 Infected With Anti Virus Xp 2008 And Others, cannot scan computer, blue screen with error message 0x00000 |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.| Important Announcement: The winners of the BC Million Post contest have been announced. You can read who the winners are at this post. - BleepingComputer Management |
  |
  Jul 1 2008, 12:34 PM
Post
#1
|
|
|
New Member  Group: Members Posts: 6 Joined: 1-July 08 Member No.: 219,806  |
thanks for your help. This post has been edited by Lisa2000: Jul 1 2008, 12:40 PM |
 |
 
|
|
Jul 1 2008, 04:58 PM
Post
#2
|
|
 Bleepin' Cynic Group: BC Advisor Posts: 5,235 Joined: 11-November 06 Member No.: 94,959 |
Have you tried running the scans in Safe Mode?
-------------------- Stupidity has a knack of getting its way.
—Albert Camus |
|
|
|
|
Jul 1 2008, 05:10 PM
Post
#3
|
|
|
New Member Group: Members Posts: 7 Joined: 1-July 08 Member No.: 219,849 |
Try to run chkdsk on all drives. if it says to check the disk the next time the computer starts, click yes/ok.
A more descriptive blue screen information would be largely helpful. |
|
|
|
|
Jul 1 2008, 10:43 PM
Post
#4
|
|
|
New Member Group: Members Posts: 2 Joined: 1-July 08 Member No.: 219,903 |
As known, AntiVirus XP 2008 is not a real antivirus program, this is a malware. You can seach it on Internet and how to remove it on computer manual. For your reference, http://www.bleepingcomputer.com/malware-re...tivirus-xp-2008
One of our colleague is installed this malware and hard to remove it. Finally, his computer is still have a pop-up windows that will download malware / adware from outside web once you click their link. |
|
|
|
|
Jul 2 2008, 09:42 AM
Post
#5
|
|
|
New Member Group: Members Posts: 6 Joined: 1-July 08 Member No.: 219,806 |
i did run the scan in safe mode (several times), after a while when it start scanning thru system, the blue screen appears. here is some of the info: " TECHNICAL INFORMATION STOP: 0X0000008E ( 0X0000005, 0X81E8F731, 0XF8987C3C, 0X00000000) BEGINNING DUMP OF PHYSICAL MEMORY PHYSICAL MEMORY DUMP COMPLETE CONTACT YOUR SYSTEM ADMINISTRATOR" *ran chkdisk *remove antivirus xp2008 malware, manually *please note i have no internet connection and computer cannot find my network/server thanks for your help *I also ran hijack: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:07:27, on 7/2/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\basfipm.exe C:\Program Files\Canon\DIAS\CnxDIAS.exe C:\WINDOWS\CDProxyServ.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe c:\WINDOWS\system32\ZuneBusEnum.exe C:\WINDOWS\system32\userinit.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\userinit.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/def...//www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/def...//www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo! R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: (no name) - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - (no file) O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU) O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab O16 - DPF: {CE8267C2-D41A-4A50-A69D-F32B5C289F14} (FileOpenInstaller) - http://plugin.fileopen.com/current/FileOpen.CAB O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = davidjgold.com O17 - HKLM\Software\..\Telephony: DomainName = davidjgold.com O17 - HKLM\System\CCS\Services\Tcpip\..\{CA3887DB-D9F1-4E7E-BF4C-8DBB3AF527E5}: NameServer = 192.168.0.200,192.168.0.1 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = davidjgold.com O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Plug and Play Device Manager ($sys$DRMServer) - Unknown owner - C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe (file missing) O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe O23 - Service: Canon Driver Information Assist Service - CANON INC. - C:\Program Files\Canon\DIAS\CnxDIAS.exe O23 - Service: XCP CD Proxy (CD_Proxy) - Unknown owner - C:\WINDOWS\CDProxyServ.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 5147 bytes |
|
|
|
|
Jul 2 2008, 06:30 PM
Post
#6
|
|
 Computer Masochist Group: Moderator Posts: 8,511 Joined: 27-January 07 From: Cleveland, Ohio Member No.: 108,618 |
I have moved your Topic that includes a HijackThis log here to the Misplaced HJT Logs forum. You posted your log in a forum not intended for HijackThis logs analysis and probably missed the directions we provide to those who require assistance. We can only allow topics with such logs in the HijackThis Logs and Malware Removal forum. This restriction is to ensure you get the best help available, from those who specialize in malware anlaysis and removal. It also should prevent you from receiving ineffective or even potentially dangerous advice, whether well meaning or not.
Prior to posting a HJT log, we ask that you please read and follow all instructions in the pinned topic titled Preparation Guide For Use Before Posting A Hijackthis Log. Following the steps in this Guide will allow the HJT Team to quickly help you with specific fixes for what may remain on your system. Please complete all the steps in the Guide. If you have performed some of them already, then just continue with the next. There are instructions for downloading and running Deckard's System Scanner (DSS) which will create a hijackthis log for you, or automatically download and install the most current version of HijackThis if it's not already installed on your computer. Please note that it is important that Deckard's System Scanner be run and a log created while in normal mode. If you run it and create your log while in safe mode, you will be asked to redo it again properly. When you have completed those steps, start a new topic in the HijackThis Logs and Malware Removal forum as directed in the Guide to post a new log. Please DO NOT post any more logs to this topic, or post a log again in the wrong forum. The Misplaced HJT Logs forum is strictly a holding area where the BC Staff can assist you with preparations for and to properly post your log. If you have a question or encounter a problem in the Prep Guide, please do post back to this topic; that is what it is here for. When your new HJT log is posted in the proper forum, please reply to this topic with a link to your new topic. Once that is done, a Member of the HJT Team will analyze your log and assist you with step by step instructions to clean your computer or otherwise advise what needs to be done. Thanks for your cooperation and good luck. The BC Staff -------------------- Mark
 why won't my laptop work? Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around Avatar by Handplane |
|
|
|
|
Jul 7 2008, 09:46 AM
Post
#7
|
|
|
New Member Group: Members Posts: 6 Joined: 1-July 08 Member No.: 219,806 |
how am i going to fix it if you just moved my post, i cannot run a spyware program, virus is not allowing me to do anything and now i have to wait another week just because u moved my post. the only thing i can run is hijack and it's coming out w/nothing
|
|
|
|
|
Jul 7 2008, 11:40 AM
Post
#8
|
|
 Bleepin' Mod Group: Moderator Posts: 4,606 Joined: 18-March 06 From: B.C. Canada Member No.: 59,826 |
Hi Lisa2000,
We can only allow topics with HijackThis logs in the HijackThis Logs and Malware Removal forum. Using a healthy computer, load the programs from the Prep Guide, onto a USB Stick. Install them onto the infected computer. If you can't perform a step, then skip it and continue with the next. Please note that it is important that Deckard's System Scanner be run and a log created while in normal mode. When you have completed those steps, start a new topic in the HijackThis Logs and Malware Removal forum as directed in the Guide to post a new log. --------------------  Join Bleeping Computers Folding@home Team and Help find a cure. I am thankful for laughter, except when milk comes out of my nose. ~Woody Allen |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 23rd November 2008 - 08:09 AM |
© 2003-2008 All Rights Reserved Bleeping Computer LLC.