Fake BSOD

[unfaithfulsfan]

Hi all, haven't had a chance to visit much in the last week or so. I think I'm having withdrawals. and here I was thinking it was all the pain meds

Anyway, I've got a nasty virus infection on a customer's computer which includes Windows Antivirus 2008 and something new, to me at least, Fake BSODs. Everything from BAD_POOL_ERROR to BOGUS_DRIVER to PANIC_SWITCH.

I read on MS forums that SmitRem will take care of Windows AV (I'm still working my way towards that) but I don't know if that will solve the blue screen problems. Anyone else encountered this ?

Thanks!
Jack

[martini161]

if the virus has already managed to get that deep into the system you will probably have to do a total reinstall

[duplo83]

The best luck I've had against really tough virus' is to find where they're located on the hard drive and manually change their file type, it renders them completely useless and will enable you to delete them. The tricky part is usually tracking them down. Once I find them I rename them to something like .jpeg or .mp3 from their .dll or.exe form and it completely breaks them. I haven't yet encountered a virus that is impervious to this, it has always worked for me.

Good Luck!!

[unfaithfulsfan]

Well, it seems I got it fixed (I think )

The BSOD turned out to be a bogus screensaver with a script to restart the computer after a certain amount of time. Pretty inventive, I think. You could just hit "esc" to cancel the script and return to Windows. (Found that out by accident)

Anyway, here's how I fixed it:
First I ran Dr Web CureIt in safe mode which found a couple of hundred items
Then I ran it in normal mode and it found a dozen or so more
Then I ran SuperAntiSpyware in Safe then normal modes and found yet another 300 registry items including the .vbs script pointers
Then I ran Spybot Search and Destroy and it found the BSOD files, a couple of more scripts and the Windows AntiVirus 2008 files

It's been idling for about 30 minutes with no problems so maybe I got everything. Still slow as constipated crap with 256 MB of RAM Customer is older guy on oxygen so upgrades aren't his big priority. Now keeping his grandkids off the computer is more important

Thanks!
Jack

[unfaithfulsfan]

oops, forgot one step. Ran SmitRem in both normal and Safe modes before SuperAntiSpyware

[DMB2000uk]

I happen to like that BSOD screensaver

Are you sure it was actually restarting the PC and wasn't part of the screensaver? (as that is what it normally does )

Dan

[martini161]

you have just opened up a whole new world of practical computer jokes to me the possibilities are endless!

[vbironchef]

That is good news. Maybe run CC Cleaner to make it run a little faster. I use PC pitstop to optimize my internet connection. I am going to save your thread because I never heard of the programs that you ran. Thanks!

[XstollieX]

you have just opened up a whole new world of practical computer jokes to me the possibilities are endless!

I like that idea where can I get those. I've got some freinds that i want to give it too

[bigblockmatt]

interesting you bring this up. my dad decided to open an email and download some program that he thought was from UPS. it first installed antivirus xp08 or something like that, then proceeded to do the BSOD and restart thing. at first i was like thought he royally messed something up. but after watching it for a minuted something didnt seem right so i just started to hit some buttons and i hit control and it went away. it made sense it was fake cause it would only come up when you let it sit idle... i found this site http://forums.techguy.org/malware-remov ... win32.html and followed the directions and it cleaned it up.

ps. the best part is my dad did it at home and work (he is a mortgage broker so his work computer is his own, no tech support - well i guess i am his tech support, lucky me). so now that i fixed his laptop, i get to do the same with his work desktop...