1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Other Nasty malware problem - am stumped!

Discussion in 'Tech Support' started by chris66, 7 Feb 2011.

  1. RichCreedy

    RichCreedy Hey What Who

    Joined:
    24 Apr 2009
    Posts:
    4,698
    Likes Received:
    172
    is he studying Life Art ? wink wink nudge nudge
     
  2. Glix

    Glix Left Thumb Stick in the mud.

    Joined:
    11 May 2010
    Posts:
    318
    Likes Received:
    1
    Recently had a pc do this to me at work, was easy enough to get rid of.
    It auto closes anything and everything that isn't explorer. So get Hijackthis on a USB stick and run it on the infected account (rename Hijackthis.exe to explorer.exe), you'll know it shouldn't be there when you see the random file name claiming to protect your windows, then sweep with antimalware bytes program.

    Not sure how the pc got infected, possibly picked it up due to the numerous holes in XP as it hardly gets any updates these days.

    Get a decent anti malware protection on there and he should be able to continue using that existing windows install.
     
  3. Nealieboyee

    Nealieboyee Packaging Master!

    Joined:
    14 Aug 2009
    Posts:
    3,826
    Likes Received:
    458
    15 years old you say?
    In situations like this, you pat him on the back, say "well done", and tell him to be more careful next time :D
     
  4. Chicken76

    Chicken76 Minimodder

    Joined:
    10 Nov 2009
    Posts:
    952
    Likes Received:
    32
    The reason why you can't press any key when prompted may be due to the fact that you haven't enabled USB keyboard support in BIOS. There may be a 'Legacy USB devices' option to enable too.
    The bluetooth keyboard must be connected to your PC through a USB-bluetooth adapter, so if a regular USB keyboard didn't work, there's no way the bluetooth one could.
    However, the PS/2 keyboard should work. The 'enable legacy HID ports' option is pretty rare, but if you spot it, enable it. Assuming the PS/2 keyboard is ok (might be a good idea to check it on another computer) then there's no other reason for it to not work unless the BIOS is infected or corrupted, hence my initial advice to reset it and reflash with a clean image downloaded on another computer.

    Also, have a look at the keyboard's PS/2 connector pins. See if one of them is bent, or ... still attached to the motherboard's PS/2 port. :D
     
  5. Guinevere

    Guinevere Mega Mom

    Joined:
    8 May 2010
    Posts:
    2,484
    Likes Received:
    176
    I'd say you've got two issues:

    1) The lad's doesn't know enough about PCs to keep them clean. So maybe it's time to sit down and give him the other chat about the facts of life?

    2) There's either a hardware or bios issue. I can't believe a bit of malware is blocking keyboard, so as said above it'll an issue with the PC not allowing it to boot from CD.

    Deal with 1) as a priority, or it'll only happen again and again.
     
  6. Glix

    Glix Left Thumb Stick in the mud.

    Joined:
    11 May 2010
    Posts:
    318
    Likes Received:
    1
    Lies, men never lie! :p
     
  7. Draksis

    Draksis What's a Dremel?

    Joined:
    21 Oct 2009
    Posts:
    1,235
    Likes Received:
    50
    Wow, it's amazing how many people don't read the thread at all, and just slam down their 'end-all-troubles' solution.

    The solution is easy - have you tried using other keyboards? :p j/k

    seriously, anything that stop system functionality before windows starts booting, is sitting in the BIOS. flash it and go from there.

    Quick question though: If you enter windows, and hammer the caps lock key - does the light not come on at all? or does it flicker, but only after waiting for 2 or 3 minutes?
     
  8. adidan

    adidan Guesswork is still work

    Joined:
    25 Mar 2009
    Posts:
    19,804
    Likes Received:
    5,591
    That would be unusual but by no means impossible. Flashing would resolve that or at least identify whether that is or is not the problem which, in itself, get you closer to solving the problem.

    Although it doesn't seem to boot from CD you may have more joy trying to boot from a flash drive or floppy. Maybe.

    Mind you like as been said before, connecting the HDD via USB on a working PC and scanning it over would be the first option.

    As for looking on 'art websites'. Good lad :D

    My brother's GF's son borked up his laptop in a similar way and it seemed actually telling all and sundry how he borked it up was a good behaviour modifier. :D
     
  9. chrismarkham1982

    chrismarkham1982 Multimodder

    Joined:
    1 Apr 2010
    Posts:
    1,835
    Likes Received:
    259
    art websites @ 15? never would of done that when i was 15 :worried:

    in all seriousness as someon has stated above its best in this situation, if nothing is working to just take the hdd out and put it on another pc and scan it, easiest way around it without losing anything especially if you cant into to windows to schedule a boot time scan.
     
  10. Glix

    Glix Left Thumb Stick in the mud.

    Joined:
    11 May 2010
    Posts:
    318
    Likes Received:
    1
    He stated in the OP, that Keyboard doesn't work between bios and Windows boot. What would be the point in disabling the keyboard if they are trying to blackmail him into buying the fake anti virus?
     
  11. chris66

    chris66 Minimodder

    Joined:
    10 Jan 2011
    Posts:
    272
    Likes Received:
    5
    OK, I haven't looked at the PC again, as yet - as I said, I am gonna let him stew without his PC for another few days.

    I don't think there is nothing wrong with the keyboard, as I wrote, I have tried three different keyboards, all with different connections. The keyboard will allow me to enter the BIOS. where I changed the boot order. It also works when the OS loads. However, it doesn't work in-between finishing Post and just before Windows loads (This is the time when I should be able to press F8, to allow me choose whether or not I want to boot into safe mode) Also, when the command "Press any key to boot from CD" appears, I press any key (on all three keyboards), and there is no response.

    So, whether there is a strange fault on the motherboard, which seems to disable the keyboard functions for a short (but crucial) time, or it's this new strain of malware. I don't know - as I say, it has me stumped.

    This is the problem.
     
    Last edited: 8 Feb 2011
  12. adam_bagpuss

    adam_bagpuss Have you tried turning it off/on ?

    Joined:
    24 Apr 2009
    Posts:
    4,282
    Likes Received:
    159
    have you reset the bios yet by removing the battery ?
     
  13. chris66

    chris66 Minimodder

    Joined:
    10 Jan 2011
    Posts:
    272
    Likes Received:
    5
    Not yet, may try that later if I have time. The PC is over three years old - Gigabyte P45 mobo, Intel E 6750 CPU, 2GB DDR2 RAM, 8800GTX and 2x500GB hard drives. I have a spare (and unopened) EVGA P45 mobo, so if all else fails, I can change that.
     
  14. adidan

    adidan Guesswork is still work

    Joined:
    25 Mar 2009
    Posts:
    19,804
    Likes Received:
    5,591
    With an older motherboard I had a few glitchy things happen and replacing the CMOS battery solved it.

    Mind you I think we've all had random weird things happen that get solved in a number of ways, from a battery, to a HDD format to just staring at it long enough until it decides it'll work. :D

    Let us know how it goes.
     
  15. IvanIvanovich

    IvanIvanovich будет глотать вашу душу.

    Joined:
    31 Aug 2008
    Posts:
    4,870
    Likes Received:
    252
    yeah i've seen this particular variant before it is pretty difficult to remove. its a multi headed virus that inserts code into the boot sector to prevent you from entering safe mode. its actually kind of clever, and is designed to hold the pc hostage in effect. to get rid of it grab a copy of ultimate boot cd. first try the av, it might be able to deal with it. if not it may be possible to get rid of the boot sector virus part by replacing the mbr / boot record with the tools available on ubcd. once you get that sorted you should be able to boot safe mode, install a good av program and hopefully remove the rest of it. if that fails, use the back up utilites to try and get anything they may want off, then run dban.

    as others have already pointed out, it is EXTREMELY unlikely to be a hardware related issue, so swaping the mobo will do absolutely nothing to help you fix this issue. once you plug that disk in, it will be back to the same thing.
     
    Last edited: 8 Feb 2011
  16. vsmora

    vsmora What's a Dremel?

    Joined:
    6 Feb 2011
    Posts:
    8
    Likes Received:
    2
    Since the PC is saying "Press any key to boot from CD" with XP CD inserted means that it is successfully reading from CD and attempting to boot from there as that message is embedded in the disc. Either use a different Live CD that inherently doesn't need a key press to boot, or make a modified copy of your XP CD (remove bootfix.bin) to achieve the same. Once fully booted from CD then hopefully KB/mouse input will be restored like when you boot the infected OS. You can then use whatever anti-malware/registry/files-system tools you wish to resurrect it.
     
  17. Lankuzo

    Lankuzo CPC Refugee

    Joined:
    23 Apr 2009
    Posts:
    906
    Likes Received:
    24
    Your keyboard works in windows. Why can't you just load xp disk inside windows?

    I'm only use to vista and windows 7 so I don't know if xp allows you to install while actually in windows
     
  18. adam_bagpuss

    adam_bagpuss Have you tried turning it off/on ?

    Joined:
    24 Apr 2009
    Posts:
    4,282
    Likes Received:
    159
    you cant install xp, vista or windows 7 while in windows.
     
  19. Ringo1

    Ringo1 What's a Dremel?

    Joined:
    11 Feb 2011
    Posts:
    20
    Likes Received:
    0
    There shouldn't be any easy way for a piece of malware to disable the keyboard just after the POST. If you're getting the "Press any key to boot from CD" message then your machine is *probably* reading the CD correctly and then checking the hard drives for boot sectors. Since it's found bootable partitions it gives you this message. If it finds none then it would boot straight into the CD without asking you to press a key.

    Unplug all the hard drives. If the machine boots straight from CD then there might be something in the boot sector of one of your hard drives which is breaking the CD's bootloader (buffer overflow?) and stopping it from interpreting your key-presses. Try plugging hard drives back in one at a time.

    If the machine doesn't boot straight into Windows setup with no hard drives connected then the machine may be having trouble with the disc itself. Try making a new boot CD (memtest, Hitachi DFT or something else) and see if that works. Maybe you just need an un-scratched disc or different CD-Rom drive. I've even had problems booting from some types of CD and not others when using Blu-ray writers.
     
  20. Lankuzo

    Lankuzo CPC Refugee

    Joined:
    23 Apr 2009
    Posts:
    906
    Likes Received:
    24
    That's news to me. I just reinstalled windows 7 using that method. Well not exactly in OS the whole process. If you load the disk in windows it comes up with Instal windows 7. Click stand it'll take you to there disclaimer and rubbish. After you accept it asks you to pick a drive. Select which one you want to Instal on and then it reboots and goes straight into formatting and installing the OS doesn't it. Or am I just going crazy. Haven't had much sleep recently so could be.
     

Share This Page