FBI virus - cannot even start in safe mode!

[jmm157]

I have a PC with Windows XP which has the FBI virus. When I start in regular mode, I just get the screen with the fake info. When I try in safe mode, I get to the login screen ok. I select Administrator and after a wait, I see this error message: Svchost.exe - Application Error. "The instruction at "0x1000180c" referenced memory at "0x00000000". The memory could not be "read".

I reseated the memory to verify that was not the problem. The same error occurred afterwards.

Could you tell me what I can do to remove this problem?

[Psychotic]

Hi there,
my name is Marius and I will assist you with your malware related problems.

Before we move on, please read the following points carefully.

• First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
• Perform everything in the correct order. Sometimes one step requires the previous one.
• If you have any problems while following my instructions, Stop there and tell me the exact nature of your problem.
• Do not run any other scans without instruction or add/remove software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
• Post all logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
• Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
• My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

 
 
 
 
Scan with FRST (using UBCD4Win)

We need to try and boot your computer using the Ultimate Boot CD for Windows (UBCD4win)

Please print this guide for future reference!

You will need: a blank CD, a Windows XP CD, a clean computer, and a flash drive.

Please follow the steps below and let me know if you were successful. If you were unable to create the UBCD4win, please tell me what error messages you got and/or what steps you got hung up on.

Step 1 - creating the ISO file

1. Please select a mirror and download the Ultimate Boot CD for Windows to your Desktop

• Double-Click on the UBCD4Win.exe that you just downloaded to your desktop.
• Follow all of the instructions/prompts that come up
• Note: Do not install to a folder with spaces in it's name, it is best to use the default C:\UBCD4Win
• Note: Your Anti-Virus may report viruses or trojans when you extract UBCD4Win, these are "False-Positives." Read here for information regarding the files that normally trigger AV software.
• At the very end, uncheck "Run UBCD4WinBuilder.exe when installation is complete", then click Finish
  

2. Insert your XP CD with SP1/SP2/SP3 into a CD Rom drive

• Open My Computer, navigate to: C:\ubcd4win
• Double-click on UBCD4WinBuilder.exe
• Click I Agree to the UBCD4Win PE Builder License
• Click No when prompted to Search for Windows installation files
• For Source: click on the ellipsis (...), then click on the drive with your Windows XP CD, then press Ok
• For Custom: no information is necessary, leave blank
• For Output: keep the default BartPE
• For Media output select Create ISO image: (enter filename)
  Note: you can leave the default file name and path as well (C:\UBCD4Win\UBCD4WinBuilder.iso), but if you do change it make sure it is a folder without spaces in the name
• Note: If your XP install disc is SP1 then please click the Plugins button and modify the following options:
  

  Click on each option, then click Enable/Disable so the correct value is displayed.
  
  Disabled - !Critical: DComLaunch Service [building with XP SP1-DISABLE]
  Enabled - !Critical: LargeIDE Fix (KB331958) [building with XP SP1-ENABLE]
  

• Note: If you have a Dell XP install disc you will need to follow the instructions here: http://www.ubcd4win.com/faq.htm#dell
  

3. Click on the "Build" button

• You will see the Windows EULA message. Click on I Agree
• You will now see the Build Screen. Let it run its course
• When the Build is finished you can click close, then exit
  

4. Burn your ISO file to CD

• Please see this information from UBCD4WIN on how to burn an ISO to CD.
  

==========

Step 2 - downloading Farbar's Recovery Scan Tool (FRST)

Next, from your clean computer, download Farbar Recovery Scan Tool and save it to your flash drive.

note: you will need the 32-bit version to run with UBCD4Win

Now plug your flash drive back into your sick computer and move on to the next step.

==========

Step 3 - booting to the UBCD4Win CD

Restart Your sick Computer Using the UBCD4Win Disc That You Have Created

• Insert the UBCD4Win disc in to one of your CD/DVD drives
• Restart your computer, the computer should choose to boot from the UBCD4Win CD automatically
• If it doesn't and you are asked if you want to boot from CD, then choose that option
  note: more information on booting from CD can be obtained here
• In the window that pops up select Launch The Ultimate Boot CD For Windows and press Enter
• It may take a little longer for the desktop to appear than it does when you start your computer normally, just let the process run itself until the desktop appears
• Once the desktop appears, you will receive a message asking: Do you want to start Network support?, click Yes
• You should now have a desktop that looks like this:
  
  

==========

Step 4 - running the FRST scan

• Single click My computer from your UBCD4Win desktop to navigate to the Farbar Recovery Scan Tool (FRST.exe) you saved to your flash drive.
• Double click on FRST.exe to begin running the tool
• When the tool opens click Yes to disclaimer
  note: if prompted to download the latest version, please do so from the link in Step 2
• Click on the Scan button
• It will make a log (FRST.txt) on the flash drive, close it and safely remove the USB drive
• Insert the USB drive into your clean computer and post the log in your next reply
  

[jmm157]

I downloaded the Ultimate Boot v3.6 and did the install. However, when I tried to create the image file, the process seemed to be running, but the UBCD4Win.iso file doesn't seem to exist. Two errors appear in the installation window:

Error: SetupDecompressOrCopyFile() “D:I386\FLTIB.DLL” to “C:\UBCD4Win\BarPE\I386\SYSTEM32\FLTLIB.DLL” 2: The system cannot find the file specified.

Warning: File “fltmgr.sys” not found.

 

Am I doing something wrong?

[Psychotic]

Reboot the computer and try again.

[jmm157]

I have restarted, but got the same errors.

[Psychotic]

I don´t know where this error comes from.

skip that - we have to try something else.

 

Try to boot into safe mode with command prompt and tell me if that works.

[jmm157]

When I booted into safe mode with command prompt, I got the same result as when I tried standard safe mode. The error I mentioned in the first post referring to memory addresses.

[Psychotic]

Create/Scan with Kaspersky Rescue Disk

Follow the instructions on this page for downloading the kav_rescue_10.iso (200 mb) file and creating the Kaspersky Rescue Disk.

Make sure you set to boot the machine from the CDRom drive first. Then save and exit the BIOS. The computer will begin to boot. Insert the disc in the CDrom drive, then restart the machine. It should then boot from that CD.

It's best if you refer to the instructions and images at Kaspersky How to record Kaspersky Rescue Disk 10 to a CD/DVD and boot my computer from the disk?

Once it boots from CD, press a key so it continues to boot from that CD.

Select the language, then be sure to select Kaspersky Rescue Disk Graphic Mode.

Kaspersky should begin scanning your machine. If it finds infection, look carefully at the files it lists. If any of them seem to be legit files, do not allow it to clean/quarantine/delete them. Rather, save the log and post the results for me to look over.

[jmm157]

I created the Kapersky Rescue Disk 10. When I attempted to run this, it failed as well. It showed a malfunction; number 9ABE003. When I looked for that, their website showed this: Unfortunately, this product does not have error description yet.

 

Maybe I should just rebuild the PC from scratch?

[Psychotic]

I think that would be better under this circumstances.

None of our possibilities work here.

 

I´m sorry that I have no better news for you.

[AdvancedSetup]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.