Malware Discussions

[nasroo7]

Hi everyone.

   After I uninstall Trend Micro from my Windows 7, and restart the computer...

I have a BSOD at Windows Log In.

I cannot access windows anymore...

I did a windows restore to an earlier point of time, and it solved the problem, but Trend micro comes back.

And when I uninstall it, I have the same BSOD each time!

I tried removing it using the Add/Remove program, and the Uninstall from the Start Menu...

And each time did a restore to an earlier point of time to be able to access windows back.

Here is the BSOD... what's wrong ?? Why uninstalling Trend micro makes that??

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
  <EventID>41</EventID>
  <Version>2</Version>
  <Level>1</Level>
  <Task>63</Task>
  <Opcode>0</Opcode>
  <Keywords>0x8000000000000002</Keywords>
  <TimeCreated SystemTime="2012-02-16T21:03:15.378013900Z" />
  <EventRecordID>24178</EventRecordID>
  <Correlation />
  <Execution ProcessID="4" ThreadID="8" />
  <Channel>System</Channel>
  <Computer>Inspiron545s</Computer>
  <Security UserID="S-1-5-18" />
  </System>
- <EventData>
  <Data Name="BugcheckCode">209</Data>
  <Data Name="BugcheckParameter1">0x10</Data>
  <Data Name="BugcheckParameter2">0x2</Data>
  <Data Name="BugcheckParameter3">0x0</Data>
  <Data Name="BugcheckParameter4">0xfffff88001467a26</Data>
  <Data Name="SleepInProgress">false</Data>
  <Data Name="PowerButtonTimestamp">0</Data>
  </EventData>
  </Event>

[malwarekiller]

Welcome aboard! 

 I would need some logs to analyze first....

• Download RogueKiller and save it on your desktop.  
•     Quit all programs 
•     Start RogueKiller.exe.  
•     Wait until Prescan has finished ... 
•     Click on Scan

  
   

• Wait for the end of the scan.   
•     The report has been created on the desktop.   
•     Click on the Delete button.

  
   

• The report has been created on the desktop.

• Next click on the ShortcutsFix  
    
    
• The report has been created on the desktop.

Please post:  
  
All RKreport logs located on your desktop.

NEXT

Download OTL  to your Desktop.

http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Select All Users
• Under the Custom Scan box paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
consrv.dll
explorer.exe

netbt.sys

atapi.sys

volsnap.sys

redbook.sys

lsi_sas.sys

lsi_scsi.sys

cdrom*

tcpip.sys
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS /s
C:\Windows\assembly\tmp\U\*.* /s

C:\Program Files\Common Files\ComObjects\*.* /s
CREATERESTOREPOINT

• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • attach both logs

 NEXT

Download aswmbr.exe ( 1.8mb ) to your desktop. 

http://public.avast.com/~gmerek/aswMBR.htm
 Double click the aswMBR.exe to run it  Click the "Scan" button to start scan.

• 

• Click the [Scan] button to start scan

  

• On completion of the scan click [Save log], save it to your desktop and post in your next reply.

[BULLDOG]

I am sorry to hear what had happened. However may I know what version of Trend Micro are you trying to uninstall from your computer? It would be advisable to do it using the toolkit designed to remove the program. Kindly reply to this thread in order for us to provide you the tool. And you may also try doing the uinstallation under safe mode. Just restart the pc and tap on f8 until the safeboot options appear. Just choose safemode with networking if in case that you need to access internet. 

[nasroo7]

Thank you for your reply!

During the scan of RogueKiller, I had the following error messages:

insert a disk in device/hardisk1/roguekiller1

device/hardisk2/roguekiller2

device/hardisk3/roguekiller3

"Cancel - Retry - Continue"

Retry or continue were bringing back the same message, so I clicked on "Cancel for all 3 of them.

So, here is the logs that you asked me for, and thank you a lot for your help

RogueKiller V7.1.0 [02/15/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: Barney [Admin rights]
Mode: Scan -- Date: 02/17/2012 11:13:54

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 2 ¤¤¤
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Infection :  ¤¤¤

¤¤¤ HOSTS File: ¤¤¤


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD7501AALS-75J7B0 ATA Device +++++
--- User ---
[MBR] eeddcacaacfc745e2028651668032db7
[BSP] 78d1458a061e8023b1f4af5585d46458 : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 15000 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 30801920 | Size: 700363 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[1].txt >>
RKreport[1].txt

RogueKiller V7.1.0 [02/15/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: Barney [Admin rights]
Mode: Remove -- Date: 02/17/2012 11:14:34

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 2 ¤¤¤
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Infection :  ¤¤¤

¤¤¤ HOSTS File: ¤¤¤


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD7501AALS-75J7B0 ATA Device +++++
--- User ---
[MBR] eeddcacaacfc745e2028651668032db7
[BSP] 78d1458a061e8023b1f4af5585d46458 : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 15000 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 30801920 | Size: 700363 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt

RogueKiller V7.1.0 [02/15/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: Barney [Admin rights]
Mode: Shortcuts HJfix -- Date: 02/17/2012 11:16:28

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ File attributes restored: ¤¤¤
Desktop: Success 1 / Fail 0
Quick launch: Success 1 / Fail 0
Programs: Success 16 / Fail 0
Start menu: Success 1 / Fail 0
User folder: Success 88 / Fail 0
My documents: Success 0 / Fail 0
My favorites: Success 0 / Fail 0
My pictures: Success 0 / Fail 0
My music: Success 0 / Fail 0
My videos: Success 0 / Fail 0
Local drives: Success 629 / Fail 0
Backup: [NOT FOUND]

Drives:
[C:] \Device\HarddiskVolume3 -- 0x3 --> Restored
[D:] \Device\CdRom0 -- 0x5 --> Skipped
[E:] \Device\HarddiskVolume4 -- 0x2 --> Restored
[F:] \Device\HarddiskVolume5 -- 0x2 --> Restored
[G:] \Device\HarddiskVolume6 -- 0x2 --> Restored
[H:] \Device\HarddiskVolume7 -- 0x2 --> Restored

¤¤¤ Infection :  ¤¤¤

Finished : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt

[nasroo7]

I couldn't past the other logs, so I tried to attach them.

Please confirm if you got them.

THank you

[malwarekiller]

Hi your logs are clean!

U can just simply delete the tools we used....

[malwarekiller]

Please follow the instructions given here:

http://windows.microsoft.com/en-us/windows7/Update-a-driver-for-hardware-that-isnt-working-properly

[nasroo7]

H, thank you for your reply

I did try to uninstall Trend Micro Internet Security in Safe mode, but I had an error message telling me that I cannot delete it under Safe Mode, but only with Normal mode (From Add or Remove program)

And same thing from the Start Menu > Uninstall Trend micro.

I have Trend Micro Internet Security, wih Windows 7 64bits.

Right now, I have the Trend Micro icons, and on the Start Menu (All programs) But I cannot execute it.

If I double click on any icon if it, nothing happens.

And I don't see it in the Process tab of Task Manager.

But that's all I have tried.

I just ran the scans asked on the top.

[nasroo7]

Thank you again malwarekiller

So, I checked my Device Manager and I found a "Microsoft Virtual Wifi Mini POrt adapter" that has an error code 31.

I ran the Windows updates, and I will try to update that driver if I can...

[malwarekiller]

Here u have a trend uninstaller try it:

 TrendMicro > Info > Tool (32bit) - Tool (64 bit)