I have a Dell with win XP that boots to a black screen in normal mode and hangs after aswrvrt.sys when in safe mode. I have downloaded OTLPENet.exe and FRST and run the scan as suggested in previous topics. Any help is appreciated.
Thanks Bax
Here is the FRST file
Hi and Welcome!!
My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I’d be grateful if you would note the following:
[] The fixes are specific to your problem and should only be used for the issues on this machine.
[] It’s often worth reading through these instructions and printing them for ease of reference.
[] If you don’t know or understand something, please don’t hesitate to say or ask!! It’s better to be sure and safe than sorry.
[] Please reply to this thread. Do not start a new topic.
[] If you happen to have a flash drive/thumb drive please have that ready in the event that we need to use it.
[]Please be sure to subscribe to the topic if you have not already done so.
IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your operating system and losing all your programs and data.
Having said that…
http://i1224.photobucket.com/albums/ee380/jeffce74/vegeta_zps7f4345cf.gif
Let’s get going!!
WARNINGUnfortunately one or more of the infections I have identified are Backdoor Trojans, IRCBots or other Malware capable of stealing very important information. You need to stop using all Internet Banking sites, change passwords to all sites with sensitive information from a clean computer and phone your bank to inform them that you may be a victim of identify theft. More often than not, we advise users that a full reinstallation of their Operating System is the only way to ensure that their computer will ever be 100% clean again.
Unfortunately I have found what is known as the ZeroAccess rootkit on your system. It is an especially nasty infection that can take quite some time to clean as well as may have damaged your system files itself. As a warning, during the cleaning (if you choose to do so) you may lose internet access with this computer and in the end we may need to reinstall the operating system anyway depending on the extent of the infection.
If you would like to format and reinstall your Operating System please let me know and we can assist you with that.
If you would like to continue with the cleaning, please continue with the following instructions and I will be more than happy to help. 
Please download DDS from either of these links
and save it to your desktop.
[*]Disable any antivirus programs during the scan (If you have difficulty properly disabling your protective programs, refer to this link here )
[*] Double click dds to run the tool.
[*]When done, two DDS.txt’s will open.
[*]Save both reports to your desktop.
Please include the contents of the following in your next reply:
DDS.txt
Attach.txt
http://i1224.photobucket.com/albums/ee380/jeffce74/aswmbr-1-1.jpg
Please download aswMBR to your desktop.
[*]Double click the aswMBR icon to run it.
[*]Click the Scan button to start scan.
[]If you are asked to update the Avast Virus database please allow it to do so.
[]When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.
http://i1224.photobucket.com/albums/ee380/jeffce74/aswmbrscan.jpg
Click the image to enlarge it
http://i1224.photobucket.com/albums/ee380/jeffce74/adwcleaner.jpg
AdwCleaner
[*]Close all open programs and internet browsers.
[*]Double click on adwcleaner.exe to run the tool.
[*]Click on Delete.
[*]Confirm each time with Ok.
[*]You will be prompted to restart your computer. A text file will open after the restart.
[*]Please post the contents of that logfile with your next reply.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.
Thank you for your help. Is the DDS something that can be downloaded to the Reatgo desktop? That is the only way I can currently access anything other than a black screen.
Ok…disregard DDS for the time being. I am at work right now but will review your FRST much more thoroughly when I get home and give you instructions for that.
Hi,
Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flashdrive as fixlist.txt
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess?
HKU\Jack Costner\...\Run: [Advanced SystemCare 5] - C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe [ 2011-12-29] (IObit)
HKU\Lillie Costner\...\Run: [Advanced SystemCare 5] - C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe [ 2011-12-29] (IObit)
S2 AdvancedSystemCareService5; C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe [497496 2011-12-29] (IObit)
2013-07-19 18:57 - 2013-07-19 18:57 - 31801344 _____ C:\Windows\System32\config\software.iobit
2013-07-19 18:57 - 2013-07-19 18:57 - 05173248 _____ C:\Windows\System32\config\system.iobit
2013-07-19 18:57 - 2013-07-19 18:57 - 00274432 _____ C:\Windows\System32\config\default.iobit
2013-07-19 18:57 - 2013-07-19 18:57 - 00053248 _____ C:\Windows\System32\config\SECURITY.iobit
2013-07-19 18:57 - 2013-07-19 18:57 - 00024576 _____ C:\Windows\System32\config\SAM.iobit
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.
Attach the new log and let me know exactly how your system is running now.
Ok I ran the scan again and the (fixlist.txt) No change to the computer still loads to black screen in normal mode and hangs after aswrvrt.sys in safe mode. I have attached the (fixlog.txt)
Hi,
Ok please do the following…
Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flashdrive as fixlist.txt
HKLM\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess?
S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
S2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [29816 2013-05-09] (AVAST Software)
S2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [66336 2013-05-09] (AVAST Software)
S1 aswRdr; C:\Windows\System32\Drivers\aswRdr.sys [49760 2013-05-09] (AVAST Software)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49376 2013-05-09] ()
S1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [770344 2013-06-27] (AVAST Software)
S1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [369584 2013-06-27] (AVAST Software)
S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [56080 2013-05-09] (AVAST Software)
S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [175176 2013-06-27] ()
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.
Once complete let me know if you can boot your system now.
Still unable to boot. Safe mode now hangs after (Mup.sys). Still boots to black screen in normal mode. I have attached the fixlog.txt from the previous fix.
Hi,
Ok we need to try and get you back to a restore point from a few days ago and see if we can get your system booted up again.
Download attached fixlist.txt file and save it to the Desktop.
NOTE. It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.
Here is the fixlist.txt
If you are able to boot to your system let me know…if not, let me know what happens.
The only thing that changed was now it hangs at aswrvrt.sys in safe mode like it was doing in the beginning.
Hi,
Let’s use the same set of instructions to run a script with FRST again, just like you did before, and then post the new log that is created as well as let me know how your system is running.
The new fixlist.txt is attached.
No change in how the system is running. Safe mode - aswrvrt.sys Normal mode - Black screen
Do you remember the approximate date of the last time you could boot to your system normally?
It had been running slow for several weeks. It began this exact issue about 10 days ago roughly.
Ok we may need to go further back to get your system back started…
Run FRST with the following script that is attached just like you have been. Let me know if your system boots…
Unfortunately there was no change with this either.
Ok…I am hoping this isn’t the case but we need to make sure this is not a failed hard drive…
Please download MHDD utility from here:
MHDD download link
Unpack and burn as an ISO
Restart your system and boot MHDD from disk
[*] When you load the file select option 1
[*] When the menu appears, select the disk that you’ll scan
Type in:
scan
…and hit enter
[*]In the next menu, click F4
[*]It will begin HDD scanning, let him to finish scan.
If there is more than 3 inputs in the district UNC X then your hard disk is damaged.
[/quote]
Nothing showed up for the unc x. Hopefully this is a bit of good news.