# Desktop flashes on and off



## hazzarduk1 (Aug 2, 2003)

my desktop flashes on and off every 3 seconds or so. The icons and taskbar both disappear, in this time the computer is unuseable, but it comes back 2 seconds later and it is fine to use again. I'l attach a HJT log, thank you for any help

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:59:26, on 20/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\Desktop\HiJackThis.exe
C:\WINDOWS\explorer.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1207168534079
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD39/JSCDL...-jc.cab&File=jinstall-6u5-windows-i586-jc.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 5295 bytes


----------



## devil_himself (Apr 7, 2007)

Greetings hazzarduk1 

Click Start, click Run, type eventvwr.msc in the Open box, and then press Enter.
Click the Application category.

Look For Recent Errors > Double Click on them > Another Windows Will open > On the Right Side use the Double Notepad icon to copy the error paste them here


----------



## hazzarduk1 (Aug 2, 2003)

> Event Type:	Information
> Event Source:	Winlogon
> Event Category:	None
> Event ID:	1002
> ...


the whole list is filled with hundreds of this error


----------



## devil_himself (Apr 7, 2007)

hmm .. Does The Error Occur Randomly Or When You Are Doing Something Specific Like

Searching Using XP Search 
Right Click Anywhere
Opening Or Closing A Folder
Or...


----------



## hazzarduk1 (Aug 2, 2003)

i would say its a random thing. Seems to happen every 3 - 5 seconds on average, it does it all the time until i just shut the computer down


----------



## devil_himself (Apr 7, 2007)

Start > Run > *Msconfig* > Startup tab > Uncheck Startup Items One By One And Restart.. See if it crashes ..


----------



## hazzarduk1 (Aug 2, 2003)

i removed them all one by one and restarted, same thing still happens


----------



## devil_himself (Apr 7, 2007)

Try This

What is the System File Checker, and how do I run it?
http://ask-leo.com/what_is_the_system_file_checker_and_how_do_i_run_it.html


----------



## hazzarduk1 (Aug 2, 2003)

just finished that, still acting the same way, still reloading every 3 - 5 seconds


----------



## devil_himself (Apr 7, 2007)

Download Process Monitor from Microsoft Sysinternals:
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

Unzip the archive and run the utility.
Press Ctrl + E To Stop The Monitoring
In the Filtering options, include this process

explorer.exe

Start Monitoring Ctrl + E
Now Let Explorer.exe Crash ! {Everything Disappears }
Stop Monitoring
Save the results to a file -> File -> Save ->In the "Events to save", select "Events displayed using current filter". And save it in PML format.

Now Zip The Log And Attach It Here Or Email It To Me !


----------



## hazzarduk1 (Aug 2, 2003)

i wasnt able to upload it to here due to the upload limit, the file is fairly large. I did manage to upload it to http://megafileupload.com/en/file/59689/logfilezip-zip.html though


----------



## devil_himself (Apr 7, 2007)

I'm Not Able To Download The LOg From That Site ..Though I See That Its 12 MB In Size ! 

You Say that Explorer.exe Crashes After Every 3 or 4 Seconds .. The Log Should Not Be That Big .. I Will be Difficult To Read .. Have You Applied The Filter As Suggested Above ? How Long Did You Monitored ?


----------



## hazzarduk1 (Aug 2, 2003)

i let it run through once crash, so i guess 10 seconds at most. although it is possible i messed up on the filter options


----------



## devil_himself (Apr 7, 2007)

Here Are Tee Correct Steps To Apply The Filter

Open Process Monitor > Press Ctrl + E To Stop The Monitoring > Filter > Filter ..

Under *Display Entries Matching These Conditions*

*Process Name is Explorer.exe then Include*

Click Add And Then Click Ok

Press Ctrl + X To Clear The Log

Start Monitoring Ctrl + E
Now Let Explorer.exe Crash ! {Everything Disappears }
Stop Monitoring
Save the results to a file -> File -> Save ->In the "Events to save", select "Events displayed using current filter". And save it in PML format.


----------



## hazzarduk1 (Aug 2, 2003)

did exactly what you said, the logfile is 16mb this time, i was capturing data for 16seconds. it was one full crash / reload.


----------



## devil_himself (Apr 7, 2007)

But I'm still Not Able To Download The Log File From The Given Link .. 

Can You Upload Somewhere Else Like Rapidshare or Mediafire !


----------



## hazzarduk1 (Aug 2, 2003)

sorry about the slow reply, was called away. just uploaded via rapidshare here http://rapidshare.com/files/109046392/logfilezip.zip.html


----------



## devil_himself (Apr 7, 2007)

Ok .. Now I Have The Log Downloaded

Looking At It I Found That Explorer Is Constantly Writing To A File --> *UDJmnUtv.ini2* Located At *C:\WINDOWS\system32* .. Do You Know What It Is

Verify What These Two Items Belong To , What Is There Is Size 
*C:\WINDOWS\system32\vtUnmJDU.dll
C:\WINDOWS\system32\UDJmnUtv.ini2*


----------



## hazzarduk1 (Aug 2, 2003)

due to explorer constantly crashing im unable to navigate to the files, is there a diferent way to find out about them?


----------



## devil_himself (Apr 7, 2007)

Greetings hazzarduk1 

Boot Into Safe Mode And Then Try !


----------



## hazzarduk1 (Aug 2, 2003)

safe mode reloads too so unable to access the file from there either. I am able to access it through Command Prompt, not sure if that is any use though


----------



## devil_himself (Apr 7, 2007)

Open Task Manager > File > New Task > Navigate To Location .... !


----------



## hazzarduk1 (Aug 2, 2003)

ah that worked. I have no idea what they belong to unfortunately

UDJmnUtv.ini2 = 283kb(was a hidden file)
vtUnmJDU.dll = 269kb


----------



## devil_himself (Apr 7, 2007)

You Can Right Click On File > Properties > Summary Or Version Tab To Get Some Info


----------



## hazzarduk1 (Aug 2, 2003)

all the fields were empty, no imformation unfortunately


----------



## devil_himself (Apr 7, 2007)

hmm... Seems To Be A Bad File .. Go Ahead And Delete Them .. We Need To Move This Thread To Malware Forum ... But First Lets See If Deleting Those File Stops The Crashes !


----------



## hazzarduk1 (Aug 2, 2003)

Tried deleting both files, the UDJmnUtv.ini2 deleted fine, vtUnmJDU.dll wont delete due to still being in use.

to MediaArts1 It isnt solved yet, explorer is still reloading. Thanks for your reply, everything is worth a try at the moment so i realy do appreciate it.


----------



## devil_himself (Apr 7, 2007)

Download Process Explorer 
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Unzip And Run 
Double Click On Explorer.exe To Go To Properties .. Thread Tab .. Do You See "vtUnmJDU.dll" In There ?


----------



## hazzarduk1 (Aug 2, 2003)

no i cant find it there sorry


----------



## devil_himself (Apr 7, 2007)

Go To Find{Ctrl + f} And Search For "vtUnmJDU.dll" ..!


----------



## hazzarduk1 (Aug 2, 2003)

nope it isnt on the list from the search either, although the file is no longer running and i was able to delete it. Still reloading though


----------



## cybertech (Apr 16, 2002)

Download *OTScanIt.exe *to your Desktop and double-click on it to extract the files. It will create a folder named *OTScanIt* on your desktop.

Close any open browsers.
If your Real protection or Antivirus intervenes with OTScanIt, allow it to run.
Open the *OTScanit* folder and double-click on *OTScanit.exe* to start the program.
Now click the *Run Scan *button on the toolbar.
The program will be scanning huge amounts of data so depending on your system it could take a long time to complete. Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Save that notepad file

Please post the resulting log here as an attachment.


Click on the orange *Post a Reply!* button 
scroll down to Manage Attachments 
Click in the box that says Upload File from your Computer
Click the Browse... button and find the file then click open
Click the Upload button
Wait until you see *Current Attachment *and your file name
Click on Close this window
Then submit the reply.


----------



## hazzarduk1 (Aug 2, 2003)

here is the log you asked for Cybertech


----------



## cybertech (Apr 16, 2002)

Please visit *this webpage* for instructions on installing recovery console and downloading/running ComboFix.

Post the log from ComboFix along with a new HijackThis log.


----------

