Malware or Broken Windows Vista Install? Symptoms and Chronology

Case Study a Possible Virus / Windows Vista Failure

I have been retained to remove a Windows virus. Here are some notes to assist others.

A Windows Vista computer with all patches applied regularly exhibits these symptoms while booted fully:

• Browser connections time out 
• Nothing can be installed as the shell has been taken over (.EXE launches produce an error message) 
• AVI 2004 had been disabled but was re-enabled and is "working" 
• The network is working: local and WAN pings succeed
• Email traffic is normal 

What's been tried so far: 

• Restore failed. This could be a Windows issue particular to this machine, or possibly one caused by the malware. Detailed logs were not examined as the problem predated the infection.
• Booting into Safe mode allowed for AVG 2014 to be re-enabled, both while in Safe Mode and upon return to normal mode 
• Malwarebytes found no errors in Safe Mode, but did hang after scanning about 28,000 objects 
• Hitmanpro ran to completion with Malwarebytes disabled and did not find any errors.
• The shell open registry keys were checked, and they are OK (recall that EXE's can be run in safe mode)

The symptoms are evident during full Windows mode, not safe mode. 

Strategy

I used some of the tactics used by William Rowland (Jan 2013), though the Safe mode block reported there is not one of the symptoms for this attack.

Result 

None of the safe mode tools proposed by W.R. turned up anything definitive. There were additional suggested tests that might have been fruitful, but as mentioned, running on "unsafe" mode was not possible -- especially Windows repair solutions -- none of which could be run in the operable safe mode.

A time-consuming Windows reinstallation was the only alternative.

When a PC is not Point-and-Shoot: WHEA-Logger EventID 17

When everything's working smoothly, a PC seems a simple device, like a toaster, or, to use a better example, like a digital camera. Turn it on, launch an application, do work, and turn it off. A smoothly working PC offers its own quietly efficient version of Point and Shoot. 

Beneath the covers, with both devices, but more so with today's PC, a lot needs to go right to produce the appearance of a carefree toaster-like experience. Some problems are comparatively common (if not frequent) but straightforward to diagnose and correct. Disk drives still fail, and for most, while SMART doesn't generally provide warning of pending failure, it's usually obvious when it happens and the corrective action is also obvious. But once in awhile, problems arise that are a reminder of how much complexity lies beneath that ever-thinner chassis.

An incident in this latter category has been occurring with an HP Elitebook 8540p laptop. Several times a minute, Windows 7 throws this exception to the event log:

Event 17, WHEA-Logger
Component: PCI Express Root Port
Error Source: Advanced Error Reporting (PCI Express)
Bus: Device:Function: 0x0:0x3:0x0
Vendor ID:Device ID: 0x8086:0xd138
Class Code: 0x30400

More details are provided by Windows in the full WMI-interfaced Windows Hardware Error Architecture (WHEA) message. There were several problems with the laptop that could have been related to this error, which was thrown at least several times a minute, and sometimes more often depending on what processing was occurring. These included infrequent blue screens, fairly frequent glitching in pro audio devices (e.g., Echo AudioFire Pre8 and Ableton Live, as well as various USB audio devices), and an unsatisfactory rating by the Echo-recommended DPC Latency Checker.

Over several months, HP support and I worked on this issue. New device drivers were tried, USB device drivers were removed and added, self-tests and diagnostics were run. Nothing turned up. Finally, the hated "reinstall Windows" suggestion reared its head. Since everything else had been tried, the partition was erased and Windows 7 x64 was reinstalled. Result? Even before all the HP utilities were reinstalled, the problem recurred.

The last HP technician suggested it could be an issue with the Nvidia NVS 5100M discrete graphics card. There are two related threads in forums that illustrate the scope and diligence of some users in trying to resolve this error. One is in NotebookReview (more related to Asus motherboard problems) and the other in an Intel Community forum (where most of the blame was laid at the feet of AMD ATI graphics cards.

The laptop is off to HP for a repair attempt. Stay tuned. In the meantime, should this post have appeared in TechnologyHead.com or in ErrorProcessing.com? Arguing in favor of the later, for instance, were several remarks by hardware technicians consulted by worried forum posters that "these problems didn't used to be reported anyway, and can easily be ignored." Arguing in favor of TechnologyHead was the aspect of complexity; after all, the error message was close to what passes for best practice these days in error reporting (if not recovery).