Unable to Shut Down and Log Off Correctly-Host Filed Infected

[intuity]

Hi,
I am working on a friend's PC which runs Windows XP. She has the Administrator's account rights and has four oter user accounts created to share the PC. First problem is that she can't access Symantec's web site to download current anti virus files. I checked her host file and found a ton of entries with the 127.0.0.1 address pointing to all kinds off different web addresses. For the moment, I have simply deletd those entriesand cut and pasted the correct entry 127.0.0.1 local host.
I tried to run CWShredder but it terminated before completing indicating it ran into a problem and wanted to send a report to MicroSoft. I have not see nthis before. I then tried to run Spy Bot S&D it found a number of items to fix but could not fix them becasue it claimed some win.ine fiel with a German name to it was currently being used. Not sure what that is all about. Finally, she showed me that when she clicks on the start button, then clicks on shut down, it does not turn her PC off. She must then click on switch user id button, then click shut down and log off. I have never see nanything tha takes control of the ability to sut down or log off the PC, especially since she is the Administraator account. I would apprecaite step by step suggestions for how to clean and fix these problems, thanks, Intuity

 

[bcastner]

See my notes in faq608-4650 as to why CWShredder terminates early.

 

[intuity]

Bcastner,

Thank you for the tip. What do you think is preventing her from suting down of just logging off correctly? IS it a rowser hijacking the system or some sort of virus\worm?

Intuity

 

[bcastner]

It is a stuck process somehow.

As a test: Start, Run, CMD
shutdown -s -f -t 0

Does it now shutdown?

One thing that could possibly help is to add a new service:

http://www.microsoft.com/downloads/...6D-8912-4E18-B570-42470E2F3582&displaylang=en

But I would do the malware cleanup to make sure it is not a bad guy that is the stuck process.

In addition, you should review:

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q308029

http://www.theeldergeek.com/shutdown_issues_in_xp.htm

http://www.aumha.org/win5/a/shtdwnxp.htm

Best wishes,
Bill Castner

 

[intuity]

Bcastner,

Thank you once again I am new to the virus and malware clean up process and am having to ask some novice questions. OK, should I run all of the malware aclean up tools in normal mode on XP first or run them in safe mode first and then in normal mode after reboot? I am thinking that the infected host file will be taken care of properly by running the malware and spyware tools. I am not at the infeted PC at this time and wont be able to get to work on it more until around 7-8pm EST tonight. I am trying to get my plan of attack worked out so that I can focus intently on a strategy once in fron of the PC again. Thus, I am trying to determine which tools to run, the corect order and which operating mode to run them all in (normaal or safe). Norton anti virus always suggests running averything i nsafe mode then again in normal mode.
thanks, Intuity

 

[bcastner]

I would before anything else disable System Restore (if an XP workstation).

First, in normal boot mode, let the Microsoft Antispyware (freeware until the end of July, 2005) handle the heavy lifting:

http://www.microsoft.com/athome/security/spyware/software/default.mspx

Second, reboot into normal Mode. follow faq608-4650 although you do not have to do the antivirus scans. Run CWShredder, Adaware and Spybot as discussed.

Third, boot into Safe mode. Run Adaware and Spybot.

Finally, hopefully you are still running the active agents in the Microsoft product. It would be worthwhile adding Spyware Blaster to the mix:

http://www.wilderssecurity.net/spywareblaster.html

Best wishes,
Bill Castner


Best,
Bill Castner

 

[intuity]

Bcastner,

thank you very, very much for the detailed resolution process. This is what I neeed to put in place, a good plan! I'll implement this process later this eveng and will letyou know how it goes.

thanks,

Inuity

 

[bcastner]

Please do tell us how it sorts. I am a little worried that you may have one of the newer VX2 variants, which requires special steps not covered above:

http://www.lavasoftsupport.com/index.php?showtopic=54511

But start with the plan above and keep your fingers crossed tightly.

Best wishes,
Bill Castner

 

[intuity]

Bcastner,

Thank you very much for all of your suggestions. I disabled system restore first. Then, applied the Microsoft Antispyware tool and it found 23 various toolbar hijackers, adware, spyware, worms and trojans. The best part was that it described what each malicious program could do and the serverity of each application. Moreover, MSASW actually removed all of the items where CWShredder and Spy Bot S&D could not. Next, I ran Norton Anti Virus adn it found two virus files which I had to remove in safe mode.

The log off problem was resolved by MSAntispyware and running NAV. The only remaining problem is that something corrupted the NAV Redirector application. I followed NAV's instructions and it will have to be totally removed and reinstalled. All in all, your advice was responsible for a sucessful system restore. Thank you! Intuity.