Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Virus disables keyboard, suspect bios modified,


  • Please log in to reply
137 replies to this topic

#1 robomow

robomow

  • Members
  • 92 posts
  • OFFLINE
  •  
  • Local time:03:46 AM

Posted 29 October 2013 - 05:00 PM

Windows xp service pack 3

With easy partition software. 

Kaserpersky antivirus. 

There is very little software installed on this computer.

 

Ok so i have tried everything I now and the usual malewarebytes, consumer virus scanners do not work. This virus disables the keyboard, dvd drive, and cdrom drive, and modifies the MBR so you can not re-install windows. 

 

The original two hard drives have been removed from the machine yet the previous hard drive I kept on a shelf for safe keeping had now been infected as well. I am not sure how this is possible but non the less it is true. The only logical explanation I can come up with is the virus is hiding in the dvd or cdrom memory? Is this even possible? I also suspect that just maybe as soon as I attempt to connect to the internet it downloads back to my computer?

 

So here is what I have tried. 

 

Reflashed the bios. This works for about three boots and then the bios hangs and is very slow to load. 

 

Disconnected both the DVD and cd rom drives.

 

Attempted to plug in the internet and download Mcafee. The first time I was redirected. The second time the download slowed down until it basically stopped.

 

Downloaded Kaspersky from another machine and installed via usb drive. Took forever to install. Scanned immediately with zero results.

 

Downloaded the latest definitions "took forever" scanned on high setting zero results.

 

Tried hitman pro zero results.

 

Other symptems every time you connect to the internet everything crawls to a stop. Mouse freezes can't click buttons or click and wait. Windows constantly tells me my drivers are not signed for hard drives and cdrom drives and ask to stop the installation or continue anyway. 

 

My original goal was to get a clean hard drive running and then slave the other two to remove the infection.

 

The original two hard drives were setup to boot four different Windows xp sp3 operating systems. I booted the version of xp which had the CAD program I wanted to run. If that makes any sense.

 

Any help or suggestions you can provide would be greatly appreciated.

 

Thanks


Edited by robomow, 29 October 2013 - 05:01 PM.


BC AdBot (Login to Remove)

 


#2 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:09:46 AM

Posted 29 October 2013 - 05:04 PM

Have you considered that your CMOS Battery could be running low, and that it should be replaced.

I only state this, because the issues that you describe pertain to the BIOS losing changes and going back to possibly default settings.

#3 robomow

robomow
  • Topic Starter

  • Members
  • 92 posts
  • OFFLINE
  •  
  • Local time:03:46 AM

Posted 29 October 2013 - 06:16 PM

No but that is an excellent idea. I should have mentioned before but this is the second computer this virus has infected. The first one was my workstation at work. Same symptons. However I will replace the cmos battery. I should also mention I am 99% sure this virus was transferred via usb drive from my work pc to my home pc. I never intended to have to connect this machine to the internet again. The only reason it was connected is because I got this virus. Until now it has not seen the internet in two years.



#4 robomow

robomow
  • Topic Starter

  • Members
  • 92 posts
  • OFFLINE
  •  
  • Local time:03:46 AM

Posted 29 October 2013 - 08:56 PM

Ok changed the cmos battery for the moment the bios setting seem to be holding. Still have the slow response issues. Mouse doesn't move and freezes up cant click a button etc.



#5 robomow

robomow
  • Topic Starter

  • Members
  • 92 posts
  • OFFLINE
  •  
  • Local time:03:46 AM

Posted 30 October 2013 - 12:16 AM

Sorry guys I posted this in the wrong forum. I am new here :bubbles: Can someone move this to the maleware removal forum please. Or should I start a new topic????



#6 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:09:46 AM

Posted 30 October 2013 - 12:21 AM

Please download and install Speccy then go to File and Publish Snap Shot.  Post the resulting link here.

 

A slow mouse could be a number of things, and not necessarily related to a malware infection.



#7 robomow

robomow
  • Topic Starter

  • Members
  • 92 posts
  • OFFLINE
  •  
  • Local time:03:46 AM

Posted 30 October 2013 - 12:32 AM

Thanks for the reply Bleepin Madman! It is late here so it will be tomorrow before I get this done because I am currently backing up the drive just because I do not want to lose any work I have done so far. For the record the currently installed drive is not the one I am worried about the most it is the other two I have removed from the machine. I was hoping to get a clean drive working so I could install the other two as slaves (one at a time) and scan them from a clean drive. Do you think this approach might work?? Part of the reason for going to this extreme is because I lose control of the keyboard with the other drives installed. Sometimes I lose the keyboard even if I just trying to boot the machine and select safe mode. Sometimes the keyboard or keyboards just start blinking and beeping like mad. I hope that makes sense.



#8 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:09:46 AM

Posted 30 October 2013 - 05:29 AM

The loss of keyboard and mouse functions can be the result of a failing motherboard as well. Are your mouse and keyboard's PS/2 or USB?

#9 robomow

robomow
  • Topic Starter

  • Members
  • 92 posts
  • OFFLINE
  •  
  • Local time:03:46 AM

Posted 30 October 2013 - 08:42 AM

At this time both are PS/2.



#10 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:09:46 AM

Posted 30 October 2013 - 08:57 AM

If possible, I would like for you to purchase a USB Mouse and Keyboard.

#11 hamluis

hamluis

    Moderator


  • Moderator
  • 56,086 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:46 AM

Posted 30 October 2013 - 09:34 AM

Moved topic to Am I Infected forum, per OP request.

 

Louis



#12 robomow

robomow
  • Topic Starter

  • Members
  • 92 posts
  • OFFLINE
  •  
  • Local time:03:46 AM

Posted 30 October 2013 - 09:55 AM

I have a usb mouse and keyboard. Would like for me to plug them in and see if this corrects the problem??



#13 robomow

robomow
  • Topic Starter

  • Members
  • 92 posts
  • OFFLINE
  •  
  • Local time:03:46 AM

Posted 30 October 2013 - 05:55 PM

............

Edited by robomow, 30 October 2013 - 10:29 PM.


#14 robomow

robomow
  • Topic Starter

  • Members
  • 92 posts
  • OFFLINE
  •  
  • Local time:03:46 AM

Posted 30 October 2013 - 05:56 PM

...............
 


Edited by robomow, 30 October 2013 - 10:28 PM.


#15 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:09:46 AM

Posted 30 October 2013 - 07:23 PM

Can you please provide a link as instructed to do so in the tutorial for speccy?  It makes it much more easier to read.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users