Problem when I try to enter a game lobby

mcwarren4 · Post by **mcwarren4** » Thu Jan 22, 2009 4:29 am

I can get into ASGS fine. Allegiance starts up fine. I can get to the point where I'm trying to enter the game lobby and then I get a blue screen that flashes up, except its not just blank, it looks like its a scrambled screen, then the computer reboots.

The only thing I've done differently in the last day is that I downloaded and ran malwarebytes to get rid of these pop up windows that kept invading my laptop.

So then I uninstalled and reinstalled Allegiance. It worked fine. I exited Allegiance to work on some other stuff. Went back into Allegiance and the same thing started happening again. Any ideas on what this could be?

raumvogel · Post by **raumvogel** » Thu Jan 22, 2009 4:41 am

Hopefully you don't have that bios killing rootkit malware thing that I read about on ZDnet last November.

mcwarren4 · Post by **mcwarren4** » Mon Jan 26, 2009 11:39 pm

Windows Version (and Service Packs): XP Pro SP2
Processor Speed: 994 MHz
RAM: 512 MB
Video Card (Make and Model#): ATI MOBILITY RADEON Xpress 200 series
Sound Card (Make and Model#): Conexant AMC Audio
Connection Type (Dialup, Cable, DSL, other): DSL
Modem (Make and Model#): Don't know how to find, but probably not related to problem
Router (Make and Model#): Don't know how to find, but probably not related to problem
Internet Service Provider(company name): AT&T
Location(State/Province/Locality, and Country): Indianapolis, IN
Installed Mods: none other than the aiming reticule

Make and Version of firewall: McAfee v 12.1
Make and version of anti-virus: McAfee v 8.1

Confirm that you have the following installed:

.Net 1.1 [ yes]

Service Pack 1 for .Net 1.1 [yes ]

Hotfix for .Net 1.1 [ yes]

Drive Allegiance is installed on: C

Problem Encountered at Step #: 10
Which Program (ASGS/Allegiance): Allegiance
What Error Message: none
Comments (What you tried, description, etc):

When I click on Join Game sometimes it lets me in, sometimes it does not. On the times when I cannot get in, the screen goes blue and has a bunch of white lines on it. There seems to be no rhyme or reason as to why it won't work sometimes and it does work other times. The system usually automatically reboots a split second after it goes to blue screen, but sometimes it locks up there. Once it reboots or I shut it off and turn it back on the computer operates normally.

I downloaded and ran an anti-spyware/malware program just before this started happening. I uninstalled and reinstalled Allegiance after this happened the first few times, but it didn't seem to help.

HSharp · Post by **HSharp** » Mon Jan 26, 2009 11:50 pm

You haven't had any hardware changes? Driver updates?

It could be a hardware problem, if you notcied a direct correlation between playing Allegiance and installing malwarebytes then that might be the problem, or perhaps was there a McAffee upgrade anytime recently?

As for video and sound details, press windows key then R (or go into the run box basically) and load up "dxdiag.exe", that should show you most of your computer details with graphics and sound being in the graphics and sound tabs.

mcwarren4 · Post by **mcwarren4** » Tue Jan 27, 2009 5:30 pm

No hardware changes. No driver updates.

There was a direct correlation to the malwarebytes thing. The problem is I'm completely illiterate with the interworkings of computers, so knowing that there was a correlation doesn't get me anywhere. So any help someone could give me would be much appreciated.

Thanks for the tip on getting system information.

HSharp · Post by **HSharp** » Tue Jan 27, 2009 5:38 pm

well I haven't used malware bytes, did it provide a backup of stuff it deletes? Or a list? I can only guess that it removed something essential to your system's allegiance playing capabilities.

mcwarren4 · Post by **mcwarren4** » Tue Jan 27, 2009 8:52 pm

Glad you asked! I didn't think of that. As you can see it found a lot of stuff, but its mostly gibberish to me. If anyone can point out something that needs to be restored let me know. Thanks in advance.

Malwarebytes' Anti-Malware 1.33
Database version: 1674
Windows 5.1.2600 Service Pack 2

1/21/2009 12:55:23 PM
mbam-log-2009-01-21 (12-55-23).txt

Scan type: Quick Scan
Objects scanned: 64341
Time elapsed: 17 minute(s), 27 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 6
Registry Keys Infected: 52
Registry Values Infected: 4
Registry Data Items Infected: 1
Folders Infected: 8
Files Infected: 26

Memory Processes Infected:
C:\Program Files\VnrPack\VnrPack22.exe (Adware.ISM) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS\system32\walwyrvq.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\qwjbbdnq.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\fcwwvf.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Program Files\WebShow\WebShow.dll (Trojan.Agent) -> Delete on reboot.
C:\Program Files\Mjcore\Mjcore.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\system32\ljJBtqPG.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{70435ada-8f0d-4366-84a9-f5a5f6276312} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{70435ada-8f0d-4366-84a9-f5a5f6276312} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c6bb3be3-378f-40c9-8e9b-e7350a723086} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c6bb3be3-378f-40c9-8e9b-e7350a723086} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{274cec44-a1bd-4bb7-bb6c-df7f5dc46d6c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{274cec44-a1bd-4bb7-bb6c-df7f5dc46d6c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c6bb3be3-378f-40c9-8e9b-e7350a723086} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bho_cpv.workhorse (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{63334394-3da3-4b29-a041-03535909d361} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e4a04a1-a24d-45ae-aca4-949778400813} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bho_cpv.workhorse.1 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bho_myjavacore.mjcore (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{e0f01490-dcf3-4357-95aa-169a8c2b2190} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{17e44256-51e0-4d46-a0c8-44e80ab4ba5b} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d88e1558-7c2d-407a-953a-c044f5607cea} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d88e1558-7c2d-407a-953a-c044f5607cea} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d88e1558-7c2d-407a-953a-c044f5607cea} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bho_myjavacore.mjcore.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\setup.player (Spyware.MarketScore) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\setup.player.2k2 (Spyware.MarketScore) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{892b2785-b0d0-4aa2-ae6a-0ed60b00a979} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ljjbtqpg (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{35b7e48b-9d81-4c6c-9578-5fd4f620d886} (Spyware.MarketScore) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{80ef304a-b1c4-425c-8535-95ab6f1eefb8} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{e81cf86b-f683-422a-b742-3f2427ea9d6a} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{84ba8988-33e1-4c89-a150-bf428e8d3213} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{99c6d1bb-7555-474c-91da-d8fb62a9cc75} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lbhaibuc (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\lbhaibuc (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lbhaibuc (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\icheck (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\BHO_MyJavaCore.DLL (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\virusremover2008 (Rogue.VirusRemove) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\virusremover2008 (Rogue.VirusRemove) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\GetModule (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\VnrPack (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3df70be1-db6e-e74f-5fd0-c2dc4aeb9c70} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3df70be1-db6e-e74f-5fd0-c2dc4aeb9c70} (Adware.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vnrpack22 (Adware.ISM) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cfahecatevih (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ajuwas (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\GrandPack (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\iCheck (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\GetModule (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\VnrPack (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files\VirusRemover2008 (Rogue.VirusRemove) -> Quarantined and deleted successfully.
C:\Program Files\Mjcore (Trojan.BHO) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Application Data\gadcom (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\Application Data\GetModule (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\qoMfcBsq.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\qsBcfMoq.ini (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\qsBcfMoq.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fcwwvf.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\walwyrvq.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\qvrywlaw.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qwjbbdnq.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Program Files\VnrPack\VnrPack22.exe (Adware.ISM) -> Quarantined and deleted successfully.
C:\Program Files\WebShow\WebShow.dll (Trojan.Agent) -> Delete on reboot.
C:\Program Files\Mjcore\Mjcore.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\system32\ljJBtqPG.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\prunnet.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\tnisjhvh.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chet Warren\Local Settings\Temp\winSbhyX3S1JhNA.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chet Warren\Local Settings\Temporary Internet Files\Content.IE5\28I53XSO\index[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chet Warren\Local Settings\Temporary Internet Files\Content.IE5\ARCJAZY5\upd105320[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Program Files\iCheck\Uninstall.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\VnrPack\dicts.gz (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files\VnrPack\trgts.gz (Adware.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\Application Data\GetModule\dicik.gz (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\Application Data\GetModule\kwdik.gz (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\Application Data\GetModule\ofadik.gz (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\usimewiga.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\Qqukevocogi.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\mlJYrOIy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

HSharp · Post by **HSharp** » Tue Jan 27, 2009 11:01 pm

And now we wait for a real Helpline Moderator to show up

My quick scan of the files didn't show anything out of the ordinary, any cause for concern might be changes with Internet Explorer but your not having a connectivity problem so it doesn't matter.

And boy did you have a lot of crap on your comp

sambasti · Post by **sambasti** » Tue Jan 27, 2009 11:58 pm

Maybe you could point a film camera at your computer, repeatedly open and close allegiance, and after the error comes you will be able to replay the recording, pause at the error and see exactly what it said on screen when it crashed.

I think I had a similar error once, and those white lines were text. (If I'm not mistaken)

Grimmwolf_GB · Post by **Grimmwolf_GB** » Wed Jan 28, 2009 12:05 am

This is now moving away from your original problem:
- Make a backup of your important data.
- Check the backup
- Make sure you got everything.
- Re-check the backup
- Format your primary partition (the one with windows on it) (if it is your only partition, create one for windows (10GB for winXP), one for your data, one for games
- Install windows
- Copy your data to the data partition
- Install the games to the games partition
- Install Alleg to the main partition

Why? Once a computer is infected, you can never know if there is more hidden bad stuff on it. Antivirus software is only a good sign that something is wrong. It is not a sign that everything is OK.