Major problems via Malwarebytes

14 years ago

I'm running Win2K on an older 900 MH machine with an AMD processor. It was custom built for me about 8 years ago. I'm fully aware I'm living with a dinosaur.

Anyway, I was in this Forum earlier today looking for comments on which machine I should consider buying.

As a by-product of this search I read several threads about speeding up an older machine. And, I took one

to heart and up-dated and then ran Malwarebytes.

It found 14 items, 12 instances of "Trojan.DNS Changer" and two "Trojan Agents."

I made a log and then proceeded to delete them. And, I made sure I had a copy of the log in a folder where

I knew where to find it if and when needed.

Then I was asked to restart the computer. On restarting, I receive a blue screen message as follows:

STOP 0x000000CE (0x00000000, 0xED2A2EFC, 0x00000000 DRIVER_UNLOADED_WITHOUT_CANCELING_PENDING_OPERATIONS

This driver maybe at fault viaagpl.sys.

***Address ED2A2EFC base at ED2A0000, DateStamp 00000000- viaagpl.sys

***Address ED2A2EFC base at ED2A0000, DateStamp 00000000- viaagpl.sys

(Note: the above line was repeated)

Then it went on to say make sure new hardware or software is properly installed. If problems continue,

disable or remove any newly installed hardware or software.

Then to disable BIOS memory options such as caching or shadowing.

Use Safe Mode to remove to remove or disable components, restart your computer, press F8 to select Advanced

Start Up Options and then start in Safe Mode.

End of Blue Screen comments.

When I attempted to start in Safe Mode, at first I received a display of drivers including this viaagpl.sys.

Then, it automatically went back to the Blue Screen with the same message.

In other words, I can not get the machine to boot. And, needless to say, I don't have a clue as to where

to begin. Any suggestions to remedy this situation would be greatly appreciated. If possible I need to get

this machine back up as I'm on limited income and was considering a new machine via the Social Security

distributions of $250 each that my wife and I are scheduled to receive. But, in the meantime need this machine.

Currently, I'm using my wife's machine.

Thanks in advance.

Tom

Sort by:Oldest

Comments (15)

marooma
14 years ago
last modified: 9 years ago
Tom,

On the same screen you get when you tap the f8 key to safe mode there should also be a selection to restart to an earlier configuration (or something like that).
That should return your computer to the last "stable" state before you made the changes with malwarebytes.

Terry
samtom_gw
Original Author
14 years ago
last modified: 9 years ago
Hi Terry,

That did the trick. I should have noticed that, but at the time I was panic stricken. I've had a PC since 1983 and never had to resort to that previously. They say, there's a first time for everything.

What do you supposed happened?

Also, does that restore the Trojans, also? I'll check that shortly.

Many thanks for a quick fix for what I envisioned was a major diaster.

Best Wishes,

Tom
Related Discussions
Trojan Virus - Causing Major Problems
Q
Comments (2)
After following owbist advice, you will need to go a Malware removal forum below are 2 we recommend it would be in you best interest to follow up on this ASAP. Post a hijackthis log at one of the chosen forums an seek expert advice. http://www.help2go.com/forum/spyware-help/ http://www.landzdown.com/index.php
...See More
Malwarebytes
Q
Comments (3)
Google MBAM Error 732 unable to update. It's a connection issue, usually seen on dial up or slower connections. Power cycle the router if you use one. How are you connected? I do not think this is Malware related. I had this problem. On my Net Zero I could not up-date Malwarebytes. Here is a link that might be useful: Error codes for MBAM.
...See More
Layout Advice Sought - Major Reno Floor Plan
Q
Comments (19)
rhome410 - thanks for the suggestion around flipping the fridge / pantry area. I had considered it early in the process, but we were hoping to avoid in order to prevent changes to the dining room (wallpaper and paneled.) However, as you will see below I created an updated floorplan and included your suggestion. I think it helps with the overall functionality of the space. We considered the full range over the rangetop / wall ovens. We really like to idea of an oven that is up off the floor for both easy access and distance from small children. Also, the fact that the oven + rangetop combo is actually significantly cheaper is a factor. On the other hand, the full range makes the floor plan easier to arrange, provides ventilation for the ovens and also has the benefit of providing an excellent "centerpiece" to the kitchen appearance. I'd say we're undecided at this point. Do you think I have the right pro/con list? kaismom - thanks for the thoughtful feedback you've given on the overall flow and interaction of the spaces we're designing. I completely agree that this is one of the most important aspects of the design process and is also one of the hardest to figure out since it can be difficult to visualize. Let me give you a few more facts that I haven't already provided. First, we live in the Boston area (not VA). The funny thing is that we used to live in VA - up until about five years ago - so I know what you are talking about! Given the combination of relatively few truely hot days and the fact that our backyard has mostly indirect light except for in the early morning, we aren't to concerned about to much light heating up the house. The back wall of the kitchen that faces the backyard does face southwest, so I'd expect great morning light and then indirect light as the day goes on. Second, your suggestion about casual family dining is an excellent point. We were thinking that the island would be the center of family life in the evenings (homework, dinner prep, dining, clean-up.) You will see below that I've created a revised floorplan and added a placeholder for a table to the plan. My thinking right now is that we wouldn't add the table - but it gives us the option. You make some excellent points about how as the kids grow older, all being seated facing each other might be a valuable habit - I'll keep them in mind. Third, you suggested I consider how we interact with the house / yard today. I'd say 90-95% of our entrance / egress from the house happens via the garage. This is in spite of the fact that we have three other entrances (including two in the backyard.) Now that you've suggested I give this careful considering - I don't expect this to change much - so this is probably the most important entrance to get right. The second priority would be the backyard, as the kids get older I envision more time (especially on the weekends) being spent playing in the backyard. In fact, this consideration is why we are having so much consternation about giving up the side view. While not having direct access to the mudroom from the backyard isn't ideal, I'm not sure we can have both the side view and this access. Adding a door from the backyard into the garage or coming through the kitchen wall adjacent to the garage won't work because there is a bulkhead access to the basement in that corner that cannot move. That's unfortunate since this would have been an excellent solution - thanks for the suggestion! palimpsest - you asked about the right front room. It is currently a room that gets little use. We'd like to eventually turn this into a library / study of sorts since the idea of a formal living room doesn't appeal. Adding the powder room of the central hall would reduce the room dimensions from 17x18 to 13x18 - I was thinking this was still adequate space for the use we envision. Perhaps a little more of a rectangle than would be ideal, but still a space we could make work. What do you think? bmorepanic - Excellent point about the double french doors. The more my wife and I think about it, the fact that they swing creates space problems and also makes it difficult to have screens on the doors. I don't see that much opportunity to have both of these doors wide open with no screens as it's either darn cold or there are to many bugs around. Given this, we're leaning more towards a sliding door. The fact that it isn't centered on the hallway isn't all that big of a deal to me, but I'll keep an eye on it when I can get some renderings and make sure it doesn't look strange. I'm still thinking about the idea of moving the fridge to the wall adjacent to the garage. Biggest concern about this is that it moves it farther away from the family room and backyard entrance. Maybe this reduces the convenience factor? However, it does create some benefits around allowing open counter space across the whole backyard wall and what feels like a more convenient work layout. I'll keep this in mind. If you get a chance, take a look at the layout I'll provide below and let me know what you think. sundownr - it's great to hear the dimensions of your space and that you find it functions well. Very encouraging that we will eventually find a solution that will work for my family. Also great to hear you eat at the island and enjoy it - this is what we envision today. Also, the photos are helpful - thank you for providing them. As you mention, I see you went with the full range which solves the wall oven problem. We like the idea of wall ovens for their convenience and also like the ideas of deep drawers under the cooktop for pots and pans, but both the convenient floorplan as well as the asthetics of the full range certainly appeal. We're still undecided there. New Revised Floorplan: I've incorporated some of the suggestions everyone has provided in this update. Still isn't perfect, but I'd be interested to see what people think. Thanks again for all the helpful suggestions!
...See More
Water damage via exterior brick wall?
Q
Comments (5)
Brick gets wet, it is your siding. There is also a space behind for potential water infiltrates to travel down to the base where weep holes are. Now to make the brick look nice it simply needs cleaned then sealed to keep it clean longer. Brushing the problem spots appears to be the best way to clean it. Looks like you would need some major scaffolding otherwise I guess it would be do-able with a ladder, extension tools, and safety gear. http://www.pressurewashersdirect.com/stories/187-How-to-Power-Wash-a-Brick-House.html If there is a problem with above the windows this is a nice picture of how it should be done. The orange part isnt labeled but that would be your L-shaped steel lintel. Also your sills are better off being one continuous piece instead of a bunch of different bricks. If you dont change those out you need to seal up all of those separate bricks well with premium exterior clear caulking.
...See More
ravencajun Zone 8b TX
14 years ago
last modified: 9 years ago
Tom if you do still show the trojans you would be better off going to this support forum where they can lead you step by step on how to get cleaned up, trojan agent can be hard to deal with. Just go to the forum and register then go to this hijackthis area and start a thread, if you would please add a link back to this thread so the team knows what has happened thus far, the team will get to you as soon as possible, and be sure to let them know your Operating system.
HijackThis Logs
if you can find that log please also post that in your thread.
R-C
marooma
14 years ago
last modified: 9 years ago
Tom,

Basically, you restored the Windows Registry to an earlier time when the system was operating correctly. The trojans themselves are still on your harddrive but only the registry entries "pointing to" them are gone.

I did some Googling and it appears that viaagpl.sys has something to do with either a video or chipset driver for a Via chipset or onboard video. Updating your motherboard drivers may take care of that problem. Why it popped up after running Malwarebytes is unknown.

Heed Ravencajun's post to ensure that you return your system to a clean state.

The only suggestion I have is to get the Firefox browser and use it for all browsing except when going to trusted sites. In the long run, your system will be more secure and you will have less of a hassle when browsing the internet. Internet Explorer uses active-x which allows malware to be installed.

Terry
samtom_gw
Original Author
14 years ago
last modified: 9 years ago
Hi Ravencajun and Terry,

After I sent my prior post at 01:13, I ran another Malwarebytes scan which came up clean. But, you're saying those critters are still hiding in there somewhere. OK, I go to
HijackThis Logs as I don't need excess baggage.

As to using IE, I use it rather infrequently, primarily to see how something I've done on one of our sites looks in IE.

I've been a FireFox proponent ever since FireFox 1.0. However, each new edition has expanded and consequently slows this ole box down even more. Remember, this is an 8 year old machine with 256 mb of RAM. So, I've gone to Opera in self-defense because of its using less resources, etc.

Again, many thanks for all you help.

And, a Happy Mother's Day to all,

Tom
marooma
14 years ago
last modified: 9 years ago
Tom,

Maybe I was premature in my assumption that the malware files were still on your computer. Malwarebytes probably removed them, but along the way it may have removed something else that was critical to the operation of your computer.

I have also been using Firefox since the beginning. Presently, I still use Firefox 2.0 as I have a triple-boot system (Windows 98SE, Windows 2000, Windows XP) so I like to keep all my OS's standardized. And all Firefox versions have an encrypted cache that cannot be accessed by anything other than Firefox. Even on a bad day, Firefox 2 is still more secure than Internet Explorer of any flavor due to it's lack of active-x.

I don't even use an active antivirus as I use a small, freeware program that protects the Windows Registry from being written to by malware.
The only protection I have is a firewall, Firefox, and a registry protector and have never had any problems with spyware/adware/malware/trojans or viruses on any of my three Operating Systems.

Terry
samtom_gw
Original Author
14 years ago
last modified: 9 years ago
Pardon my delay in getting back with you all. After getting a clean bill of health from Malwarebytes from my scan after cleaning up the prior mess, and getting Terry's most recent message, I have not done a HiJack This Log.

Maybe, I'm lazy but do you all feel it still should be done?

Again, many thanks for all fo your input.

Tom
zep516
14 years ago
last modified: 9 years ago
Feel free to post here I'll look at it and we can also run an online scan,

Click Here to download HJTInstall.exe
Save HJTInstall.exe to your desktop.
Â Doubleclick on the HJTInstall.exe icon on your desktop.
Â By default it will install to C:\Program Files\Trend Micro\HijackThis .
Â Click on Install.
Â It will create a HijackThis icon on the desktop.
Â Once installed, it will launch Hijackthis.
Â Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Â Click on "Edit > Select All" then click on "Edit > Copy" and Paste the entire contents of the log (no attachments) into your next post.
DO NOT use the AnalyzeThis button, its findings are dangerous if misinterpreted.
DO NOT have Hijackthis fix anything yet. Most of what HJT lists will be harmless or even required by your Operating System, a spyware fighter will guide you.
samtom_gw
Original Author
14 years ago
last modified: 9 years ago
Here it is. I don't understand one iota of what's in this log file.

Thanks,

Tom

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:20:54 PM, on 5/14/2009
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Plextor2000\AFSSVC.EXE
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\CTSvcCDA.exe
C:\WINNT\System32\svchost.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\devldr32.exe
C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
C:\WINNT\system32\RUNDLL32.EXE
C:\WINNT\system32\LVCOMSX.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Qualcomm\Eudora\Eudora.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: HelperObject Class - (00C6482D-C502-44C8-8409-FCE54AD9C208) - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Yahoo! Companion BHO - (02478D38-C3F9-4efb-9B51-7695ECA05670) - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - (8E718888-423F-11D2-876E-00A0C9082467) - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - (EF99BD32-C1FB-11D2-892F-0090271D4F88) - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: SnagIt - (8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3) - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LVCOMSX] C:\WINNT\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: APC UPS Status.lnk = C:\Program Files\APC\APC PowerChute Personal Edition\Display.exe
O16 - DPF: (156BF4B7-AE3A-4365-BD88-95A75AF8F09D) (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
O16 - DPF: (17492023-C23A-453E-A040-C7C580BBF700) (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: (2BC66F54-93A8-11D3-BEB6-00105AA9B6AE) (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: (56762DEC-6B0D-4AB4-A8AD-989993B5D08B) (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: (644E432F-49D3-41A1-8DD5-E099162EEEC5) (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O18 - Protocol: skype4com - (FFC8B962-9B40-4DFF-9458-1830C7DD7F5D) - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL mizkjs.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: afssvc - Plextor Corp. - C:\Program Files\Plextor2000\AFSSVC.EXE
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTSvcCDA.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINNT\System32\HPHipm11.exe

--
End of file - 5854 bytes
zep516
14 years ago
last modified: 9 years ago
Looks good there is no Malware showing just 2 Items to fix.

Close all browser windows including this one only have hijackthis open DO A SYSTEM SCAN ONLY place a check mark in the following entries:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
This is harmless, but should be fixed.

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NvMcTray.dll,NvTaskbarInit

Nvidia system tray applet. Not necessary. Removing this entry will free up a small amount of system resources.

Now clicked FIXED CHECKED.

Reboot the computer.

Do a SYSTEM SCAN & SAFE A LOG FILE review the NEW log an those entries should be gone.

You have a clean machine there!!
zep516
14 years ago
last modified: 9 years ago
One thing I don't see is a Firewall program?
samtom_gw
Original Author
14 years ago
last modified: 9 years ago
Hi Zep,

Those items are now history. You mentioned a Firewall.

I'm behind a cable modem and a Linksys router, so do I need an additional firewall?

Thanks for all your advice.

Best Wishes,

Tom
zep516
14 years ago
last modified: 9 years ago
I would consider a software firewall not sure what to recommend lets see what others say in the mean time I'll look around there are several free ones available.
grandms
14 years ago
last modified: 9 years ago
It probably wouldn't hurt to also have a software firewall. I'm using a router with a firewall built in, but I also use a software firewall.

You may have to search for one that will work with Win 2K.
zep516
14 years ago
last modified: 9 years ago
Here is one that works with 2000, try it out outpost.

Major problems via Malwarebytes

Comments (15)

marooma

samtom_gw
Original Author

Related Discussions

ravencajun Zone 8b TX

marooma

samtom_gw
Original Author

marooma

samtom_gw
Original Author

zep516

samtom_gw
Original Author

zep516

zep516

samtom_gw
Original Author

zep516

grandms

zep516

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

Major problems via Malwarebytes

Comments (15)

samtom_gwOriginal Author

Related Discussions

samtom_gwOriginal Author

samtom_gwOriginal Author

samtom_gwOriginal Author

samtom_gwOriginal Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

samtom_gw
Original Author

samtom_gw
Original Author

samtom_gw
Original Author

samtom_gw
Original Author

samtom_gw
Original Author