Possible Virus

[casey13]

Sorry for the lack of information and this is sort of pieced together. I don't have the computer in front of me and she doesn't have the computer in front of her.

Background: Windows Vista Home Premium, doubt it's been updated. Norton is expired for a few months and had I known she was using it, I would have pointed her to AVG. She was using some sort of online scanner. Firefox ticked her off when it would close when she'd sign out of Yahoo! so she started using IE (not updated.)

Well, apparently her notebook has been crashing and she didn't really care because it would start up with the black menu that suggests starting in safe mode if she doesn't know the cause of it. However, it just started displaying the Blue Screen of Death when it tried to load Windows. I heard about it from my mother and I complained that it was probably a driver or software issue and not covered under Best Buy's warranty. My sister still took it to Best Buy.

Best Buy thinks it is a virus. Maybe it is as it has been crashing when she uses it.

Not expecting anyone to be able to troubleshoot it with this much information. I am going to try to get her to write down the BSD message, but it restarts really quickly after displaying it.

I am trying to get her to boot into safe mode. She doesn't know if it'll work as she didn't try it before taking it into Best Buy.

She does have access to Windows 7 discs and she is thinking of installing it by reformatting the hard drive. She has a few stuff that she would like, but she is ok with this option. Hopefully if it comes to this, the virus is just in the software files and doing a long reformat would kill the virus along with the rest of the data. Just hoping it's not in the BIOS, but that would be very odd if it was.

Any advice on what I should have her try. As soon as I have the BSD, I think I'd know more. I am kind of wary of what the Geek Squad says from personal experience.

[Jack]

Go to Start > Run > "sysdm.cpl"

Go to Advanced tab

Under Startup and Recovery, click Settings

Uncheck the Automatically Restart box

Set "Write debugging information" to "Small memory dump" and ensure the path below is %SystemRoot%\Minidump

Induce the BSOD or wait for it to happen again. If possible, induce it or allow it to happen at least twice.

Disabling automatic restart will allow you to see any STOP codes or filenames on the BSOD.

Go to C:\WINDOWS\Minidump and get the two latest files. Upload them to a free file host and link to them and we'll see what's up.

Also, malware in BIOS is very unlikely. It's possible, but it's the sort of thing you hear of lofty and unknown researchers doing in some sort of intimidating computer science lab. Nothing that's among consumer-grade malware currently. The most you might get is a rootkit in the MBR, but that can be removed without reformatting.

[lordlundar]

She does have access to Windows 7 discs and she is thinking of installing it by reformatting the hard drive. She has a few stuff that she would like, but she is ok with this option.

Along those lines, it would be the better option IMO. If you can access the files, put them on a removable media (external HDD, flash, drive, cd/dvd, etc) and run a scan on them on another machine with an up to date scanner. Dump any infected files and do the format (full format through an XP disk if you can swing it), shut the machine off for a couple hours to purge the RAM, then do the Win7 install.

BSOD's are usually when windows is handling operations, not the BIOS, so it's unlikely the BIOS is infected.