PC freezes during the scan

Viruses and worms
1

Hello everyone!

First of all i would like to apologize for my english. It isn’t very well, but i will try to explain the problem which i have at the moment. A few month ago i tried to do full system scan with AVAST trial version. At the beginning everything looked fine, i had scanned about 30-40% of all system when suddenly everything stopped. I couldn’t move my mouse or to do other operations. So i just had to wait until the blue screen shows or to restart my laptop manually. After some time i tried one more time to do full scan, but my laptop froze again. Only this time at 16%. I tried to use other antivirus programs but i didn’t get any result. Today i ran one more time avast, but this time in safe mode. So it took me just a few minutes before the pc stopped again. I’m not good at such things but i think it could be a virus or some problems with my laptop parts (for example hard disk). It would be very nice if someone would help me to manage this problem.

2

Hi,

This issue might not be malware related, but problem might be related to hardware. Let’s check your PC on malware shall we?

We shall run two diagnostic tool. FRST is the main and primary tool I need. Gmer is secondary AntiRootKit diagnostic tool.
=> Try to run Gmer, and if you get BSOD during scanning, don’t panic and just abort gmer scanning and post me FRST logs.

Please download Farbar Recovery Scan Tool by Farbar and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Under Optional Scan ensure “List BCD” and “Driver MD5” are ticked.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

THEN

Please download GMER, AntiRootkit tool from the link below and save it to your Desktop:

Gmer download link
Note: file will be random named

Double-clicking to run GMER.

[*]Wait for initial scan to finish - if there is any query, click No;
[*]Click Scan button and wait until the full scan is complete;
[*]Click Save … - save the report to the Desktop (named ARK );

Attach here Gmer (ARK.txt) logreports.

3

I downloaded both files like you said. First opened FRST which asked me to click yes to disclaimer. When i clicked yes, i got two different errors ( my fault i didn’t memorize what was written there). So i pressed yes on both of them and program closed. Only thinking icon left until now and i can’t press any icon on my desktop or to close FRST through task manager. Now i’m gonna try to run second program.

4

Hi,
FRST is primary tool for me. Try to download fresh FRST tool (delete old-one) and re-run as instructed above with all option checked.

If you get an error, please tell me and post me screenshot of that messages/error.
If FRST create logs for you, please attach here.

EDIT:

If you fail again to run FRST (yes, please post me screenshot of error) try to run DDS tool instead.

Please download DDS and save it to your Desktop from here:
http://www.bleepingcomputer.com/download/dds/dl/104/

Double click to run the tool, click the Start button.

  • When done, DDS will open two (2) logs:
    1. DDS.txt
    2. Attach.txt

Save both reports to your desktop. DDS.txt and Attach.txt attach back to topic.

5

This time it worked almost good only at the end of the scan i got an error. So i will attach both .txt files and a screenshot of that error. Should i run GMER now?

6

Here’s the second scan with GMER log file.

7

I’ll be back later or tomorow to check posted logs and wrote FRSTFix or to tell you the system state.

8

Hi,

1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

START
CMD: notepad C:\IORRT\IORRT.bat >> "%userprofile%\desktop\batcheck.txt"
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://startsear.ch/?aff=1&src=sp&cf=d5efc206-d3ca-11e0-bfb6-88ae1d623c3b&q={searchTerms}
SearchScopes: HKCU - DefaultScope {AD8533D4-88BB-4ECF-9877-542DF0CD7A02} URL = http://search.softonic.com/INF00176/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=eaf4a27a00000000000022f1a1bb52aa&r=626
SearchScopes: HKCU - {54BAFAA7-1357-45F2-ABCE-A0CE9B852636} URL = http://startsear.ch/?aff=1&q={searchTerms}
SearchScopes: HKCU - {AB79D3B4-AEDB-428a-B504-BAC00521A1C7} URL = http://www.smartwebsearch.net/index.php?from=4&q={searchTerms}
SearchScopes: HKCU - {AD8533D4-88BB-4ECF-9877-542DF0CD7A02} URL = http://search.softonic.com/INF00176/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=eaf4a27a00000000000022f1a1bb52aa&r=626
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
FF HKCU\...\FireFox\Extensions: [SearchToolbar@skywebsearch.com] - C:\Program Files\SaveTubeVideo.com\SaveTubeVideo\FF
C:\Program Files\SaveTubeVideo.com
CHR HKLM\...\Chrome\Extension: [dnllcmllkjofnojidnaknldfehfhehoo] - C:\Program Files\HDvidCodec.com\HDvidCodec10.crx
CHR HKLM\...\Chrome\Extension: [hbcennhacfaagdopikcegfcobcadeocj] - C:\Program Files\Common Files\Spigot\GC\saebay_1.0.crx
CHR HKLM\...\Chrome\Extension: [icdlfehblmklkikfigmjhbmmpmkmpooj] - C:\Program Files\Common Files\Spigot\GC\errorassistant_1.1.crx
CHR HKLM\...\Chrome\Extension: [mhkaekfpcppmmioggniknbnbdbcigpkk] - C:\Program Files\Common Files\Spigot\GC\coupons_2.4.crx
CHR HKLM\...\Chrome\Extension: [pfndaklgolladniicklehhancnlgocpp] - C:\Program Files\Common Files\Spigot\GC\saamazon_1.0.crx
C:\Program Files\HDvidCodec.com
C:\Program Files\Common Files\Spigot
S3 WinRing0_1_2_0; \??\C:\Users\Romas\AppData\Local\Temp\tmp51B7.tmp [x]
U3 kxldipod; \??\C:\Users\Romas\AppData\Local\Temp\kxldipod.sys [x]
C:\Users\Romas\AppData\Local\Temp
C:\Users\Aliusia\AppData\Local\Temp
C:\Users\Tedi\AppData\Local\Temp
AlternateDataStreams: C:\ProgramData\TEMP:430C6D84
AlternateDataStreams: C:\ProgramData\TEMP:C46995DA
AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2
AlternateDataStreams: C:\ProgramData\TEMP:E7D2A25A
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\26212347.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\26212347.sys => ""="Driver"
CMD: ipconfig /flushdns
END

2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
One more log will be created on Desktop (batcheck.txt) Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.

------ next -------

Re-run FRST, just hit [Scan] button and post me fresh created logreport.

---------------------------------------------
=> In your next reply, please attach Fixlog.txt, batcheck.txt and fresh FRST.txt log

9

Hi again!

Yesterday i had some problems with internet connection so couldn’t reply to your post. I made all your steps as you said but didn’t get batcheck.txt log, only other two.

10

Ok. Termosas, posted log looks good. Your system si malware free. Therefore, I shall remove used tools.

Please download DelFix by “Xplode” to your Desktop.

Run the tool and check the following boxes below;

[] Remove disinfection tools
[] Create registry backup
[*] Purge System Restore

Now click on “Run” button. Wait for the programme completes his work.
All the tools we used should be gone.
Tool will create and open an log report (DelFix.txt)
Note: The report will also be stored on C:\DelFix.txt

I don’t need DelFix log report.

I recommended to use MCShield if you will.
You may download MCShield from one of the following links:

MyCity - Official download link
Softpedija - Mirror download link

It will prevent infection by computer via USB flash drive, mobile phone or any other memory card.
And not only will prevent infection, but it will immediately clean flash drive, memory card or external HDD.

If BSOD still occurs on avast scan, then you may follow where BSOD occurs (which driver avast review when error occurs).
Or as I sad before, this may be hardware related. I would test PSU for the start.

11

Thank you for your help! So the main problem can be somewhere in hardware?

12

As I see it, there are two reasons.
Softwere

  • porheps avast’s kernel driver pins with another kernel driver (less likely)
    Hardware
  • PSU does not provide enough power (or gives too much power to some component) and component is failing.
  • Components are not cooled sufficiently (dust, thermal paste)
  • something else…