Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Antivirus Xp 2008 - Disables Keyboard And Mouse


  • Please log in to reply
11 replies to this topic

#1 vjb911

vjb911

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Location:North East
  • Local time:12:18 AM

Posted 03 October 2008 - 08:41 AM

Long story short...
A friend asked for assistance with a BSD. The computer was infected with Antivirus XP 2008. I've followed all of the removal instructions listed on this site. The problem now is that when a user goes to >START > RUN the keyboard and mouse become disabled. This also happens when a user does CTRL-ALT-DEL. Any ideas before I do a format and reinstall XP?

BC AdBot (Login to Remove)

 


#2 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:12:18 AM

Posted 03 October 2008 - 12:58 PM

Post the last couple of malwarebyte's logs

What other programs did you run?
Chewy

No. Try not. Do... or do not. There is no try.

#3 vjb911

vjb911
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Location:North East
  • Local time:12:18 AM

Posted 03 October 2008 - 01:08 PM

I followed the instructions from http://www.bleepingcomputer.com/malware-re...tivirus-xp-2008.

I haven't run any other programs.

#4 Noypi_to_its

Noypi_to_its

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:12:18 PM

Posted 03 October 2008 - 01:15 PM

have you tried booting to safemode? If so, is your mouse and keyboard also disabled?

#5 vjb911

vjb911
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Location:North East
  • Local time:12:18 AM

Posted 03 October 2008 - 06:40 PM

I have been booting to safemode. Any action that would show the running processes disables the keyboard and mouse. Also, any attempt to run a command line and the keyboard and mouse are disabled.

#6 Noypi_to_its

Noypi_to_its

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:12:18 PM

Posted 03 October 2008 - 06:48 PM

you could use procexp.exe to look at the processes running - http://technet.microsoft.com/en-us/sysinte...s/bb896653.aspx... and instead of using the run command you could use command.com... if you are using winxp pro you can also get the list of processes running in your computer using the command tasklist and to kill a certain process use this taskkill /f /im PROCESSNAME - /f is to force the process to end and /im is to tell your os that you are typing the filename that you are killing or you could use /PID PROCESS# instead of /im PROCESSNAME.

Edited by Noypi_to_its, 03 October 2008 - 06:52 PM.


#7 buddy215

buddy215

  • BC Advisor
  • 13,001 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:11:18 PM

Posted 03 October 2008 - 07:01 PM

There is a SLIM chance that a "system restore" might work. If possible, use a "system restore" point before the malware got on the machine.
XP System Restore Guide:
http://www.bleepingcomputer.com/tutorials/windows-xp-system-restore-guide/

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#8 vjb911

vjb911
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Location:North East
  • Local time:12:18 AM

Posted 05 October 2008 - 05:35 PM

"There is a SLIM chance that a "system restore" might work. If possible, use a "system restore" point before the malware got on the machine.
XP System Restore Guide:"

I've tried to do a system restore. The only restore points are post infection.

#9 vjb911

vjb911
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Location:North East
  • Local time:12:18 AM

Posted 05 October 2008 - 05:37 PM

you could use procexp.exe to look at the processes running - http://technet.microsoft.com/en-us/sysinte...s/bb896653.aspx... and instead of using the run command you could use command.com... if you are using winxp pro you can also get the list of processes running in your computer using the command tasklist and to kill a certain process use this taskkill /f /im PROCESSNAME - /f is to force the process to end and /im is to tell your os that you are typing the filename that you are killing or you could use /PID PROCESS# instead of /im PROCESSNAME.


How do I run command.com?

#10 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:12:18 AM

Posted 05 October 2008 - 06:04 PM

I followed the instructions from http://www.bleepingcomputer.com/malware-re...tivirus-xp-2008.

I haven't run any other programs.



I asked for the MBAM logs 2 days ago

Are the mouse and keyboard usb or ps2?
Chewy

No. Try not. Do... or do not. There is no try.

#11 vjb911

vjb911
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Location:North East
  • Local time:12:18 AM

Posted 05 October 2008 - 06:15 PM

Access to the infected computer is limited...I'll get the logs as soon as I can access.

Both the mouse and keyboard are PS2.

#12 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:12:18 AM

Posted 05 October 2008 - 07:47 PM

Access to the infected computer is limited


that would be an issue
Chewy

No. Try not. Do... or do not. There is no try.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users