewer before. Maybe I'll try it, (crosses fingers) -------------------- 私はGempesaw の一族からのジョンErvine Gempesaw である
|
|
|
|
|
Feb 7 2008, 08:51 PM
Post
#7
|
|
|
New Member Group: Members Posts: 11 Joined: 31-October 07 From: Philippines Member No.: 166,540 |
QUOTE(syunichi @ Feb 7 2008, 05:56 PM) Ok, why dont you try Command.com instead of cmd.exe. Will the same thing happen? HI! It is fine when I use command.com. I used that SDFix but the same thing happens. Is there any file or dll that cmd.exe needs in order to run? Maybe that is the file that I need to fix. -------------------- 私はGempesaw の一族からのジョンErvine Gempesaw である
|
|
|
|
|
Feb 7 2008, 11:09 PM
Post
#8
|
|
 To INSANITY and BEYOND !! Group: Moderator Posts: 10,943 Joined: 10-September 04 From: NJ USA Member No.: 2,608 |
Tools like SDFix are specialized tools normally used by malware removal experts who are helping others to investigate and remove malware infections in the Hijackthis forum. They are intended to be used under the guidance and supervision of an expert. Using a specialized tool incorrectly could adversely impact your system.
-------------------- Can you spare some PC cycles to help FIND A CURE .. BC FOLDING TEAM Click me /info..
ThoughtVent a goodplace to discuss.<<>>>Staying Updated Calendar of Updates. For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear.... |
|
|
|
|
Feb 8 2008, 08:19 PM
Post
#9
|
|
 Still visually handicapped, new avatar :0) Group: Global Moderator Posts: 15,531 Joined: 2-October 05 From: Southeastern CT, USA Member No.: 35,824 |
IMO you either still have a virus, or the virus has damaged your OS to the point that it's not working properly.
I'd suggest a visit to the Am I Infected? forum for a more expert opinion: http://www.bleepingcomputer.com/forums/forum103.html -------------------- - John
**If you need a more detailed explanation, please ask for it. I have the Knack. ** BTW - the avatar pic is a camel as it looks back at me while I'm in the saddle (and he wasn't happy!) |
|
|
|
|
Feb 14 2008, 04:03 AM
Post
#10
|
|
|
New Member Group: Members Posts: 11 Joined: 31-October 07 From: Philippines Member No.: 166,540 |
It's still the same, I did what you people told me to do. But it's just no use. There's no running any software that uses dos plugins cause it will shutdown or shuts down my computer. Do you think it's better if I reformat my drive?
-------------------- 私はGempesaw の一族からのジョンErvine Gempesaw である
|
|
|
|
|
Feb 14 2008, 08:49 AM
Post
#11
|
|
|
Still visually handicapped, new avatar :0) Group: Global Moderator Posts: 15,531 Joined: 2-October 05 From: Southeastern CT, USA Member No.: 35,824 |
If you format your drive and reinstall Windows, the chances are good that you'll eliminate the virus. Make sure that you backup your stuff and that you've got all the drivers that you'll need before formatting.
-------------------- - John
**If you need a more detailed explanation, please ask for it. I have the Knack. ** BTW - the avatar pic is a camel as it looks back at me while I'm in the saddle (and he wasn't happy!) |
|
|
|
|
Feb 20 2008, 10:08 PM
Post
#12
|
|
|
New Member Group: Members Posts: 11 Joined: 31-October 07 From: Philippines Member No.: 166,540 |
Hi! it's me again, I didn't have the time to reformat my hard drive coz I have a lot of things to do. This is the logfile that hijackthis generated.
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:02:38 AM, on 2/21/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\VTtrayp.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Vimicro\Vimicro UVC USB2.0 PC Camera\x86\VMonitor.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAP.EXE C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\NCH Swift Sound\Talk\talk.exe C:\Program Files\tcpIQ\Line Speed Meter\LineSpeedMeter.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\RamBooster 2.0\Rambooster.exe C:\Program Files\Free Download Manager\fdm.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Veoh Networks\Veoh\VeohClient.exe C:\Program Files\HyperIM\HyperIM.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\fxssvc.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/.../search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn1\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn1\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn1\yt.dll O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [VMonitorVMUVC] "C:\Program Files\Vimicro\Vimicro UVC USB2.0 PC Camera\x86\VMonitor.exe" VMUVC O4 - HKLM\..\Run: [\\MSGNIADMIN\EPSON Stylus C67 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAP.EXE /P36 "\\MSGNIADMIN\EPSON Stylus C67 Series" /O6 "USB002" /M "Stylus C67" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Talk] "C:\Program Files\NCH Swift Sound\Talk\talk.exe" -logon O4 - HKLM\..\Run: [Line Speed Meter] C:\Program Files\tcpIQ\Line Speed Meter\LineSpeedMeter.exe -minimize O4 - HKLM\..\Run: [Auto EPSON Stylus C67 Series on MSGNIADMIN (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAP.EXE /P51 "Auto EPSON Stylus C67 Series on MSGNIADMIN (Copy 1)" /O21 "\\MSGNIADMIN\EPSONSty" /M "Stylus C67" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [RamBooster] C:\Program Files\RamBooster 2.0\Rambooster.exe O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide O4 - HKCU\..\Run: [HyperIM] C:\Program Files\HyperIM\HyperIM.exe -min O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user') O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present O8 - Extra context menu item: &Play Radio URL - C:\Program Files\Christian Music Toolbar\MusicToolBar.dll.htm O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O23 - Service: 3CX VoIP Client Tunnel (3CXVoIPClientTunnel) - Unknown owner - C:\Program Files\3CX VoIP Client\3CXTunnel.exe (file missing) O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe -- End of file - 10562 bytes Can anyone help me? -------------------- 私はGempesaw の一族からのジョンErvine Gempesaw である
|
|
|
|
|
Feb 20 2008, 11:05 PM
Post
#13
|
|
|
To INSANITY and BEYOND !! Group: Moderator Posts: 10,943 Joined: 10-September 04 From: NJ USA Member No.: 2,608 |
I have moved your Topic that includes a HijackThis log here to the Misplaced HJT Logs forum. You posted your log in a forum not intended for HijackThis logs analysis and probably missed the directions we provide to those who require assistance. We can only allow topics with such logs in the HijackThis Logs and Malware Removal forum. This restriction is to ensure you get the best help available, from those who specialize in malware anlaysis and removal. It also should prevent you from receiving ineffective or even potentially dangerous advice, whether well meaning or not.
Prior to posting a HJT log, we ask that you please read and follow all instructions in the pinned topic titled Preparation Guide For Use Before Posting A Hijackthis Log. Following the steps in this Guide will allow the HJT Team to quickly help you with specific fixes for what may remain on your system. Please complete all the steps in the Guide. If you have performed some of them already, then just continue with the next. If you can't perform a step, then skip it and continue with the next. The last step will include downloading and using the most current version of HijackThis if the first line of your log does not appear as follows: Logfile of Trend Micro HijackThis v2.0.2 Please note that it is important that HijackThis be run and a log created while in normal mode. If you run it and create your log while in safe mode, you will be asked to redo it again properly. When you have completed those steps, start a new topic in the HijackThis Logs and Malware Removal forum as directed in the Guide to post a new log. Please DO NOT post any more logs to this topic, or post a log again in the wrong forum. The Misplaced HJT Logs forum is strictly a holding area where the BC Staff can assist you with preparations for and to properly post your log. If you have a question or encounter a problem in the Prep Guide, please do post back to this topic; that is what it is here for. When your new HJT log is posted in the proper forum, please reply to this topic with a link to your new topic. Once that is done, a Member of the HJT Team will analyze your log and assist you with step by step instructions to clean your computer or otherwise advise what needs to be done. Thanks for your cooperation and good luck. The BC Staff -------------------- Can you spare some PC cycles to help FIND A CURE .. BC FOLDING TEAM Click me /info..
ThoughtVent a goodplace to discuss.<<>>>Staying Updated Calendar of Updates. For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear.... |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 9th January 2009 - 06:18 AM |
© 2003-2008 All Rights Reserved Bleeping Computer LLC.