Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Windows restarts 3-5 times to properly see the login page

12 Sep 2010   #1

Windows 7 Professional 32bit
 
 
Windows restarts 3-5 times to properly see the login page

Hi all.
so i've been running windows 7 for over a year now on a 1.5 year old laptop.
recently i've noticed that my laptop has been taking a LOT longer to load.
starting about 1 month back. at first i dismissed it as i thought it was a one-off thing but the problem is not going away and it appears to be getting worse.

basically, i boot up my laptop, i see the "starting windows" screen with the windows icon. and then it turns into a black screen with my mouse in the centre. it sits for about 30 or more seconds before it basically restarts and boots up my laptop again. this process repeats for about 3-5 (it varies) times before i can finally see the login page.

im not sure if this problem is related but when i hibernate my laptop. and try to boot it up again. it leads me to a completely black page. and doesnt respond to anything. i have to force shut down.

ive seen a lot of reports about people getting this "black screen of death" or whatever. but i dont know if its the same problem becuase i do eventually get somewhere..

i already opened a thread in the crashes and debugging forum here.. but ive been informed its probably a virus and was directed here for help..
link to my previous thread --> http://www.sevenforums.com/crashes-d...ogin-page.html

so far i have run mcAfee full scan and malwarebytes full scan.
Quote:
i can see a very simple log of the mcafee scan. doesnt allow me to copy and paste or save but the main detail is:
Total files detected: 15
Total files quarantined: 13
and ive attached my logs from malwarebytes

any help would be great thanks!




Attached Files
File Type: txt mbam-log-2010-09-12 (14-11-00).txt (4.2 KB, 11 views)
File Type: txt mbam-log-2010-09-12 (16-50-33).txt (901 Bytes, 3 views)
My System SpecsSystem Spec
.

12 Sep 2010   #2

windows 7 ultimate 64 bit,Windows 7 ultimate 32 bit,Windows XP sp3 home
 
 

hi.......
scan your pc with hitmanpro and dr web cureit
My System SpecsSystem Spec
12 Sep 2010   #3
Microsoft MVP

Windows 7 Ultimate 32bit SP1
 
 

You are infected with a 'backdoor' bot

These are the most dangerous, and most widespread, type of Trojan.
Backdoor Trojans provide the author or ‘master’ of the Trojan with remote ‘administration’ of victim machines. Unlike legitimate remote administration utilities, they install, launch and run invisibly, without the consent or knowledge of the user. Once installed, backdoor Trojans can be instructed to send, receive, execute and delete files, harvest confidential data from the computer, log activity on the computer and more.
If your computer was used for online banking or has credit card information on it, all passwords should be changed immediately to include those used for email, eBay and forums.
You should consider them to be compromised.
They should be changed by using a different computer and not the infected one, if not an attacker may get the new passwords and transaction information.
Banking and credit card institutions should be notified of the possible security breech.
More info can be found below:
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
How to report ID theft, fraud, drive-by installs, hijacking and malware? Security - dslreports.com
When should I re-format? How should I reinstall?
When should I re-format? How should I reinstall? Security - dslreports.com
If you choose to format and reinstall see this link for instructions:
Windows: reformat and reinstall - Cyberwalker.com

Right now, let's flush your DNS cache and restore MS's original Hosts file.
Copy and paste these lines in Note pad.
@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0
Save as flush.bat to your desktop. Right click the .bat file and run as Administrator. Your computer will reboot itself.

Download this scanner: Dr.Web CureIT! to your desktop. Run a full scan.
http://www.freedrweb.com/cureit/?lng=en
My System SpecsSystem Spec
.


12 Sep 2010   #4

Windows 7 Professional 32bit
 
 

wow. i did not know my computer problem was this serious. had i known. i would surely have reported this earlier..
running the scan now
My System SpecsSystem Spec
13 Sep 2010   #5

Windows 7 Professional 32bit
 
 

okay so I've finally finished the scan.
I can't seem to find the log but there were about 50 items found at 80% of the scan
I tried booting up my computer once this morning and there was no problem. havnt had time to try more
is there a way to check that the trojan is definately gone??
thanks
My System SpecsSystem Spec
13 Sep 2010   #6

windows 7 ultimate 64 bit,Windows 7 ultimate 32 bit,Windows XP sp3 home
 
 

Quote   Quote: Originally Posted by thehay View Post
there were about 50 items found at 80% of the scan
hmmm......i would dump the av that seemed to have slept all this while.

Quote:
I tried booting up my computer once this morning and there was no problem. havnt had time to try more
is there a way to check that the trojan is definately gone??
repeat the mbam/hitman scans.........all clean on repeat scan will be a good sign...but in reality i would be skeptical with any cleaning...when it involves so many detections........do change all your passwords....you can also post a hijack this log and pm jacee or corrine to take a look at it.....
My System SpecsSystem Spec
14 Sep 2010   #7

Windows 7 Professional 32bit
 
 

well most of those 50 items were in the quaratine folder of mcafee.
i must of left them as quaratined and never deleted?

is this the hijackthis log?


Attached Files
File Type: log hijackthis.log (10.8 KB, 7 views)
My System SpecsSystem Spec
14 Sep 2010   #8
Microsoft MVP

Windows 7 Ultimate 32bit SP1
 
 

Hi thehay,

Download Combofix from any of the links below, and save it to your desktop.<--Important
Link 1
Link 2
Link 3

Click on this link Here to see a list of programs that should be disabled.
The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
Next: Disconnect from the internet. If you are on Cable or DSL, unplug your computer from the modem.
Next: Please disable all onboard security programs (all running with back ground protection) as it may hinder the scanner from working.
This includes Antivirus, Firewall, and any Spyware scanners that run in the background.
  • Double click combofix.exe and follow the prompts.
  • When finished, it will produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Please be patient while the scan runs, at times it may appear to stall.
When finished and after reboot (in case it asks to reboot), it should open a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.
After rebooting ensure your Security applications have been re-enabled.

In your next reply post:
ComboFix.txt
New HJT log taken after the above scan has run

***A guide and tutorial on "How to use Combofix" can be found here:
A guide and tutorial on using ComboFix
My System SpecsSystem Spec
14 Sep 2010   #9

Windows 7 Professional 32bit
 
 

my mcafee security center decided today was the day to deactivate itself.
so i couldnt figure out how to actually exit mcafee. but i thought that since it was deactivated.. it wouldnt have any effect anyways.. was i wrong?

i activated my mcafee again and this time i was able to turn off the av and firewall properly
ive posted the new logs now


Attached Files
File Type: log hijackthis.log (10.0 KB, 9 views)
File Type: txt comboFix.txt (25.5 KB, 9 views)
My System SpecsSystem Spec
18 Sep 2010   #10
Microsoft MVP

Windows 7 Ultimate 32bit SP1
 
 

Oops, it's been a while since I replied back to you, very sorry

Did you want to keep the conduit search and tool bar?
Messenger Plus Live UAE Toolbar - a Conduit "Community Toolbar" - modifies the default IE URL search hook. Conduit toolbars are reputed to have a certain trackware functionality.

1. Open FireFox, Go to tools (at the top of the screen) and click on "Add-ons".

2. Scroll down and find your toolbar extention.

3. Click 'uninstall.

Download TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. Right click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

TFC (Temp File Cleaner) will clear out all temp folders for all user accounts (temp, IE temp, java, FF, Opera, Chrome, Safari), including Administrator, All Users, LocalService, NetworkService, and any other accounts in the user folder. It also cleans out the %systemroot%\temp folder and checks for .tmp files in the %systemdrive% root folder, %systemroot%, and the system32 folder (both 32bit and 64bit on 64bit OSs). It shows the amount removed for each location found (in bytes) and the total removed (in MB). Before running, it will stop Explorer and all other running apps. When finished, if a reboot is required the user must reboot to finish clearing any in-use temp files.

TFC only cleans temp folders. TFC will not clean URL history, prefetch, or cookies. Depending on how often someone cleans their temp folders, their system hardware, and how many accounts are present, it can take anywhere from a few seconds to a minute or more. TFC will completely clear all temp files where other temp file cleaners may fail. TFC requires a reboot immediately after running. Be sure to save any unsaved work before running TFC.

Once you have done the above, please update MBam, then select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. Copy and Paste that log into your next reply.
My System SpecsSystem Spec
Reply

 Windows restarts 3-5 times to properly see the login page




Thread Tools



Similar help and support threads for2: Windows restarts 3-5 times to properly see the login page
Thread Forum
Attempting to login to most websites results in login page refreshing. Browsers & Mail
Page doesn't load properly - what's the cause? Browsers & Mail
Windows 7 Restarts at random times. Performance & Maintenance
Installed Updates page not displaying properly Windows Updates & Activation
Windows takes 3-5 times to properly see the login page BSOD Help and Support
Windows 7 restarts before login BSOD Help and Support
Windows 7 login page. General Discussion

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 10:00 PM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33