Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

No Mouse/Keyboard at login


  • Please log in to reply
9 replies to this topic

#1 alan93

alan93

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:05:17 PM

Posted 14 January 2012 - 09:43 AM

This happened after I ran combo fix to get rid of a BHO called whitesmoke.
It didn't get rid of it so I ran restore.
On boot after restore I get no mouse or keyboard and cannot login to my computer.
I disconnected USB mouse and tried PS1 mouse still doesn't work.
Safemode gets the same thing.

Edited by hamluis, 14 January 2012 - 03:28 PM.
Moved from XP to Am I Infected.


BC AdBot (Login to Remove)

 


#2 mark1956

mark1956

  • Security Colleague
  • 271 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Spain
  • Local time:11:17 PM

Posted 14 January 2012 - 11:02 AM

You should never use Combofix without the help of a Malware expert, it is not a tool for public use.

Sounds like your USB drivers have been disabled, although I am surprised the PS2 mouse did not function. Try removing the CMOS battery for 10 minutes, replace it and then reboot.

Do you have an XP disc?

What is the make and model of the PC?

#3 alan93

alan93
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:05:17 PM

Posted 14 January 2012 - 11:06 AM

amd athlon 1600
corsair ram
hitachi 1T HD
is the make of my pc

strange thing is , I was trying to run system restore again from recovery console but can't figure out when its at c:\windows
also safe mode with prompt takes me back to the login screen .
Regardless of combofix, why did the system restore not work?
I never had this happen on a system restore.
Will try battery method in a while.

#4 mark1956

mark1956

  • Security Colleague
  • 271 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Spain
  • Local time:11:17 PM

Posted 14 January 2012 - 11:22 AM

What are you seeing in the Recovery Console, the prompt will show C:\Windows if that is what it is logged into. Try this:


At the Command Prompt, type CD C:\ and press Enter, then type:

C:\windows\system32\restore\rstrui.exe and press Enter.

That should launch the Recovery Console.

Have you uninstalled Combofix? If you have it will automatically delete all previous restore points and create a new one.

You might have to run
XP Repair Install if all else fails.

#5 alan93

alan93
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:05:17 PM

Posted 14 January 2012 - 11:31 AM

What are you seeing in the Recovery Console, the prompt will show C:\Windows if that is what it is logged into. Try this:


At the Command Prompt, type CD C:\ and press Enter, then type:

C:\windows\system32\restore\rstrui.exe and press Enter.

That should launch the Recovery Console.

Have you uninstalled Combofix? If you have it will automatically delete all previous restore points and create a new one.

You might have to run
XP Repair Install if all else fails.



I didnt uninstall combofix after running it.

C:\windows\system32\restore\rstrui.exe and press Enter.
-> "The command is not recognized type help for a list of supported commands.

Why would combo fix NOT give me a message that said "YOUR SYSTEM RESTORE POINTS WILL BE TOTALLY OBLITERATED IF YOU CONTINUE" so that the ones you think you have you really don't and you will be stuck until you reinstall windows" ???

Edited by alan93, 14 January 2012 - 11:32 AM.


#6 mark1956

mark1956

  • Security Colleague
  • 271 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Spain
  • Local time:11:17 PM

Posted 14 January 2012 - 11:52 AM

Why would combo fix NOT give me a message that said "YOUR SYSTEM RESTORE POINTS WILL BE TOTALLY OBLITERATED IF YOU CONTINUE" so that the ones you think you have you really don't and you will be stuck until you reinstall windows" ???

The reason is that it should only be used by trained malware staff and they would all know that it would delete the restore points. That is something that is always done after Malware removal so any infections that will be saved in the restore points will be deleted.

As your system is pretty much disabled without use of the keyboard or mouse then I think a Repair Install will be the only way out of this.

I am not sure why the restore command I gave did not get recognised, I have used it many times when helping with complete success. Maybe there are more problems with your system files than just the mouse and keyboard not working. Using System Restore does not guarantee full removal of infections and that can also be said for a Repair Install. At least if you get the mouse and keyboard active you can then get the help you need to clean the machine if the infection is still present without having to do a format and clean install.

Edited by mark1956, 14 January 2012 - 11:55 AM.


#7 alan93

alan93
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:05:17 PM

Posted 14 January 2012 - 11:57 AM

fixed it.

It appears that Combofix raped my sytem files so I restored them using repair console
c:\windows\system32\config
and did a
ren from .bak on
system.bak
software.bak
sam.bak
security.bak
default.bak

#8 mark1956

mark1956

  • Security Colleague
  • 271 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Spain
  • Local time:11:17 PM

Posted 14 January 2012 - 12:01 PM

That is good news, now you just need to be on the look out for any infections. If you notice any peculiar behaviour or poor performance do not hesitate to open a new thread in the Malware forum.

#9 alan93

alan93
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:05:17 PM

Posted 14 January 2012 - 12:15 PM

That is good news, now you just need to be on the look out for any infections. If you notice any peculiar behaviour or poor performance do not hesitate to open a new thread in the Malware forum.


great thanks, well actually what led to all of this was me running a program before combo fix that was supposed to convert wma files to mp3 and when i did the install it gave options and i unchecked them but it still installed whitesmoke BHO on it.

And i still have it if i type in the url window of Chrome and get isearch.whitesmoke.com/?q

Should i start one for this?

Edited by alan93, 14 January 2012 - 12:15 PM.


#10 mark1956

mark1956

  • Security Colleague
  • 271 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Spain
  • Local time:11:17 PM

Posted 14 January 2012 - 03:55 PM

Yes, some expert help would be the best way to deal with this infection. Then you can be sure it is all cleaned out.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users