What's causing this?

Viruses and worms
1

Hi All,

Have a pc with an unknown problem.

Initially the system presented with a slow boot and then crashed.

On restart it booted to past the login screen and then black screen with white cursor. NO BSOD at all.

On attempting safemode it stops indefinitely at the asw.Rvrt.sys line.

All repair options and startup options have been tried both off Win7 disk and installed system files.

Currently it is cycling the chkdsk command with no exit out option if you press a key.

Basic system details:

Packard Bell P4600
2GB Ram
Windows 7 Ultimate 32 bit

Can someone assist please?

2

FRST LOG Attached.

3

attach OTL diagnostic logs http://forum.avast.com/index.php?topic=53253.0

4

Thank Pondus!

Attached the OTL log

5

Log experts are notified, it may take some hours before they are online

have you run Combofix? … if so attach that log and any other security tool log you have

6

Hi,

This seems like hardware problem as logs doesn’t show the malware or the cause here. But I would like to get one more look. It might help …

Please download ListPartx64 by Farbar and save it to a flash drive.
http://www.bleepingcomputer.com/download/listparts/

[*]Plug the flashdrive into the infected PC.
[*]Restart your computer and tap F8 to bring up the Advanced Menu, then click Repair your computer
[*]Follow the prompt to enter keyboard input method, and then the prompt to enter a password. If the machine does not have a password, simply click Enter.

In the next menu, use the arrow keys on the keyboard to highlight Command Prompt and press Enter.

[*] In the command window type in notepad and press Enter.
[*] When notepad opens, click File and select Open.
[*]Select “Computer” and find your flash drive letter and close the notepad.
[*]In the command window type e:\listparts64.exe and press Enter.

Note: Replace letter e with the drive letter of your flash drive.

[*]The tool will start to run. When the tool opens click Yes to disclaimer.
[*]Press Scan button.

It will make a log (Result.txt)) on the flash drive. Please attach it to your reply.

7

Hi,

@magna86 the report is attached.

@Pondus I get an error trying to run combofix that the program cannot run in recovery mode as it will cause damage. asks to restart then cycles back to chkdsk.

8

Hi Alastair15,

I get an error trying to run combofix that the program cannot run in recovery mode as it will cause damage. asks to restart then cycles back to chkdsk.
Have you read the ComboFix [url=http://www.bleepingcomputer.com/combofix/how-to-use-combofix]disclaimer[/url]? Read that. Also read the "sUBs" [url=http://www.techsupportforum.com/forums/showpost.php?p=1829551]warning[/url] ... ComboFix reprot and operative folder has been created [b]03-12[/b] at [b]11:05[/b]. According to the size of the logfile, ComboFix.txt does shows the report. I will tell FRST to show that reprot...

Important questions: does boot issue occurred after running ComboFix (from normal mode)?

I can’t locate the problem. Everything indicates that the problem is hardware nature. But I’ll try some things in the hope that it will help …

Be warned: The following script shall tell FRST not just to preform some fix attempts but to target the avast related files and folders as well.

FRST’s FixList in RE

Open notepad.

[*]Click Start
[*] Type notepad.exe in the search programs and files box and click Enter.
[] A blank Notepad page should open.
[] Copy/Paste the contents of the code box below into Notepad.

Start
File: C:\Windows\System32\systemsf.ebd
Folder: C:\Qoobox
C:\Program Files\AVAST Software
C:\ProgramData\AVAST Software
C:\Windows\*.tmp
S3 catchme; \??\C:\Users\LEEANN~1\AppData\Local\Temp\catchme.sys [X]
CMD: bcdedit /set nointegritychecks OFF
CMD: netsh winsock reset
CMD: ipconfig /flushdns
CMD: DEL %TEMP%\*.* /F /S /Q
cmd: bootrec /FixMbr
cmd: bootrec /fixBoot
CMD: type  C:\ComboFix.txt
End

[*] Save it to your USB flashdrive as fixlist.txt

Boot into Recovery Environment

Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens …

[*] Press the Fix button once and wait.
[*] FRST will process fixlist.txt
[*] When finished, it will produce a log fixlog.txt on your USB flashdrive.

Exit out of Recovery Environment and post me the log please.