Soft lockups and strange mouse cursor problem

[MagnoliaFan]

Hi,

My Windows 7 machine has recently (since earlier today) developed an annoying habit of locking up briefly (3-5 seconds usually) as well as having the mouse cursor disappearing/not defaulting back to the arrow pointer. The lockups don't force me to do a manual restart and it hasn't BSODed yet.

My specs are:

Windows 7 Ultimate 64bit
12 gig DDR3 memory
Intel i7 950 3.07GHz processor
120 gig SSD main drive
NVIDIA GeForce 460 GPU

I ran a rootkit detector that found 2 issues and initially fixed the problem but it has since returned in the last few hours and makes life very difficult. I've updated my GFX driver and checked my SSD/HDD health, which is all ok.

I've run out of ideas and hope someone can help me out!

 

[VistaKing]

What program did you use to remove the rootkit and did it create a log afterwords ?

 

[MagnoliaFan]

It was the Sophos Virus Removal Tool and it doesn't appear to create a log.

 

[VistaKing]

This is the location of the log

C:\ProgramData\Sophos\Sophos Virus Removal Tool\Logs\SophosVirusRemovalTool.log

 

[MagnoliaFan]

2013-07-18 13:13:00 Sophos Virus Removal Tool version 2.4
2013-07-18 13:13:00 Copyright (c) 2009-2013 Sophos Limited. All rights reserved.

2013-07-18 13:13:00 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2013-07-18 13:13:00 Windows version 6.1 SP 1.0 Service Pack 1 build 7601 SM=0x100 PT=0x1 WOW64
2013-07-18 13:13:00 Checking for updates...
2013-07-18 13:13:02 Update progress: proxy server not available
2013-07-18 13:13:07 Option all = no
2013-07-18 13:13:07 Option recurse = yes
2013-07-18 13:13:07 Option archive = no
2013-07-18 13:13:07 Option service = yes
2013-07-18 13:13:07 Option confirm = yes
2013-07-18 13:13:07 Option sxl = yes
2013-07-18 13:13:07 Option max-data-age = 35
2013-07-18 13:13:07 Option EnableSafeClean = yes
2013-07-18 13:13:07 Couldn't apply option 'EnableSafeClean' to the detection engine [0xa004020c].
2013-07-18 13:13:07 Component SVRTcli.exe version 2.4
2013-07-18 13:13:07 Component control.dll version 2.4
2013-07-18 13:13:07 Component SVRTservice.exe version 2.4
2013-07-18 13:13:07 Component engine\osdp.dll version 1.44.0.2100
2013-07-18 13:13:07 Component engine\veex.dll version 3.45.0.2100
2013-07-18 13:13:07 Component engine\savi.dll version 7.5.13.2100
2013-07-18 13:13:07 Component rkdisk.dll version 1.5.30.0
2013-07-18 13:13:07 Version info: Product version 2.4
2013-07-18 13:13:07 Version info: Detection engine 3.45.0
2013-07-18 13:13:07 Version info: Detection data 4.91
2013-07-18 13:13:07 Version info: Build date 10/07/2013
2013-07-18 13:13:07 Version info: Data files added 333
2013-07-18 13:13:07 Version info: Last successful update (not yet updated)
2013-07-18 13:13:14 Downloading updates...
2013-07-18 13:13:14 Update progress: [I96736] Looking for package C1A903B2-E63E-483b-982D-04BB9C457C60 1.0
2013-07-18 13:13:14 Update progress: [I49502] Found supplement SAVIW32 LATEST 4
2013-07-18 13:13:14 Update progress: [I49502] Found supplement IDE492 LATEST
2013-07-18 13:13:14 Update progress: [I49502] Found supplement IDE493 LATEST
2013-07-18 13:13:14 Update progress: [I19463] Syncing product C1A903B2-E63E-483b-982D-04BB9C457C60 1
2013-07-18 13:13:14 Update progress: [I19463] Syncing product SAVIW32 30
2013-07-18 13:13:28 Update progress: [I19463] Syncing product IDE492 222
2013-07-18 13:13:28 Update progress: [I19463] Syncing product IDE493 114
2013-07-18 13:13:28 Installing updates...
2013-07-18 13:13:33 Update successful
2013-07-18 13:13:39 Option all = no
2013-07-18 13:13:39 Option recurse = yes
2013-07-18 13:13:39 Option archive = no
2013-07-18 13:13:39 Option service = yes
2013-07-18 13:13:39 Option confirm = yes
2013-07-18 13:13:39 Option sxl = yes
2013-07-18 13:13:39 Option max-data-age = 35
2013-07-18 13:13:39 Option EnableSafeClean = yes
2013-07-18 13:13:39 Couldn't apply option 'EnableSafeClean' to the detection engine [0xa004020c].
2013-07-18 13:13:39 Component SVRTcli.exe version 2.4
2013-07-18 13:13:39 Component control.dll version 2.4
2013-07-18 13:13:39 Component SVRTservice.exe version 2.4
2013-07-18 13:13:39 Component engine\osdp.dll version 1.44.0.2100
2013-07-18 13:13:39 Component engine\veex.dll version 3.45.0.2100
2013-07-18 13:13:39 Component engine\savi.dll version 7.5.13.2100
2013-07-18 13:13:39 Component rkdisk.dll version 1.5.30.0
2013-07-18 13:13:39 Version info: Product version 2.4
2013-07-18 13:13:39 Version info: Detection engine 3.45.0
2013-07-18 13:13:39 Version info: Detection data 4.91G
2013-07-18 13:13:39 Version info: Build date 10/07/2013
2013-07-18 13:13:39 Version info: Data files added 334
2013-07-18 13:13:39 Version info: Last successful update 18/07/2013 13:13:33

2013-07-18 13:30:13 Could not open C:\Boot\BCD
2013-07-18 13:30:28 Could not open C:\hiberfil.sys
2013-07-18 13:30:39 Could not open C:\pagefile.sys
2013-07-18 13:42:57 Could not open C:\System Volume Information\{0eb417cb-ef9c-11e2-9b92-bcaec534bfce}{3808876b-c176-4e48-b7ae-04046e6cc752}
2013-07-18 13:42:57 Could not open C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752}
2013-07-18 13:42:57 Could not open C:\System Volume Information\{5b968c41-ef9e-11e2-a569-bcaec534bfce}{3808876b-c176-4e48-b7ae-04046e6cc752}
2013-07-18 13:43:06 Could not open C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Current Session
2013-07-18 13:43:06 Could not open C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Current Tabs
2013-07-18 13:43:06 Could not open C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOCK
2013-07-18 13:43:06 Could not open C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOCK
2013-07-18 13:43:07 Could not open C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bmnlcjabgnpnenekpadlanbbkooimhnj\LOCK
2013-07-18 13:43:07 Could not open C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOCK
2013-07-18 13:52:53 >>> Virus 'Mal/Generic-L' found in file C:\Users\Dan\Downloads\Fr.Cry.III.Updte.v104\Fr.Cry.III.Updte.v104\net.fix\ubiorbitapi_r2_loader.dll
2013-07-18 13:52:53 >>> Virus 'Mal/Generic-L' found in file HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
2013-07-18 13:56:01 Could not open C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb
2013-07-18 13:56:01 Could not open C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
2013-07-18 13:59:32 Could not open C:\Windows\Temp\TMP0000BBFFDDDAAEEF391A873D
2013-07-18 14:02:33 >>> Virus 'Mal/KeyGen-M' found in file D:\$RECYCLE.BIN\S-1-5-21-1713403455-1265810733-2519692852-1001\$R70R5P8.Keygen-BRD\Keygen\Keygen.exe
2013-07-18 14:02:33 >>> Virus 'Mal/KeyGen-M' found in file D:\$RECYCLE.BIN\S-1-5-21-1713403455-1265810733-2519692852-1001\$R70R5P8.Keygen-BRD\Keygen\Keygen.exe
2013-07-18 14:02:33 >>> Virus 'Mal/KeyGen-M' found in file HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
2013-07-18 14:11:03 The following items will be cleaned up:
2013-07-18 14:11:03 Mal/Generic-L
2013-07-18 14:11:03 Mal/KeyGen-M
2013-07-18 14:11:42 Threat 'Mal/Generic-L' has been cleaned up.
2013-07-18 14:11:42 File "C:\Users\Dan\Downloads\Fr.Cry.III.Updte.v104\Fr.Cry.III.Updte.v104\net.fix\ubiorbitapi_r2_loader.dll" belongs to malware 'Mal/Generic-L'.
2013-07-18 14:11:42 File "C:\Users\Dan\Downloads\Fr.Cry.III.Updte.v104\Fr.Cry.III.Updte.v104\net.fix\ubiorbitapi_r2_loader.dll" has been cleaned up.
2013-07-18 14:11:42 Registry value "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA" belongs to malware 'Mal/Generic-L'.
2013-07-18 14:11:42 Registry value "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA" has been cleaned up.
2013-07-18 14:11:42 Removal successful
2013-07-18 14:11:44 Threat 'Mal/KeyGen-M' has been cleaned up.
2013-07-18 14:11:44 File "D:\$RECYCLE.BIN\S-1-5-21-1713403455-1265810733-2519692852-1001\$R70R5P8.Keygen-BRD\Keygen\Keygen.exe" belongs to malware 'Mal/KeyGen-M'.
2013-07-18 14:11:44 File "D:\$RECYCLE.BIN\S-1-5-21-1713403455-1265810733-2519692852-1001\$R70R5P8.Keygen-BRD\Keygen\Keygen.exe" has been cleaned up.
2013-07-18 14:11:44 Removal successful
2013-07-18 14:11:44 Warning: failed to create SafeClean restore instance (0x80004002).


2013-07-18 14:11:50 Scan completed.
2013-07-18 14:11:50

------------------------------------------------------------

2013-07-18 22:30:13 Sophos Virus Removal Tool version 2.4
2013-07-18 22:30:13 Copyright (c) 2009-2013 Sophos Limited. All rights reserved.

2013-07-18 22:30:13 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2013-07-18 22:30:13 Windows version 6.1 SP 1.0 Service Pack 1 build 7601 SM=0x100 PT=0x1 WOW64
2013-07-18 22:30:13 Checking for updates...
2013-07-18 22:30:16 Update progress: proxy server not available
2013-07-18 22:30:18 Option all = no
2013-07-18 22:30:18 Option recurse = yes
2013-07-18 22:30:18 Option archive = no
2013-07-18 22:30:18 Option service = yes
2013-07-18 22:30:18 Option confirm = yes
2013-07-18 22:30:18 Option sxl = yes
2013-07-18 22:30:18 Option max-data-age = 35
2013-07-18 22:30:18 Option EnableSafeClean = yes
2013-07-18 22:30:18 Couldn't apply option 'EnableSafeClean' to the detection engine [0xa004020c].
2013-07-18 22:30:18 Component SVRTcli.exe version 2.4
2013-07-18 22:30:18 Component control.dll version 2.4
2013-07-18 22:30:18 Component SVRTservice.exe version 2.4
2013-07-18 22:30:18 Component engine\osdp.dll version 1.44.0.2100
2013-07-18 22:30:18 Component engine\veex.dll version 3.45.0.2100
2013-07-18 22:30:18 Component engine\savi.dll version 7.5.13.2100
2013-07-18 22:30:18 Component rkdisk.dll version 1.5.30.0
2013-07-18 22:30:18 Version info: Product version 2.4
2013-07-18 22:30:18 Version info: Detection engine 3.45.0
2013-07-18 22:30:18 Version info: Detection data 4.91G
2013-07-18 22:30:18 Version info: Build date 10/07/2013
2013-07-18 22:30:18 Version info: Data files added 334
2013-07-18 22:30:18 Version info: Last successful update 18/07/2013 13:13:33
2013-07-18 22:30:19 Downloading updates...
2013-07-18 22:30:19 Update progress: [I96736] Looking for package C1A903B2-E63E-483b-982D-04BB9C457C60 1.0
2013-07-18 22:30:19 Update progress: [I49502] Found supplement SAVIW32 LATEST 4
2013-07-18 22:30:19 Update progress: [I49502] Found supplement IDE492 LATEST
2013-07-18 22:30:19 Update progress: [I49502] Found supplement IDE493 LATEST
2013-07-18 22:30:19 Update progress: [I19463] Syncing product C1A903B2-E63E-483b-982D-04BB9C457C60 1
2013-07-18 22:30:19 Update progress: [I19463] Syncing product SAVIW32 30
2013-07-18 22:30:19 Update progress: [I19463] Syncing product IDE492 222
2013-07-18 22:30:20 Update progress: [I19463] Syncing product IDE493 117
2013-07-18 22:30:20 Installing updates...
2013-07-18 22:30:20 Update successful
2013-07-18 22:30:24 Option all = no
2013-07-18 22:30:24 Option recurse = yes
2013-07-18 22:30:24 Option archive = no
2013-07-18 22:30:24 Option service = yes
2013-07-18 22:30:24 Option confirm = yes
2013-07-18 22:30:24 Option sxl = yes
2013-07-18 22:30:24 Option max-data-age = 35
2013-07-18 22:30:24 Option EnableSafeClean = yes
2013-07-18 22:30:24 Couldn't apply option 'EnableSafeClean' to the detection engine [0xa004020c].
2013-07-18 22:30:24 Component SVRTcli.exe version 2.4
2013-07-18 22:30:24 Component control.dll version 2.4
2013-07-18 22:30:24 Component SVRTservice.exe version 2.4
2013-07-18 22:30:24 Component engine\osdp.dll version 1.44.0.2100
2013-07-18 22:30:24 Component engine\veex.dll version 3.45.0.2100
2013-07-18 22:30:24 Component engine\savi.dll version 7.5.13.2100
2013-07-18 22:30:24 Component rkdisk.dll version 1.5.30.0
2013-07-18 22:30:24 Version info: Product version 2.4
2013-07-18 22:30:24 Version info: Detection engine 3.45.0
2013-07-18 22:30:24 Version info: Detection data 4.91G
2013-07-18 22:30:24 Version info: Build date 10/07/2013
2013-07-18 22:30:24 Version info: Data files added 337
2013-07-18 22:30:24 Version info: Last successful update 18/07/2013 22:30:20

2013-07-18 22:30:35 Scan completed.
2013-07-18 22:30:35

------------------------------------------------------------

 

[VistaKing]

Farbar Recovery Scan Tool


64-Bit Version OS Farbar Recovery Scan Tool x64 <===== Download Link

Drag the FRST64.exe from the Downloads folder to your Desktop

Right click on FRST64.exe and choose

When the tool opens click Yes on the disclaimer window .

Press Scan button.

FRST will let you know when the scan is complete and has written the FRST.txt to file

   Note

The first time Farbar Recovery Scan Tool is run, it makes also another log Addition.txt

Please upload both logs in your reply.(FRST.txt and Addition.txt)

:note: FRST.txt and Addition.txt will be on the Desktop :note:

Upload a File
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .

 

[MagnoliaFan]

There we go

 

[VistaKing]

I don't see any malicious software . I do recommend removing Daemon Tools Lite and Spybot - Search & Destroy

 

[MagnoliaFan]

What problems could they be causing? Not had any issues with them on a system in the past.

Any other suggestions as to what could be causing the problem?

It has been unusually hot here recently and my case is a little short on ventilation as I can't run all my fans, could overheating cause this?

 

[VistaKing]

Daemon Tools is known to cause BSODs on Windows 7 . Spybot is an old program that a lot of people don't use .

Download this program

RogueKiller for 32bit <==== Download Link

RogueKiller for 64bit <==== Download Link

:ar: Click on one of the links above that goes with your Windows 7 bit versions

:ar: Save to the Desktop.

:ar: Close all windows and browsers

:ar: Right click on

and choose

:ar: Press: SCAN

:ar: provide the RKreport.txt (Mode: Scan) in your reply.

 

[MagnoliaFan]

I've uninstalled Spybot but I still use Daemon Tools and will only uninstall if it starts to give me problems, unless you strongly recommend I do so regardless.

Edit: Also, having just done a restart after removing Spybot it's now behaving itself but it did this previously and then started to present the same problems again.

 

[VistaKing]

Run RK again and click the Delete button .

 

[MagnoliaFan]

Done. Do you need another report? And should I do a restart?

 

[VistaKing]

Try to login to normal mode

 

[MagnoliaFan]

Seems to have done the trick, thanks very much!

I'll leave it till tomorrow before marking this as solved, just to be sure.

 

[MagnoliaFan]

Sadly the problem has returned after I thought everything was OK last night.

Any more suggestions?

 

[VistaKing]

Run

Malwarebytes

Download Link :ar: MalwareBytes

When the installation is done uncheck Enable free trial of Malwarebytes (see image below )

Update the definitions and do a full scan

:ar: On the Scanner tab:
Make sure the "Perform Full Scan" option is selected.
Then click on the Scan button.
:ar: If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
:ar: The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
:ar: When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
:ar: Click OK to close the message box and continue with the removal process.
:ar: Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
:ar: Make sure that everything is checked, and click Remove Selected.
:ar: When removal is completed, a log report will open in Notepad.
:ar: The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
:ar: Copy and paste the contents of that report in your next reply and exit MBAM.