Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Residual Antivirus Xp 2008 Malwares...?


  • Please log in to reply
2 replies to this topic

#1 petunia2323

petunia2323

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:11:46 AM

Posted 30 September 2008 - 09:11 PM

Hi there...
I actually have a few issues with my computer related to Antivirus XP 2008 (some I know are related...others are iffy). So here goes:

2 days ago, I got the AntiXP 2008 (e.g. Spyware background, random .exe's and .dll's containing the letters phc, etc ), so I googled for manual removal of the virus and got rid of the annoying wallpaper as well as the registry keys.

Then, yesterday, I turn on my computer and find out my internet's really slow and every time I do a Google search, when I click on a certain page, it redirects me to random pages (e.g. http://www.everydayhealth.com/depression). So I discover this forum and proceed to download Malwarebytes and did a full scan in Normal mode. Followed the directions and removed all the ones that were checked. Yadda yadda yadda.

Reboot. Still has browser issues. Then I read that it's better to run it in Safe Mode. So I go to reboot, press F8 and BLAM! I have a BSOD that says "video driver failed to Initialize"....Stop code: 0xB4. So I try rebooting again and yet again, it wouldn't go into Safe Mode! The weird thing is that I was able to go to Safe Mode 2 days ago when I first got the AntiXP =/. AND I also didn't install / manipulate any video drivers in the last two days. What's happening before the BSOD is that a bunch of drivers are listed as it's loaded & then it gets stuck on mup.sys .

So, now I'm stuck. I have a malware, and to remove it, I need to run in Safe Mode....only I can't get to Safe Mode at all! Are these two things related? I REALLY hope I don't have to reformat!! I'd like ANY help possible with this! Thanks!

I've listed my MBAM log below (I actually ran it two times because i didn't finish the first scan):

Malwarebytes' Anti-Malware 1.28
Database version: 1222
Windows 5.1.2600

9/30/2008 6:35:05 AM
mbam-log-2008-09-30 (06-35-05).txt

Scan type: Full Scan (C:\|)
Objects scanned: 179046
Time elapsed: 1 hour(s), 19 minute(s), 16 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 1
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 12

Memory Processes Infected:
C:\WINDOWS\SYSTEM32\DRIVERS\svchost.exe (Heuristics.Reserved.Word.Exploit) -> Failed to unload process.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\ -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\ -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\SYSTEM32\DRIVERS\svchost.exe (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\b.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\ (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\DRIVERS\ (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\cmd.com (Worm.Alcra) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\netstat.com (Worm.Alcra) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\ping.com (Worm.Alcra) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\regedit.com (Worm.Alcra) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\tasklist.com (Worm.Alcra) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\tracert.com (Worm.Alcra) -> Quarantined and deleted successfully.
C:\Documents and Settings\Penny\Cookies\MM2048.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Penny\Cookies\MM256.DAT (Trojan.Agent) -> Quarantined and deleted successfully.


===============================================================================================================

Malwarebytes' Anti-Malware 1.28
Database version: 1222
Windows 5.1.2600

9/30/2008 12:47:07 AM
mbam-log-2008-09-30 (00-47-07).txt

Scan type: Full Scan (C:\|)
Objects scanned: 44570
Time elapsed: 27 minute(s), 35 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{549b5ca7-4a86-11d7-a4df-000874180bb3} (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

BC AdBot (Login to Remove)

 


#2 ctshenderson

ctshenderson

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:07:46 AM

Posted 03 October 2008 - 08:29 PM

Hi petunia,

I found your post when looking for a solution to the same problem. I managed to fix it....

You need to either boot your computer with a boot CD such as Bart PE, or slave your hard disk drive to another PC so you can access the files on the drive.

In the Windows\System32 and Windows\System32\Drivers folders there are some files starting with tdss - you need to either delete or rename all of these. To be on the safe side you could search the entire drive for tdss*.* and rename anything found (make sure you set to search in hidden folders also). Once done, you PC should now restart correctly. I would suggest that you rerun MalwareBytes and Spybot until both report no problems.

I had 2 PCs on my bench with this issue today, and both cured by removing the tdss*.* files.

Good luck.

Mark
Computer Troubleshooters Henderson
Waitakere City
New Zealand.

Edited by ctshenderson, 03 October 2008 - 08:30 PM.


#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,267 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:46 PM

Posted 03 October 2008 - 09:46 PM

If you do a Google search on mup.sys hangs in safe mode, you will find thousands of similar reports about this issue with various causes and possible solutions. What works for one person may not work for another.

There are several suggestions in discussion threads here and here.

Also read "How to fix an XP\Win 2000 System that freezes after loading mup.sys while booting".
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users